Discover available Inforcer tools by domain. Returns tool names and descriptions for the selected domain. All tools are callable at any time — this is a help/discovery aid, not a prerequisite.

Check Inforcer API connectivity and available domains. Performs a live baselines.list() call as a read-only connectivity check.

List all managed tenants. Read-only.

Get a single tenant. Tenant identifier — accepts a numeric Client Tenant ID, a tenant DNS name, an Azure AD tenant GUID, or a friendly name. Resolved to the numeric Client Tenant ID before the request. Ambiguous names throw a clear error. Read-only.

Resolve a tenant name, DNS name, or Azure AD GUID to its numeric Inforcer Client Tenant ID (which is NOT the Azure AD tenant GUID). Read-only.

List baseline groups and their members. Optionally filter by the baseline (owner) tenant ID. Read-only.

List baseline alignment scores across tenants. Read-only.

Get detailed baseline-alignment drift for a tenant. Tenant identifier — accepts a numeric Client Tenant ID, a tenant DNS name, an Azure AD tenant GUID, or a friendly name. Resolved to the numeric Client Tenant ID before the request. Read-only.

List policies for a tenant. Tenant identifier — accepts a numeric Client Tenant ID, a tenant DNS name, an Azure AD tenant GUID, or a friendly name. Resolved to the numeric Client Tenant ID before the request. Read-only.

Get the Microsoft Secure Score data for a tenant. Tenant identifier — accepts a numeric Client Tenant ID, a tenant DNS name, an Azure AD tenant GUID, or a friendly name. Resolved to the numeric Client Tenant ID before the request. Read-only.

List Entra ID user summaries for a tenant (paginated). Tenant identifier — accepts a numeric Client Tenant ID, a tenant DNS name, an Azure AD tenant GUID, or a friendly name. Resolved to the numeric Client Tenant ID before the request. Read-only.

Get full detail for a single user. Tenant identifier — accepts a numeric Client Tenant ID, a tenant DNS name, an Azure AD tenant GUID, or a friendly name. Resolved to the numeric Client Tenant ID before the request. Read-only.

List Entra ID group summaries for a tenant (paginated). Tenant identifier — accepts a numeric Client Tenant ID, a tenant DNS name, an Azure AD tenant GUID, or a friendly name. Resolved to the numeric Client Tenant ID before the request. Read-only.

Get full detail for a single group, including members. Tenant identifier — accepts a numeric Client Tenant ID, a tenant DNS name, an Azure AD tenant GUID, or a friendly name. Resolved to the numeric Client Tenant ID before the request. Read-only.

List Entra ID directory role definitions for a tenant. Tenant identifier — accepts a numeric Client Tenant ID, a tenant DNS name, an Azure AD tenant GUID, or a friendly name. Resolved to the numeric Client Tenant ID before the request. Read-only.

List the audit event types available for filtering the activity log. Read-only.

Search the Inforcer activity (audit) log. All filters are optional; returns a page of events plus a continuation token for paging. Read-only.

List the assessments available to run (use to discover assessment IDs). Read-only.

⚠ HIGH-IMPACT. Triggers an assessment run for a tenant. This is not destructive, but it kicks off real work in Inforcer and is visible to operators. Tenant identifier — accepts a numeric Client Tenant ID, a tenant DNS name, an Azure AD tenant GUID, or a friendly name. Resolved to the numeric Client Tenant ID before the request. Confirm with the user before invoking.

List the catalog of available report types — key, supported output formats, whether the type is collatable (single cross-tenant output), and accepted parameters. Use to discover valid (type, output_format) pairs before calling inforcer_reports_run. Read-only.

List queued and completed report runs. Read-only.

⚠ HIGH-IMPACT. Queues one or more reports across one or more tenants. This is not destructive, but it kicks off real report-generation work in Inforcer. Reports run asynchronously — use inforcer_reports_run_status to poll the returned run(s) to completion, then inforcer_reports_download_output to fetch each finished output. Confirm with the user before invoking.

Poll a report run. Returns isTerminal:false with no outputs while the run is still in progress, or isTerminal:true with the list of downloadable outputs once it finishes. Read-only.

Download a single finished report output (discovered via inforcer_reports_run_status). Returns the file content base64-encoded along with its filename and content type. Read-only.