Inforcer Baseline Alignment

Inforcer Baseline Alignment & Drift

Inforcer's central idea: each managed tenant is measured against an assigned security baseline (a template of policy settings). The gap between the tenant's deployed state and that baseline is drift. This skill covers listing baselines, reading alignment scores, and — most importantly — pulling the per-policy alignment details that show exactly where a tenant has drifted.

Read api-patterns for headers, region, the envelope, and pagination, and tenant-management for resolving a tenant to its integer Client Tenant ID. Every alignment/policy call is tenant-scoped by that integer id.

Anti-triggers

• Fixing the drift — Inforcer's API cannot deploy a policy, remediate, or restore configuration; those exist only in the Inforcer UI. The M365 changes themselves are cipp-users, cipp-security, or cipp-standards, and CIPP's Remediate-mode standards are the auto-fix mechanism Inforcer lacks.
• CIPP's version of "baseline" and "drift" — CIPP standards and BPA measure a different template with different findings; the two scores are not comparable. Use cipp-standards.
• The threshold that turns a score into aligned / semi-aligned / drifted — that classification lives in inforcer-compliance-reporting.
• What change caused a drift — the alignment surface shows state, not history; use inforcer-audit-events.

Tools

inforcer_baselines_list

List the security baseline templates defined in Inforcer. Returns baseline objects (id, name, and the policy settings each baseline prescribes). Baselines are the "golden" definition a tenant is compared against.

inforcer_baselines_list()

inforcer_alignment_scores

Read the alignment score for a tenant — the headline measure of how closely the tenant matches its assigned baseline.

inforcer_alignment_scores(clientTenantId=1423)

Use this for the at-a-glance "how aligned is this tenant?" answer. Score classification (aligned / semi-aligned / drifted) is threshold-driven — see compliance-reporting.

inforcer_alignment_details

Pull the per-policy drift breakdown — the detailed list of how each policy in the tenant compares to the baseline. This is where you see which policies are aligned and which have drifted, not just the aggregate score.

inforcer_alignment_details(clientTenantId=1423)

Returns, per policy, the baseline-expected state and the tenant's actual state so you can pinpoint exactly what diverged. This is the primary input to any drift report.

inforcer_policies_list

List the deployed policy state for a tenant (read-only). Shows what policies are actually in place on the tenant, independent of the baseline comparison.

inforcer_policies_list(tenant="Acme")

The tenant argument accepts a friendly name, a DNS name, an Azure AD tenant GUID, or the numeric Client Tenant ID; the server resolves the first three to the numeric id before calling Inforcer.

Use this to inspect the tenant's real configuration when an alignment detail is ambiguous, or to confirm what is actually deployed.

What to look for in an alignment review

Workflow patterns

Single-tenant drift deep-dive

ctid    = resolve("Acme")                 # integer Client Tenant ID
score   = inforcer_alignment_scores(clientTenantId=ctid)
details = inforcer_alignment_details(clientTenantId=ctid)
drifted = [p for p in details if p['aligned'] is False]

Start from the score for the headline, then read alignment_details to list the drifted policies. Cross-reference inforcer_policies_list when you need the tenant's actual deployed value for a policy.

Portfolio drift sweep

For each tenant from inforcer_tenants_list, pull inforcer_alignment_scores, then drill into inforcer_alignment_details only for tenants below an alignment threshold. This keeps the sweep cheap while still surfacing the per-policy detail where it matters. Page continuationToken to completion on every list.

Caveats

• Inforcer's API is read-only for alignment. You can see drift in full detail, but you cannot deploy a policy, remediate the drift, or restore configuration through the API. Those actions exist only in the Inforcer UI — surface them as recommendations, never as something this plugin performs.
• The API is community-sourced (no official public docs); field names such as aligned and the exact alignment_details shape are illustrative and credited to royklo/InforcerCommunity.
• Alignment is only meaningful relative to an assigned baseline; a tenant with no baseline assigned cannot be scored.

Related Skills

• tenant-management - resolve a tenant to the integer Client Tenant ID before scoping
• compliance-reporting - how alignedThreshold / semiAlignedThreshold classify aligned / semi-aligned / drifted
• assessments - run an assessment to refresh the data that feeds alignment
• api-patterns - envelope, pagination, and the integer-id gotcha