/tenant-compliance

name: "ImmyBot Tenant & Compliance Reporting"
description: >
  ImmyBot tenants (client organizations) and fleet-wide reporting: the tenant
  and background-task tool surfaces, the per-tenant compliance scorecard and
  fleet task-queue audit procedures, and how to assemble a client QBR report
  from stats, compliance, software inventory, and failed-task history.
when_to_use: >-
  When working with ImmyBot tenants (client organizations), reviewing per-tenant compliance
  dashboards, software inventory rollups, or auditing background task queues across the fleet. Use
  when: immybot tenant, immybot client organization, immybot compliance report, immybot tenant
  stats, immybot task queue, immybot failed tasks, or immybot fleet report.

ImmyBot Tenant & Compliance Reporting

Tenants are ImmyBot's client organizations. This skill covers tenant-level queries, compliance rollups, and the background-task queue that powers fleet-wide operational and QBR reporting.

Anti-triggers

• **Regulatory or framework compliance** — "compliance" here means

installed software matches desired state, nothing more. CIS, NIST, and SOC 2 control mapping is `scalepad-controlmap`; Microsoft 365 security baselines are `cipp-standards`.

• **A Microsoft 365 or Entra tenant** — an ImmyBot tenant is a client

organization inside this ImmyBot instance and is unrelated to an M365 tenant ID, even though ImmyBot authenticates via Entra. Use `cipp-tenants`.

• **Fixing what the report shows** — this skill reports; remediation is

`immybot-software-deployment` and `immybot-maintenance-sessions`.

Tenant API Tools

| Tool | Purpose | |------|---------| | `immybot_tenants_list` | List tenants with name/status filters | | `immybot_tenants_get` | Full detail for one tenant by ID | | `immybot_tenants_search` | Search tenants by name | | `immybot_tenants_stats` | Statistics for a tenant | | `immybot_tenants_computers` | Computers belonging to a tenant | | `immybot_tenants_deployments` | Deployments scoped to a tenant | | `immybot_tenants_compliance` | Compliance dashboard data for a tenant | | `immybot_tenants_software_inventory` | Software inventory rollup for a tenant |

Task Queue API Tools

| Tool | Purpose | |------|---------| | `immybot_tasks_list` | Background tasks with computer/tenant/status/type filters | | `immybot_tasks_get` | Detail for one task | | `immybot_tasks_running` | All currently running tasks | | `immybot_tasks_queued` | Tasks waiting for execution | | `immybot_tasks_failed` | All failed tasks | | `immybot_tasks_for_computer` | Tasks for a specific computer | | `immybot_tasks_for_tenant` | Tasks for a specific tenant | | `immybot_tasks_by_type` | Tasks of a given type (SoftwareInstall, ScriptExecution, …) | | `immybot_tasks_queue_stats` | Task queue statistics | | `immybot_tasks_history` | Task execution history over a date range |

Per-Tenant Compliance Scorecard

1. `immybot_tenants_search` → resolve the tenant. 2. `immybot_tenants_get` and `immybot_tenants_stats` for the overview (computer count, status). 3. `immybot_tenants_compliance` for the compliance rollup — which deployments are met vs failing. 4. Drill into failing deployments with `immybot_deployments_compliance`. 5. `immybot_tenants_software_inventory` to confirm what is actually installed across the tenant.

Fleet Task-Queue Audit

1. `immybot_tasks_queue_stats` for the high-level picture. 2. `immybot_tasks_failed` — every failure across the fleet. 3. `immybot_tasks_running` and `immybot_tasks_queued` for current load and backlog. 4. For a problem client, `immybot_tasks_for_tenant` to scope the failures. 5. `immybot_tasks_history` over a date range for trend reporting.

Building a Client QBR Report

For each tenant, assemble:

• Computer count and online ratio (`immybot_tenants_stats`,

`immybot_tenants_computers`).

• Compliance percentage and failing deployments

(`immybot_tenants_compliance`).

• Software inventory highlights — required software present,

outdated packages (`immybot_tenants_software_inventory`).

• Recent failed tasks and how they were resolved

(`immybot_tasks_failed`, `immybot_tasks_history`).

Present per-tenant so the technician knows which client each finding belongs to.

Best Practices

• Always scope task and compliance queries by tenant when reporting

to a specific client — unscoped results span the whole MSP.

• Treat a low compliance percentage as a remediation backlog: route

failing deployments into a maintenance session.

• Track failed-task trends over time, not just the current snapshot,

to catch recurring issues.

Related Skills

• [software-deployment](../software-deployment/SKILL.md) — fix failing deployments
• [maintenance-sessions](../maintenance-sessions/SKILL.md) — reconcile non-compliant tenants
• [endpoint-management](../endpoint-management/SKILL.md) — drill into individual computers