# Working with Baselines

> Apply security templates to tenants, groups, and users, and understand priority resolution.

import { Steps, Aside } from '@astrojs/starlight/components';
import { YouTube } from 'astro-embed';

Baselines define the *expected* security state of a tenant, group, or user. Octiga creates them by applying a **template** — a reusable set of security policies — at a chosen scope.

## Video walkthrough

{/* Example embed — replace with a real walkthrough video. */}
<YouTube id="dQw4w9WgXcQ" title="Baselines walkthrough" />


## Applying a template

<Steps>

1. Create a template with the security policies (specs) you want to enforce.

2. Apply the template to a tenant, group, or user. Octiga snapshots it as a baseline at that scope.

3. From the next sync onward, actual state is compared against the baseline and differences appear as deviations.

</Steps>

## Priority resolution

Users can belong to multiple groups, each with its own baselines. When baselines conflict, the tenant's **group order** decides which wins: groups earlier in the order have higher priority.

<Aside type="tip">
    Review group order whenever you add a group-scoped baseline — the winning policy for a user is always the highest-priority group they belong to.
</Aside>

## Licence requirements

Some policies require specific Microsoft 365 licences (service plans). Users without the required plan are automatically excluded from those checks, so missing licences never show up as false-positive deviations.

## Auto-remediation

Auto-remediation can be enabled at three levels — MSP, tenant, or individual baseline — with the most specific setting winning. When enabled, Octiga applies the baseline state automatically instead of only raising an alert.