← PS C:\Blog\rksolutions> cd ..

InforcerCommunity: A PowerShell Module for the Inforcer REST API

· 12 min read ·
Conditional Access Exchange Online Entra ID Graph API Intune Reports Tools
Looking for the tool? Browse the current apps, modules, documentation and install links on the Community Tools page.

If you use Inforcer to manage Microsoft 365 baselines, alignment scores, and policies across tenants, you already know the value of a single pane of glass for compliance and policy drift. But automation and scripting often mean wrestling with REST APIs, building your own auth and error handling, and maintaining scripts that break when the API changes. InforcerCommunity is a community PowerShell module that wraps the Inforcer API so you can connect, query tenants, baselines, policies, alignment details, users, and audit events from the command line or from your own scripts - with consistent parameters, sensible defaults, and help that works. This guide explains what it does, how to use it, and how you can contribute or ask for new features.

Table of Contents

What is InforcerCommunity?

InforcerCommunity is a PowerShell script module that talks to the Inforcer REST API.

What it gives you:

  • Connect once, query everything: Authenticate with your Inforcer API key and region, then run cmdlets to list tenants, baselines, policies, alignment details, users, and audit events.
  • Consistent behavior: All Get-* cmdlets support -Format, -OutputType (PowerShellObject or JsonObject), and -TenantId for filtering. TenantId accepts a numeric ID, Microsoft Tenant ID (GUID), or tenant name.
  • No secrets in scripts: The API key is stored as a SecureString in the session; you can pass it once via Connect-Inforcer and then run as many commands as you need.
  • Tab completion and help: Every cmdlet has comment-based help; Get-Help Connect-Inforcer -Full and tab completion on parameters (e.g. -EventType on Get-InforcerAuditEvent) work out of the box.
  • Pipeline support: Pipe tenants into other cmdlets - e.g. Get-InforcerTenant | Get-InforcerUser or Get-InforcerTenant | Get-InforcerTenantPolicies works out of the box.

Where to find it:

Community project notice: InforcerCommunity was created by me for the community. It is not owned, endorsed, or maintained by Inforcer. It is an independent, community-driven project to make the Inforcer API easier to use from PowerShell. You use it at your own responsibility.

For per-version detail, see the CHANGELOG in the repository. This post focuses on what the module does and how to use it.

Requirements

  • PowerShell 7.0 or later (Windows, macOS, or Linux).
  • An Inforcer API key from your Inforcer tenant (Configure > REST API > New API Key).

Installation

Install-Module -Name InforcerCommunity -Scope CurrentUser

Option 2: From source (GitHub)

git clone https://github.com/royklo/InforcerCommunity.git
cd InforcerCommunity
Import-Module ./module/InforcerCommunity.psd1 -Force

Important: When loading from source, always run Import-Module from the repository root and use the path ./module/InforcerCommunity.psd1. If you see errors about a missing file or wrong path, make sure you are in the InforcerCommunity repo root.

Quick Start

After installing the module:

# Connect with your API key (region: uk, eu, us, or anz)
Connect-Inforcer -ApiKey "your-api-key" -Region uk

# List all tenants you have access to
Get-InforcerTenant

# Get alignment details in table format
Get-InforcerAlignmentDetails

# Get users for a tenant (by name, numeric ID, or GUID)
Get-InforcerUser -TenantId "Contoso"

# Get policies for a specific tenant
Get-InforcerTenantPolicies -TenantId 482

# Disconnect when done
Disconnect-Inforcer

You can use Get-Help <CmdletName> -Full for parameters and examples (e.g. Get-Help Get-InforcerUser -Full).

Reports

Inforcer’s Reports API generates ready-made tenant reports - Active User Count, Tenant Audit Report, Copilot Adoption, and more. InforcerCommunity wraps the full lifecycle (discover, queue, poll, download) in four cmdlets, with Invoke-InforcerReport doing the heavy lifting end-to-end.

The two API scopes you need are Reports.Read (to discover types and download outputs) and Reports.Run (to queue runs). If you target a tenant by GUID or name instead of its numeric Client Tenant ID, you also need Tenants.Read. Connect-Inforcer accepts any valid API key regardless of scope, so a Reports.Read-only key works fine for read-only workflows. On HTTP 401 it reports a meaningful message instead of a raw status code, and every API error surfaces field-level detail from the server’s errors[] array along with the x-correlation-id header for support tickets.

Discovering Report Types

Start by listing what’s available. The catalog is cached after the first call, so this is instant on repeat and powers tab completion on -ReportType:

# List every available report type
Get-InforcerReportType

# Filter to a single type by key
Get-InforcerReportType -Key CopilotAdoption

# Only types that support PDF output
Get-InforcerReportType -OutputFormat pdf

# Only types tagged 'security'
Get-InforcerReportType -Tag security

Running a Report

The simplest run queues a report, waits for it to finish, and saves the output to your current directory:

# Queue, wait, and save ActiveUserCount.csv to the current directory
Invoke-InforcerReport -ReportType ActiveUserCount -OutputFormat csv -TenantId 482

# Save somewhere specific and open it as soon as it lands
Invoke-InforcerReport -ReportType TenantAuditReport -OutputFormat html -TenantId 482 -OutputPath ./reports -Open

While it works, you get a three-phase progress bar - queue, then poll (with elapsed time and poll count), then download. The cmdlet accepts a tenant as a numeric Client Tenant ID, a Microsoft Tenant GUID, or a tenant name, and resolves it before submitting. If you reference a report type that isn’t in your cached catalog, it refreshes the catalog once before failing, so newly shipped report types work without a reconnect.

Some report types take a period. CopilotAdoption and ShadowAiDetection default to 30 days when you omit it; pass -ReportPeriod to override. To run a saved assessment as a report, use -ReportType Assessment with an -AssessmentId (tab completion accepts the friendly name and inserts the opaque ID):

Invoke-InforcerReport -ReportType Assessment -AssessmentId l1f8wd29pl44pp1j66r9 -OutputFormat pdf -TenantId 482

Execution Modes

Invoke-InforcerReport has three modes depending on how much you want it to do:

  • Default - sync and save. Polls until each run is terminal, downloads every output, and emits one result object per saved file.
  • -NoWait - fire and forget. Returns the run IDs immediately so you can check back later with Get-InforcerReportRun.
  • -NoSave - poll until complete but write nothing. Returns the outputs metadata, ready to pipe into Save-InforcerReportOutput when you decide where the files should go.
# Fire and forget: returns RunIds immediately
Invoke-InforcerReport -ReportType CopilotAdoption -OutputFormat csv -TenantId 482, 139 -NoWait

# Poll without saving, then download on your terms
Invoke-InforcerReport -ReportType ActiveUserCount -OutputFormat csv -TenantId 482 -NoSave |
    Save-InforcerReportOutput -OutputPath ./reports

Get-InforcerReportRun lists recent runs and, with -RunId -Wait, polls a single run to completion - handy because freshly queued runs take about four minutes to appear in the list endpoint, while the polling path sees them as soon as they finish.

Pipeline and Bulk Runs

Because Get-InforcerReportType emits a Key alias that binds to -ReportType, you can discover and run in one line. The same OutputFormat broadcasts across every piped type:

# Run every security-tagged report type for a tenant, all as CSV
Get-InforcerReportType -Tag Security | Invoke-InforcerReport -OutputFormat csv -TenantId 482

# Pair report types to formats by index
Invoke-InforcerReport -ReportType TenantAuditReport, ActiveUserCount -OutputFormat pdf, csv -TenantId 482

# Bulk-download every output from every visible run
Get-InforcerReportRun -IncludeOutputs |
    ForEach-Object { $_.outputs } |
    Save-InforcerReportOutput -OutputPath ./bulk

A few client-side guards keep you out of known API edge cases: duplicate (type, format) pairs are removed before the request (the server would otherwise render duplicates in the wrong format), -Collate is rejected on report types the catalog marks as non-collatable, and unknown -Parameter keys are rejected up front instead of being silently ignored.

Assessments

Inforcer provides compliance assessments that evaluate your tenant against industry frameworks and readiness checks - things like Copilot Readiness, CIS Microsoft 365 Foundations Benchmark, CIS Microsoft Intune for Windows 11 Benchmark, and Essential Eight Maturity Level 1. With InforcerCommunity, you can run these assessments from the command line and get structured results you can automate with.

Single-Tenant Assessment

Run an assessment against one tenant and see every check with its pass/fail status:

# List available assessments
Get-InforcerAssessment

# Run Copilot Readiness against a tenant (by name)
Invoke-InforcerAssessment -TenantId "Contoso" -AssessmentId "Copilot Readiness"

The output shows a compliance summary followed by each check as a pipeline object:

  Copilot Readiness - 76.2% compliant (16/21 checks passed)

Status           : Pass
name             : Enable Conditional Access policies to block legacy authentication
category         : Entra
subCategory      : Conditional Access
importance       : High
ObjectsEvaluated : 13
FindingsMessage  : 1 out of 13 object(s) are fully-compliant with this check
Scores           : {@{objectId=de66f385...; score=100; objectName=Core - Block - Legacy Authentication; ...}, ...}

Each check includes a Scores property with per-object detail - which Conditional Access policy passed, which failed, and why. You can drill into this:

$results = Invoke-InforcerAssessment -TenantId "Contoso" -AssessmentId "Copilot Readiness"

# See only failed checks
$results | Where-Object Status -eq 'Fail'

# Table view
$results | Format-Table Status, name, category, importance

# Drill into violations for a specific check
$results[1].Scores | Where-Object { $_.violations.Count -gt 0 } | Select-Object objectName, score, violations

Generate an interactive HTML report with one parameter:

Invoke-InforcerAssessment -TenantId "Contoso" -AssessmentId "Copilot Readiness" -OutputPath ./copilot-report.html

The HTML report includes a navy cover banner, compliance score ring, collapsible check cards grouped by category (Entra, Exchange, M365, Purview, SharePoint), per-object expandable cards showing violations and passes, and markdown-rendered description and remediation steps. Everything is self-contained - no external dependencies, works offline.

Multi-Tenant Assessment Matrix

The real power comes when you run an assessment across all your tenants at once:

# Run against all tenants
Invoke-InforcerAssessment -AssessmentId "Copilot Readiness" -MultiTenant -OutputPath ./matrix.html

# Or pick specific tenants by name
Invoke-InforcerAssessment -TenantId "Contoso","Fabrikam","Woodgrove" -AssessmentId "Copilot Readiness" -OutputPath ./matrix.html

The cmdlet runs each tenant sequentially with progress updates:

Multi-tenant assessment: 'Copilot Readiness' across 10 tenant(s)

[1/10] Running 'Copilot Readiness' against Contoso...
  Still running... 10s elapsed
  Completed in 14s.
[2/10] Running 'Copilot Readiness' against Fabrikam...
  Still running... 3m 10s elapsed
  Completed in 3m 16s.
...

All assessments complete. 10 tenant(s) processed in 16m 18s.
  Contoso - 76.2% (16/21)
  Fabrikam - 42.9% (9/21)
  Woodgrove - 38.1% (8/21)
  ...

The matrix HTML report is a full-viewport interactive dashboard: a sticky left column with check names that stays visible while you scroll horizontally across tenant columns, each showing a pass/fail indicator. A tenant filter dropdown lets you show or hide specific tenants (useful when you have 100+ tenants and want to focus on a subset). Click “Details” on any check to open a slide-out panel with the description, impact, and rationale. Category rows group checks by Entra, Exchange, M365, Purview, and SharePoint. Search and status filters (All, Has Failures, All Passed) work across the entire matrix.

Assessment Export Options

All export formats work for both single-tenant and multi-tenant:

# HTML report (single or matrix)
Invoke-InforcerAssessment -TenantId "Contoso" -AssessmentId "Copilot Readiness" -OutputPath ./report.html

# CSV for Excel or automation (multi-tenant includes Tenant column)
Invoke-InforcerAssessment -AssessmentId "Copilot Readiness" -MultiTenant -OutputPath ./matrix.csv

# JSON for webhooks, APIs, or further processing
Invoke-InforcerAssessment -AssessmentId "Copilot Readiness" -MultiTenant -OutputType JsonObject

# Pipeline for PowerShell automation (each check has TenantName in multi-tenant mode)
Invoke-InforcerAssessment -AssessmentId "Copilot Readiness" -MultiTenant |
    Where-Object Status -eq 'Fail' |
    Group-Object TenantName |
    Select-Object Name, Count

Tenant Documentation

Export-InforcerTenantDocumentation generates comprehensive documentation for an entire tenant in one command:

# Generate HTML documentation (opens in browser automatically)
Export-InforcerTenantDocumentation -TenantId "Contoso" -Format Html

# Generate HTML and Excel, with Graph enrichment for group/filter names
Connect-Inforcer -ApiKey "your-api-key" -Region uk -FetchGraphData
Export-InforcerTenantDocumentation -TenantId "Contoso" -Format Html,Excel -OutputPath C:\Reports

# Export only policies from a specific baseline
Export-InforcerTenantDocumentation -TenantId 139 -Baseline "Inforcer Blueprint Baseline - Tier 1" -Format Html

# Filter by tag
Export-InforcerTenantDocumentation -TenantId "Contoso" -Tag "Production" -Format Markdown

HTML output is a self-contained file with no external dependencies - you can email it, archive it, or open it offline. It includes:

  • Collapsible Product > Category > Policy navigation in a sidebar
  • Real-time search with text highlighting
  • Dark/light mode toggle (persisted in localStorage)
  • Tag filter pills with AND/OR logic
  • Hide empty fields and show metadata toggles
  • Collapsible long values and a back-to-top button

Excel output creates a workbook with one sheet per product area. Each row is a policy with columns for category, name, description, platform, settings, and assignments - ready for filtering and analysis.

Markdown output generates a GFM-compatible document with a table of contents and per-policy tables - useful for including in wikis or version-controlled documentation.

Settings Catalog resolution: Both the documentation and comparison cmdlets translate raw Settings Catalog IDs into friendly names using data sourced from IntuneSettingsCatalogData. The dataset (~65 MB) is downloaded and cached automatically on first use at ~/.inforcercommunity/data/settings.json with a 24-hour refresh, so the first export is slower and every subsequent one is instant.

Environment Comparison

Compare-InforcerEnvironments compares two tenants’ Intune configurations and generates an interactive HTML report:

# Compare two tenants in the same Inforcer account
Compare-InforcerEnvironments -SourceTenantId "Contoso" -DestinationTenantId "Fabrikam"

# Compare across different Inforcer accounts with Graph enrichment
$src = Connect-Inforcer -ApiKey $key1 -Region uk -PassThru
$dst = Connect-Inforcer -ApiKey $key2 -Region eu -PassThru
Compare-InforcerEnvironments -SourceTenantId 482 -DestinationTenantId 139 `
    -SourceSession $src -DestinationSession $dst -FetchGraphData

You can also scope either side to a single baseline with -SourceBaselineId and -DestinationBaselineId, so the comparison covers only the policies in that baseline rather than the whole tenant:

# Compare only the policies in a baseline against a full tenant
Compare-InforcerEnvironments -SourceTenantId "Contoso" -SourceBaselineId "Tier 1 - Foundations" `
    -DestinationTenantId "Fabrikam"

# Compare one baseline against another
Compare-InforcerEnvironments -SourceTenantId "Contoso" -SourceBaselineId "Tier 1" `
    -DestinationTenantId "Fabrikam" -DestinationBaselineId "Tier 2"

When you pass a baseline ID without its matching tenant ID, the cmdlet resolves the baseline’s owner tenant automatically, so -SourceTenantId / -DestinationTenantId can be omitted on that side.

The HTML report includes four tabs:

  • Comparison - flat table of all Settings Catalog settings with sortable columns, status filter pills (Matched/Conflicting/Source Only/Dest Only), category dropdown, and advanced column filters with AND/OR logic
  • Manual Review - non-Settings-Catalog policies (compliance, enrollment, scripts) in a 50/50 source/destination layout grouped by platform. Matching policy names are aligned side-by-side. Scripts and compliance rules are shown as collapsible code blocks with syntax highlighting
  • Duplicates - settings configured in two or more policies with different values, with automated conflict analysis
  • Deprecated - settings flagged as deprecated by Microsoft, grouped by source and destination

Cross-category reconciliation: A setting delivered as Endpoint Security on one tenant and as a Settings Catalog policy on another would normally show up as two separate items - one “source only” and one “destination only”. The comparison matches by DefinitionId instead of policy category, so the same underlying setting lines up as a single row regardless of which Intune template type each tenant used to deploy it. This is what lets you compare a tenant on the older Endpoint Security flow against one that’s migrated to Settings Catalog without a wall of false-positive drift.

The report also features an animated configuration match score (with confetti at 100%), dark/light mode toggle, column resize handles, and a responsive layout. Like the Export report, the HTML is fully self-contained with no external dependencies.

Key Cmdlets and Use Cases

Cmdlet What it does
Connect-Inforcer Establishes a secure connection to the Inforcer API (ApiKey, Region or BaseUrl). Accepts any valid API key regardless of scope, and supports -FetchGraphData and -PassThru for cross-account workflows.
Disconnect-Inforcer Clears the session, drops all cached catalogs, and disconnects.
Test-InforcerConnection Verifies the current API connection.
Get-InforcerTenant Lists tenants; optional -TenantId to return a single tenant.
Get-InforcerBaseline Retrieves baseline groups and members.
Get-InforcerTenantPolicies Retrieves policies for a given tenant.
Get-InforcerAlignmentDetails Retrieves alignment scores or per-policy alignment details (optional -TenantId, -BaselineId, -Tag).
Get-InforcerAuditEvent Retrieves audit events (optional -EventType, date range, paging).
Get-InforcerSupportedEventType Lists supported audit event types (used for tab completion).
Get-InforcerUser Lists/searches users or gets full user detail by ID (optional -Search, -MaxResults, -UserId).
Get-InforcerGroup Retrieves Entra ID groups (list with search/filter/pagination, or detail by name/GUID with members).
Get-InforcerRole Retrieves Entra ID directory role definitions (built-in, enabled, privileged).
Export-InforcerTenantDocumentation Generates tenant documentation in HTML, Markdown, or Excel (optional -Baseline, -Tag, -FetchGraphData).
Compare-InforcerEnvironments Compares two tenants’ Intune configuration and generates an interactive HTML comparison report. Supports baseline-scoped comparison via -SourceBaselineId / -DestinationBaselineId.
Get-InforcerAssessment Lists available assessments (Copilot Readiness, CIS Benchmarks, Essential Eight, etc.).
Invoke-InforcerAssessment Runs an assessment against one or more tenants. Supports -MultiTenant, -OutputPath (HTML/CSV), -OutputType JsonObject.
Get-InforcerReportType Lists available report types with supported formats and tags (cached, drives tab completion).
Invoke-InforcerReport Queues report runs, polls until complete, and saves the output. Supports -NoWait, -NoSave, -Open, and pipeline input.
Get-InforcerReportRun Lists recent report runs; -Wait polls a run to completion, -IncludeOutputs embeds outputs.
Save-InforcerReportOutput Downloads a specific report output to disk using the server-suggested filename.

Typical workflows:

  • Tenant and policy overview: Connect-Inforcer -> Get-InforcerTenant -> Get-InforcerTenantPolicies -TenantId "Contoso" to inspect a specific tenant’s policies.
  • Alignment and drift: Get-InforcerAlignmentDetails for score summaries; Get-InforcerAlignmentDetails -BaselineId "Tier 0" for per-policy detail.
  • User overview: Get-InforcerUser -TenantId "Contoso" for a user list; Get-InforcerUser -TenantId 139 -UserId "8e61ce11-..." for full detail including groups, roles, devices, and risk.
  • Audit and compliance: Get-InforcerAuditEvent with optional -EventType (tab completion for event types), -DateFrom, -DateTo, and paging parameters.
  • Tenant documentation: Export-InforcerTenantDocumentation -TenantId "Contoso" -Format Html,Excel to generate a complete configuration snapshot.
  • Environment comparison: Compare-InforcerEnvironments -SourceTenantId "Contoso" -DestinationTenantId "Fabrikam" to see every difference between two tenants.
  • Group and role lookup: Get-InforcerGroup -TenantId 139 -Search "Finance" for groups, Get-InforcerRole -TenantId 139 | Where-Object IsPrivileged -eq $true for privileged roles.
  • Compliance assessment: Invoke-InforcerAssessment -TenantId "Contoso" -AssessmentId "Copilot Readiness" to check a single tenant, or add -MultiTenant -OutputPath matrix.html for a cross-tenant matrix report.
  • Reports: Get-InforcerReportType to see what’s available, then Invoke-InforcerReport -ReportType ActiveUserCount -OutputFormat csv -TenantId "Contoso" -Open to queue, download, and open it; pipe Get-InforcerReportType -Tag Security | Invoke-InforcerReport -OutputFormat csv -TenantId 482 to run a whole category at once.
  • Pipeline: Get-InforcerTenant -TenantId 139 | Get-InforcerUser to list users for a piped tenant.

For full parameter details and example output, see the Cmdlet Reference in the repository.

Output Formats and Filtering

  • -Format: Most Get-* cmdlets support Table or Raw (e.g. for alignment details).
  • -OutputType: PowerShellObject (default) or JsonObject (JSON with depth 100) for piping into other tools or export.
  • -TenantId: Accepts a numeric Client Tenant ID, a Microsoft Tenant ID (GUID), or a tenant name (case-insensitive match). Use it on Get-InforcerTenant, Get-InforcerTenantPolicies, Get-InforcerAlignmentDetails, Get-InforcerUser, and others.
# Example: export all tenants as JSON for use elsewhere
Get-InforcerTenant -OutputType JsonObject | Out-File tenants.json -Encoding utf8

# Example: search users by name
Get-InforcerUser -TenantId "Contoso" -Search "Adele"

# Example: get full user detail as JSON
Get-InforcerUser -TenantId 139 -UserId "8e61ce11-a45b-42a6-8ca4-1d881781566d" -OutputType JsonObject

How to Contribute

Contributions are welcome. The project uses a standard fork-and-pull-request workflow:

  • Fork the repository on GitHub: https://github.com/royklo/InforcerCommunity.
  • Clone your fork and create a branch (e.g. feature/your-feature-name or fix/bug-description).
  • Make your changes under module/ (see CONTRIBUTING.md for code style and the consistency contract - parameter order, -Format/-OutputType, property names, etc.).
  • Run tests from the repo root: Invoke-Pester ./Tests/Consistency.Tests.ps1.
  • Commit and push to your fork, then open a pull request against the main repository. Fill in the PR template (summary, how to test, related issue if any).

New cmdlets must be added to module/Public/, registered in FunctionsToExport in the manifest, and documented in docs/CMDLET-REFERENCE.md. The consistency tests must be updated if you add or change exported cmdlets or key parameters.

How to Report Bugs

If something doesn’t work as expected:

  • Go to New issue.
  • Choose Bug report.
  • Fill in:

Description: What went wrong?

  • Steps to reproduce: Exact commands or steps.
  • Expected behavior: What you expected.
  • Actual behavior: What happened instead (including any error messages).
  • Environment: PowerShell version, OS, and module version (e.g. Get-Module InforcerCommunity | Select-Object Version).
  • Additional context: Logs, screenshots, or other details.

This helps maintainers and the community reproduce and fix issues quickly.

How to Request a Feature

Have an idea for a new cmdlet, parameter, or behaviour?

  • Go to New issue.
  • Choose Feature request.
  • Describe:

The feature you’d like (e.g. a new endpoint, a new parameter, or a different output shape).

  • The use case (why it would help you or others).
  • If you have one, a proposed solution (e.g. cmdlet name, parameters, example usage).

Not every request can be implemented immediately, but all are read and considered; they also help others discover and discuss ideas.

Conclusion

InforcerCommunity turns the Inforcer API into a set of PowerShell cmdlets you can use interactively or in scripts: connect once, then list tenants, baselines, policies, alignment details, users, groups, roles, and audit events with consistent parameters and output. Generate Inforcer reports like Active User Count, Tenant Audit, and Copilot Adoption straight to disk with a single cmdlet that queues, polls, and downloads for you. Run compliance assessments like Copilot Readiness and CIS Benchmarks against one tenant or all of them at once, with interactive HTML matrix reports that let you compare compliance across your entire estate. Generate complete tenant documentation in HTML, Markdown, or Excel. Compare two tenants’ Intune configurations side-by-side with an interactive report that shows every difference, duplicate, and deprecated setting. Use tenant names instead of IDs, pipe results between cmdlets, and export to CSV or JSON for integration with other tools and automation pipelines. It’s a community project, not owned or maintained by Inforcer; feedback, bug reports, and feature requests from users like you shape what comes next. Install it from the PowerShell Gallery, try the quick start, and if you hit a bug or have an idea, open an issue or send a pull request.

← back to all posts next: Intune Anomalies Report →
PS Select-String -Pattern
↑↓navigate ↵open escclose