# Working with Baselines

> Apply security templates to tenants, groups, and users, and understand priority resolution.

Baselines define the *expected* security state of a tenant, group, or user. Octiga creates them by applying a **template** — a reusable set of security policies — at a chosen scope.

Update 1

## Video walkthrough

::youtube{id="dQw4w9WgXcQ" title="Baselines walkthrough"}

## Applying a template

:::steps
1. Create a template with the security policies (specs) you want to enforce.

2. Apply the template to a tenant, group, or user. Octiga snapshots it as a baseline at that scope.

3. From the next sync onward, actual state is compared against the baseline and differences appear as deviations.
:::

## Priority resolution

Users can belong to multiple groups, each with its own baselines. When baselines conflict, the tenant's **group order** decides which wins: groups earlier in the order have higher priority.

:::tip
Review group order whenever you add a group-scoped baseline — the winning policy for a user is always the highest-priority group they belong to.
:::

## Licence requirements

Some policies require specific Microsoft 365 licences (service plans). Users without the required plan are automatically excluded from those checks, so missing licences never show up as false-positive deviations.

## Auto-remediation

Auto-remediation can be enabled at three levels — MSP, tenant, or individual baseline — with the most specific setting winning. When enabled, Octiga applies the baseline state automatically instead of only raising an alert.