> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Inforcer API

> Use Inforcer from Neo: Microsoft Secure Score, baseline alignment, policies, users, groups and roles, assessments, the activity log and reports, per client tenant

The common uses are a security review or QBR, where the agent reports a client's Microsoft Secure Score and the actions that would raise it, how far the client drifts from your baseline, and Inforcer's own reports, and a ticket about a client's Microsoft 365, where it checks how a policy or a user is set in Inforcer's backup.

> [!NOTE]
>
> Automatically enabled when you configure Inforcer permissions in your agent workflow.

## What It Does

* Read a client's Microsoft Secure Score: the current and maximum score, 90 days of history, scores by category, and each improvement action with its gap and remediation steps
* Read alignment scores against your baselines, and one client's policy-by-policy comparison with its baseline
* Read a client's backed-up Microsoft 365, Intune and Entra policies, its users (licenses, MFA registration, admin roles), groups with members, and directory roles
* Run an Inforcer assessment for a client and read its compliance results
* Queue Inforcer report runs, read CSV, JSON and HTML outputs, and attach a PDF output to the ticket
* Read Inforcer's own activity log

Neither a report run nor an assessment changes anything in a client's Microsoft 365.

## Permission Groups

| Group | Covers |
| - | - |
| Tenants | Your Inforcer tenants with their secure score, alignment summaries, licenses, tags, last backup and recent policy changes (read only) |
| Secure Scores | A tenant's Microsoft Secure Score, its history and its improvement actions (read only) |
| Baselines & Alignment | Baseline groups, alignment scores, and one tenant's comparison with a baseline (read only) |
| Policies | A tenant's backed-up policies with their settings (read only) |
| Users, Groups & Roles | A tenant's Entra users, groups with members, and directory roles (read only) |
| Activity Log | Inforcer's activity log and its event types (read only) |
| Assessments | The assessments on offer, and running one against a tenant |
| Reports | Report types, recent report runs and their outputs, and queueing a new run |

## Access Profiles

| Profile | What runs |
| - | - |
| **Read Only** | Every read in the eight groups |
| **Full Automation** | Every read, and queueing report runs and running assessments without approval |

## Safety Controls

| Control | Behavior |
| - | - |
| **The ticket's client only** | On a run for a ticket that names a company, Neo sends a call only about the Inforcer tenant the ticket's company is mapped to: a path under that tenant, a report run for that tenant alone, or that tenant's outputs of a report run. Reads that answer for every tenant (the tenant list, alignment scores, baselines, the activity log, the report run list) go out only on a run with no ticket company, such as a chat with Neo or a scheduled agent |
| **Secrets hidden** | A policy setting whose name marks a secret, such as a password or a pre-shared key, reaches the agent as `[redacted by Neo]` |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.