Baseline Alignment

---
name: "Inforcer Baseline Alignment"
description: >
  Inforcer's core drift-detection surface: baseline templates, tenant
  alignment scores, alignment details (the per-policy breakdown of a tenant
  against its assigned baseline), and reading deployed tenant policy state.
  Read-only.
when_to_use: >-
  When listing baseline templates, reading a tenant's alignment score, or inspecting
  per-policy drift against an assigned baseline.
  Use when: inforcer baseline, baseline template, tenant alignment, alignment
  score, alignment details, policy drift, drift detail, or tenant policies.
---

# Inforcer Baseline Alignment & Drift

Inforcer's central idea: each managed tenant is measured against an
assigned **security baseline** (a template of policy settings). The gap
between the tenant's deployed state and that baseline is **drift**. This
skill covers listing baselines, reading alignment scores, and — most
importantly — pulling the **per-policy alignment details** that show
exactly where a tenant has drifted.

Read [api-patterns](../api-patterns/SKILL.md) for headers, region, the
envelope, and pagination, and [tenant-management](../tenant-management/SKILL.md)
for resolving a tenant to its integer Client Tenant ID. Every
alignment/policy call is tenant-scoped by that integer id.

## Anti-triggers

- **Fixing the drift** — Inforcer's API cannot deploy a policy,
  remediate, or restore configuration; those exist only in the Inforcer
  UI. The M365 changes themselves are `cipp-users`, `cipp-security`, or
  `cipp-standards`, and CIPP's `Remediate`-mode standards are the
  auto-fix mechanism Inforcer lacks.
- **CIPP's version of "baseline" and "drift"** — CIPP standards and
  BPA measure a different template with different findings; the two
  scores are not comparable. Use `cipp-standards`.
- **The threshold that turns a score into aligned / semi-aligned /
  drifted** — that classification lives in
  `inforcer-compliance-reporting`.
- **What change caused a drift** — the alignment surface shows state,
  not history; use `inforcer-audit-events`.

## Tools

### `inforcer_baselines_list`

List the security **baseline templates** defined in Inforcer. Returns
baseline objects (id, name, and the policy settings each baseline
prescribes). Baselines are the "golden" definition a tenant is compared
against.

```
inforcer_baselines_list()
```

### `inforcer_alignment_scores`

Read the **alignment score** for a tenant — the headline measure of how
closely the tenant matches its assigned baseline.

```
inforcer_alignment_scores(clientTenantId=1423)
```

Use this for the at-a-glance "how aligned is this tenant?" answer. Score
classification (aligned / semi-aligned / drifted) is threshold-driven —
see [compliance-reporting](../compliance-reporting/SKILL.md).

### `inforcer_alignment_details`

Pull the **per-policy drift breakdown** — the detailed list of how each
policy in the tenant compares to the baseline. This is where you see
*which* policies are aligned and *which* have drifted, not just the
aggregate score.

```
inforcer_alignment_details(clientTenantId=1423)
```

Returns, per policy, the baseline-expected state and the tenant's actual
state so you can pinpoint exactly what diverged. This is the primary
input to any drift report.

### `inforcer_policies_list`

List the **deployed policy state** for a tenant (read-only). Shows what
policies are actually in place on the tenant, independent of the
baseline comparison.

```
inforcer_policies_list(tenant="Acme")
```

The `tenant` argument accepts a friendly name, a DNS name, an Azure AD
tenant GUID, or the numeric Client Tenant ID; the server resolves the
first three to the numeric id before calling Inforcer.

Use this to inspect the tenant's real configuration when an alignment
detail is ambiguous, or to confirm what is actually deployed.

## What to look for in an alignment review

| Finding | Why it matters |
|---------|----------------|
| Low alignment score | The tenant has drifted materially from its baseline; investigate `inforcer_alignment_details` |
| Policy present in baseline but absent on tenant | A required control was never deployed or was removed |
| Policy deployed but with weaker settings than baseline | Silent weakening — looks "configured" but doesn't meet baseline |
| Many small drifts vs one critical drift | Triage by control impact, not count — one missing MFA/identity control outweighs many cosmetic diffs |
| Tenant with no assigned baseline | Nothing to measure against; alignment is meaningless until a baseline is assigned |

## Workflow patterns

### Single-tenant drift deep-dive

```
ctid    = resolve("Acme")                 # integer Client Tenant ID
score   = inforcer_alignment_scores(clientTenantId=ctid)
details = inforcer_alignment_details(clientTenantId=ctid)
drifted = [p for p in details if p['aligned'] is False]
```

Start from the score for the headline, then read `alignment_details` to
list the drifted policies. Cross-reference `inforcer_policies_list`
when you need the tenant's actual deployed value for a policy.

### Portfolio drift sweep

For each tenant from `inforcer_tenants_list`, pull
`inforcer_alignment_scores`, then drill into `inforcer_alignment_details`
only for tenants below an alignment threshold. This keeps the sweep
cheap while still surfacing the per-policy detail where it matters. Page
`continuationToken` to completion on every list.

## Caveats

- Inforcer's API is **read-only** for alignment. You can **see** drift in
  full detail, but you **cannot** deploy a policy, remediate the drift,
  or restore configuration through the API. Those actions exist only in
  the Inforcer UI — surface them as recommendations, never as something
  this plugin performs.
- The API is **community-sourced** (no official public docs); field
  names such as `aligned` and the exact `alignment_details` shape are
  illustrative and credited to
  [`royklo/InforcerCommunity`](https://github.com/royklo/InforcerCommunity).
- Alignment is only meaningful relative to an **assigned** baseline; a
  tenant with no baseline assigned cannot be scored.

## Related Skills

- [tenant-management](../tenant-management/SKILL.md) - resolve a tenant to the integer Client Tenant ID before scoping
- [compliance-reporting](../compliance-reporting/SKILL.md) - how alignedThreshold / semiAlignedThreshold classify aligned / semi-aligned / drifted
- [assessments](../assessments/SKILL.md) - run an assessment to refresh the data that feeds alignment
- [api-patterns](../api-patterns/SKILL.md) - envelope, pagination, and the integer-id gotcha