git:20260804.f49efe8 to git:20260806.2d05ac2

---

name: "Inforcer Baseline Alignment"

description: >

Inforcer's core drift-detection surface: baseline templates, tenant

alignment scores, alignment details (the per-policy breakdown of a tenant

against its assigned baseline), and reading deployed tenant policy state.

Read-only.

when_to_use: >-

When listing baseline templates, reading a tenant's alignment score, or inspecting

per-policy drift against an assigned baseline.

Use when: inforcer baseline, baseline template, tenant alignment, alignment

score, alignment details, policy drift, drift detail, or tenant policies.

---

# Inforcer Baseline Alignment & Drift

Inforcer's central idea: each managed tenant is measured against an

assigned **security baseline** (a template of policy settings). The gap

between the tenant's deployed state and that baseline is **drift**. This

skill covers listing baselines, reading alignment scores, and — most

importantly — pulling the **per-policy alignment details** that show

exactly where a tenant has drifted.

Read [api-patterns](../api-patterns/SKILL.md) for headers, region, the

envelope, and pagination, and [tenant-management](../tenant-management/SKILL.md)

for resolving a tenant to its integer Client Tenant ID. Every

alignment/policy call is tenant-scoped by that integer id.

## Anti-triggers

- **Fixing the drift** — Inforcer's API cannot deploy a policy,

remediate, or restore configuration; those exist only in the Inforcer

UI. The M365 changes themselves are `cipp-users`, `cipp-security`, or

`cipp-standards`, and CIPP's `Remediate`-mode standards are the

auto-fix mechanism Inforcer lacks.

- **CIPP's version of "baseline" and "drift"** — CIPP standards and

BPA measure a different template with different findings; the two

scores are not comparable. Use `cipp-standards`.

- **The threshold that turns a score into aligned / semi-aligned /

drifted** — that classification lives in

`inforcer-compliance-reporting`.

- **What change caused a drift** — the alignment surface shows state,

not history; use `inforcer-audit-events`.

## Tools

### `inforcer_baselines_list`

List the security **baseline templates** defined in Inforcer. Returns

baseline objects (id, name, and the policy settings each baseline

prescribes). Baselines are the "golden" definition a tenant is compared

against.

```

inforcer_baselines_list()

```

### `inforcer_alignment_scores`

Read the **alignment score** for a tenant — the headline measure of how

closely the tenant matches its assigned baseline.

```

inforcer_alignment_scores(clientTenantId=1423)

```

Use this for the at-a-glance "how aligned is this tenant?" answer. Score

classification (aligned / semi-aligned / drifted) is threshold-driven —

see [compliance-reporting](../compliance-reporting/SKILL.md).

### `inforcer_alignment_details`

Pull the **per-policy drift breakdown** — the detailed list of how each

policy in the tenant compares to the baseline. This is where you see

*which* policies are aligned and *which* have drifted, not just the

aggregate score.

```

inforcer_alignment_details(clientTenantId=1423)

```

Returns, per policy, the baseline-expected state and the tenant's actual

state so you can pinpoint exactly what diverged. This is the primary

input to any drift report.

List the **deployed policy state** for a tenant (read-only). Shows what

policies are actually in place on the tenant, independent of the

baseline comparison.

```

```

Use this to inspect the tenant's real configuration when an alignment

detail is ambiguous, or to confirm what is actually deployed.

## What to look for in an alignment review

| Finding | Why it matters |

|---------|----------------|

| Low alignment score | The tenant has drifted materially from its baseline; investigate `inforcer_alignment_details` |

| Policy present in baseline but absent on tenant | A required control was never deployed or was removed |

| Policy deployed but with weaker settings than baseline | Silent weakening — looks "configured" but doesn't meet baseline |

| Many small drifts vs one critical drift | Triage by control impact, not count — one missing MFA/identity control outweighs many cosmetic diffs |

| Tenant with no assigned baseline | Nothing to measure against; alignment is meaningless until a baseline is assigned |

## Workflow patterns

### Single-tenant drift deep-dive

```

ctid = resolve("Acme") # integer Client Tenant ID

score = inforcer_alignment_scores(clientTenantId=ctid)

details = inforcer_alignment_details(clientTenantId=ctid)

drifted = [p for p in details if p['aligned'] is False]

```

Start from the score for the headline, then read `alignment_details` to

when you need the tenant's actual deployed value for a policy.

### Portfolio drift sweep

For each tenant from `inforcer_tenants_list`, pull

`inforcer_alignment_scores`, then drill into `inforcer_alignment_details`

only for tenants below an alignment threshold. This keeps the sweep

cheap while still surfacing the per-policy detail where it matters. Page

`continuationToken` to completion on every list.

## Caveats

- Inforcer's API is **read-only** for alignment. You can **see** drift in

full detail, but you **cannot** deploy a policy, remediate the drift,

or restore configuration through the API. Those actions exist only in

the Inforcer UI — surface them as recommendations, never as something

this plugin performs.

- The API is **community-sourced** (no official public docs); field

names such as `aligned` and the exact `alignment_details` shape are

illustrative and credited to

[`royklo/InforcerCommunity`](https://github.com/royklo/InforcerCommunity).

- Alignment is only meaningful relative to an **assigned** baseline; a

tenant with no baseline assigned cannot be scored.

## Related Skills

- [tenant-management](../tenant-management/SKILL.md) - resolve a tenant to the integer Client Tenant ID before scoping

- [compliance-reporting](../compliance-reporting/SKILL.md) - how alignedThreshold / semiAlignedThreshold classify aligned / semi-aligned / drifted

- [assessments](../assessments/SKILL.md) - run an assessment to refresh the data that feeds alignment

- [api-patterns](../api-patterns/SKILL.md) - envelope, pagination, and the integer-id gotcha