/compliance-reporting

name: "Inforcer Compliance Reporting"
description: >
  Inforcer compliance and posture reporting: per-tenant Microsoft 365 secure
  scores, combining them with alignment scores, and the alignedThreshold /
  semiAlignedThreshold settings that classify each tenant or policy as
  aligned, semi-aligned, or drifted. Covers portfolio posture roll-ups across
  the MSP's managed tenants.
when_to_use: >-
  When producing Inforcer security posture or compliance reports for one tenant or the
  whole portfolio. Use when: inforcer secure score,
  compliance report, posture report, aligned threshold, semi-aligned, drifted classification,
  portfolio posture, or secure score per tenant.

Inforcer Compliance Reporting

This skill turns Inforcer's raw signals — secure scores and alignment — into a posture report. The headline output is a per-tenant classification (aligned / semi-aligned / drifted) rolled up across the portfolio, suitable for monthly internal reviews and QBRs.

Read [api-patterns](../api-patterns/SKILL.md) for headers, region, the envelope, and pagination, and [tenant-management](../tenant-management/SKILL.md) for resolving tenants to integer Client Tenant IDs. Alignment mechanics live in [baseline-alignment](../baseline-alignment/SKILL.md).

Anti-triggers

• **Per-policy drift detail** — this skill produces the classification

and the roll-up; *which* controls diverged is `inforcer-baseline-alignment`.

• **CIPP's compliance view** — BPA reports, standards compliance, and

domain health are a separate baseline with separate findings; use `cipp-standards`. Do not blend CIPP and Inforcer scores into one number.

• **Stale scores before a report** — refreshing the underlying data

means triggering an assessment run, the one write in this plugin; use `inforcer-assessments`.

Tools

`inforcer_secure_scores_get`

Read the Microsoft 365 **secure score** for a tenant — Microsoft's own security posture measure for the M365 environment.

inforcer_secure_scores_get(tenant="Acme")

The `tenant` argument accepts a friendly name, a DNS name, an Azure AD tenant GUID, or the numeric Client Tenant ID; the server resolves the first three to the numeric id before calling Inforcer.

Secure score is complementary to alignment: alignment says "does this tenant match *our* baseline?", secure score says "what does Microsoft think of this tenant's posture overall?". A strong report uses both.

`inforcer_alignment_scores`

Read the tenant's alignment score against its assigned baseline (the other half of the posture picture). See [baseline-alignment](../baseline-alignment/SKILL.md) for details.

inforcer_alignment_scores(clientTenantId=1423)

Classification: aligned / semi-aligned / drifted

Alignment classification is **threshold-driven**. Two configurable settings define the bands:

• `alignedThreshold`
• `semiAlignedThreshold`

A tenant (or an individual policy) is classified by comparing its alignment value against those thresholds:

| Classification | Condition | |----------------|-----------| | **aligned** | value `>= alignedThreshold` | | **semi-aligned** | value `>= semiAlignedThreshold` **and** `< alignedThreshold` | | **drifted** | value `< semiAlignedThreshold` |

So the bands are: at or above `alignedThreshold` is **aligned**; in the window `[semiAlignedThreshold, alignedThreshold)` is **semi-aligned**; below `semiAlignedThreshold` is **drifted**. Always state the threshold values you used in the report — a tenant's band is meaningless without the thresholds that produced it, and changing the thresholds reclassifies tenants without anything actually changing on the tenant.

def classify(value, aligned_threshold, semi_aligned_threshold):
    if value >= aligned_threshold:
        return "aligned"
    if value >= semi_aligned_threshold:
        return "semi-aligned"
    return "drifted"

Portfolio posture roll-up

For a fleet report:

1. `inforcer_tenants_list` — enumerate managed tenants (page to completion). 2. For each tenant's integer Client Tenant ID, pull `inforcer_alignment_scores` and `inforcer_secure_scores_get`. 3. Apply the `alignedThreshold` / `semiAlignedThreshold` classification to the alignment value. 4. Sort tenants drifted-first, then semi-aligned, then aligned, so the MSP triages the worst posture first. 5. Summarize: counts per band, lowest secure scores, and the tenants that are both drifted **and** low secure score (the priority list).

| Column | Source | |--------|--------| | Alignment score + band | `inforcer_alignment_scores` + thresholds | | Secure score | `inforcer_secure_scores_get` | | Classification | computed (aligned / semi-aligned / drifted) |

Caveats

• This surface is **read-only**. You can report posture but cannot

remediate it, deploy policies, or restore configuration via the API — those are UI-only. Report findings as recommendations.

• The API is **community-sourced** (no official public docs); the exact

field names for secure score, alignment value, and the threshold settings are illustrative and credited to [`royklo/InforcerCommunity`](https://github.com/royklo/InforcerCommunity).

• Don't present a band without its thresholds. If thresholds are

configured differently between runs, a tenant can "change band" with no real posture change — note the thresholds for reproducibility.

• Secure score and alignment measure different things; don't conflate

them. A high secure score with low alignment means Microsoft is happy but the tenant diverges from the MSP baseline (and vice versa).

Related Skills

• [baseline-alignment](../baseline-alignment/SKILL.md) - alignment scores and the per-policy drift detail behind the bands
• [tenant-management](../tenant-management/SKILL.md) - enumerate and resolve tenants for the roll-up
• [assessments](../assessments/SKILL.md) - run an assessment to refresh posture inputs
• [api-patterns](../api-patterns/SKILL.md) - envelope, pagination,