Working with Baselines

Baselines define the expected security state of a tenant, group, or user. Octiga creates them by applying a template — a reusable set of security policies — at a chosen scope.

Video walkthrough

Play

Applying a template

1. Create a template with the security policies (specs) you want to enforce.

2. Apply the template to a tenant, group, or user. Octiga snapshots it as a baseline at that scope.

3. From the next sync onward, actual state is compared against the baseline and differences appear as deviations.

Priority resolution

Users can belong to multiple groups, each with its own baselines. When baselines conflict, the tenant’s group order decides which wins: groups earlier in the order have higher priority.

Tip

Review group order whenever you add a group-scoped baseline — the winning policy for a user is always the highest-priority group they belong to.

Licence requirements

Some policies require specific Microsoft 365 licences (service plans). Users without the required plan are automatically excluded from those checks, so missing licences never show up as false-positive deviations.

Auto-remediation

Auto-remediation can be enabled at three levels — MSP, tenant, or individual baseline — with the most specific setting winning. When enabled, Octiga applies the baseline state automatically instead of only raising an alert.