/baseline-alignment

name: "Inforcer Baseline Alignment"
description: >
  Inforcer's core drift-detection surface: baseline templates, tenant
  alignment scores, alignment details (the per-policy breakdown of a tenant
  against its assigned baseline), and reading deployed tenant policy state.
  Read-only.
when_to_use: >-
  When listing baseline templates, reading a tenant's alignment score, or inspecting
  per-policy drift against an assigned baseline.
  Use when: inforcer baseline, baseline template, tenant alignment, alignment
  score, alignment details, policy drift, drift detail, or tenant policies.

Inforcer Baseline Alignment & Drift

Inforcer's central idea: each managed tenant is measured against an assigned **security baseline** (a template of policy settings). The gap between the tenant's deployed state and that baseline is **drift**. This skill covers listing baselines, reading alignment scores, and — most importantly — pulling the **per-policy alignment details** that show exactly where a tenant has drifted.

Read [api-patterns](../api-patterns/SKILL.md) for headers, region, the envelope, and pagination, and [tenant-management](../tenant-management/SKILL.md) for resolving a tenant to its integer Client Tenant ID. Every alignment/policy call is tenant-scoped by that integer id.

Anti-triggers

• **Fixing the drift** — Inforcer's API cannot deploy a policy,

remediate, or restore configuration; those exist only in the Inforcer UI. The M365 changes themselves are `cipp-users`, `cipp-security`, or `cipp-standards`, and CIPP's `Remediate`-mode standards are the auto-fix mechanism Inforcer lacks.

• **CIPP's version of "baseline" and "drift"** — CIPP standards and

BPA measure a different template with different findings; the two scores are not comparable. Use `cipp-standards`.

• **The threshold that turns a score into aligned / semi-aligned /

drifted** — that classification lives in `inforcer-compliance-reporting`.

• **What change caused a drift** — the alignment surface shows state,

not history; use `inforcer-audit-events`.

Tools

`inforcer_baselines_list`

List the security **baseline templates** defined in Inforcer. Returns baseline objects (id, name, and the policy settings each baseline prescribes). Baselines are the "golden" definition a tenant is compared against.

inforcer_baselines_list()

`inforcer_alignment_scores`

Read the **alignment score** for a tenant — the headline measure of how closely the tenant matches its assigned baseline.

inforcer_alignment_scores(clientTenantId=1423)

Use this for the at-a-glance "how aligned is this tenant?" answer. Score classification (aligned / semi-aligned / drifted) is threshold-driven — see [compliance-reporting](../compliance-reporting/SKILL.md).

`inforcer_alignment_details`

Pull the **per-policy drift breakdown** — the detailed list of how each policy in the tenant compares to the baseline. This is where you see *which* policies are aligned and *which* have drifted, not just the aggregate score.

inforcer_alignment_details(clientTenantId=1423)

Returns, per policy, the baseline-expected state and the tenant's actual state so you can pinpoint exactly what diverged. This is the primary input to any drift report.

`inforcer_policies_list`

List the **deployed policy state** for a tenant (read-only). Shows what policies are actually in place on the tenant, independent of the baseline comparison.

inforcer_policies_list(tenant="Acme")

The `tenant` argument accepts a friendly name, a DNS name, an Azure AD tenant GUID, or the numeric Client Tenant ID; the server resolves the first three to the numeric id before calling Inforcer.

Use this to inspect the tenant's real configuration when an alignment detail is ambiguous, or to confirm what is actually deployed.

What to look for in an alignment review

| Finding | Why it matters | |---------|----------------| | Low alignment score | The tenant has drifted materially from its baseline; investigate `inforcer_alignment_details` | | Policy present in baseline but absent on tenant | A required control was never deployed or was removed | | Policy deployed but with weaker settings than baseline | Silent weakening — looks "configured" but doesn't meet baseline | | Many small drifts vs one critical drift | Triage by control impact, not count — one missing MFA/identity control outweighs many cosmetic diffs | | Tenant with no assigned baseline | Nothing to measure against; alignment is meaningless until a baseline is assigned |

Workflow patterns

Single-tenant drift deep-dive

ctid    = resolve("Acme")                 # integer Client Tenant ID
score   = inforcer_alignment_scores(clientTenantId=ctid)
details = inforcer_alignment_details(clientTenantId=ctid)
drifted = [p for p in details if p['aligned'] is False]

Start from the score for the headline, then read `alignment_details` to list the drifted policies. Cross-reference `inforcer_policies_list` when you need the tenant's actual deployed value for a policy.

Portfolio drift sweep

For each tenant from `inforcer_tenants_list`, pull `inforcer_alignment_scores`, then drill into `inforcer_alignment_details` only for tenants below an alignment threshold. This keeps the sweep cheap while still surfacing the per-policy detail where it matters. Page `continuationToken` to completion on every list.

Caveats

• Inforcer's API is **read-only** for alignment. You can **see** drift in

full detail, but you **cannot** deploy a policy, remediate the drift, or restore configuration through the API. Those actions exist only in the Inforcer UI — surface them as recommendations, never as something this plugin performs.

• The API is **community-sourced** (no official public docs); field

names such as `aligned` and the exact `alignment_details` shape are illustrative and credited to [`royklo/InforcerCommunity`](https://github.com/royklo/InforcerCommunity).

• Alignm