# Deploying a scheme

> Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.

Deploy a scheme to apply its baselines to a tenant, one or more Azure groups, or one or more users. Every **Deploy Scheme** button and menu item in Octiga opens the same wizard, so these steps apply wherever you start.

1. **Select the scheme.** Pick the scheme you want to deploy. If you opened the wizard from a scheme's own page, this step is already filled in and you land on Mode instead.
2. **Choose the mode.** Choose **Apply as managed** or **Copy and detach**. Apply as managed (Managed) takes every baseline in the scheme and keeps tracking it; Copy and detach (Direct) copies a subset once, as an independent snapshot. [Schemes](https://docs.octiga.io/baselines/schemes/#managed-and-direct) explains the difference.
3. **Choose the target.** Deploy onto the tenant itself to cover everyone in it, or onto Azure groups or users to cover only those groups' members or those users.
4. **Choose baselines** *(Copy and detach only)*. Every baseline in the scheme starts checked. Uncheck any you don't want in this copy. This step doesn't appear for Apply as managed, because a Managed deploy always takes the whole scheme.
5. **Confirm.** Review the summary, then deploy.

*Screenshot: Step 1 — Select the scheme.*

1. Scheme select

*Screenshot: Step 2 — Choose the mode.*

1. Apply as managed
2. Copy and detach

*Screenshot: Step 3 — Choose the target.*

1. Tenant, or deployment method and targets

*Screenshot: Step 4 — Choose baselines (Copy and detach only).*

1. Header checkbox and "Deploying N of M baselines" count

> **Licence:** Baselines the target isn't licensed for are skipped, not failed. Each baseline's own page states what it needs; see also [Licence requirements](https://docs.octiga.io/reference/licence-requirements/).

*Screenshot: Step 5 — Confirm.*

1. Summary — scheme, mode, target, baseline count

## Managed or Direct, by target

Either mode works on either target, and each combination is independent of the others:

| Target      | Apply as managed                                                                                         | Copy and detach                                                                                                   |
| ----------- | -------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
| Azure group | Sets the group's scheme link. Every baseline in the scheme applies, and keeps tracking it.               | Copies your chosen baselines onto the group as independent values. No link.                                       |
| User        | Sets the user's scheme link — a resolution tier above their groups and below any Direct value they hold. | Copies your chosen baselines onto the user as Direct values — the same write as adding a Direct baseline by hand. |

Deploying an org-level scheme onto the tenant itself has no group or user dimension: both modes apply straight to the tenant, under the org-level rules below.

## Org-level rules

Three rules apply whenever you deploy an org-level scheme onto a tenant, wherever you start the deploy:

- **One managed scheme per tenant.** A tenant can be managed by only one org-level scheme at a time. An Apply as managed deploy onto a tenant already managed by another scheme detaches it from that scheme in the same action, after you confirm.
- **Incoming baseline wins, per tag.** Whatever you deploy replaces the tenant's existing value for each baseline it touches, without asking baseline by baseline which one to keep.
- **One deployment targets one tenant.** You can't batch-deploy a scheme across several tenants in one run.

> **Caution:** A tenant already managed by another scheme is detached from it in this action.

## Group rule

A Copy and detach deploy onto a group that's Managed by a scheme clears that scheme's link, after you confirm. From then on the group keeps its own copy of the scheme's baselines and no longer follows changes to the scheme.

## Reading the result

A deploy reports how many baselines it applied, and how many it skipped for licence.

> **Licence:** Unlicensed baselines are skipped, not failed. A skipped baseline doesn't count against the deploy, and the target isn't shown as Deviated for a setting it was never given.

## Check it worked

Open the tenant's Baselines screen. After an Apply as managed deploy, the org-level tab shows a banner above the table naming the scheme that manages the tenant; a Copy and detach deploy shows no banner, because nothing tracks it. On the user-level tab, a deployed group or user shows the scheme's name in the Scheme column, or "Direct" against each baseline a Copy and detach deploy copied onto them.

## If it didn't

- **"This tenant is managed by another scheme"** — see [Troubleshooting](https://docs.octiga.io/reference/troubleshooting/).
- **The deploy result shows skipped items** — see [Licence requirements](https://docs.octiga.io/reference/licence-requirements/).

## Where you can start a deploy

The wizard opens from many places: a scheme's own page, the Baseline Schemes list's row menu, a tenant's org-level Baselines tab, the tenant's dashboard, the tenants list, a tenant's user-level Baselines tab, the Groups page, and the user roster (for one user or a batch). The steps are the same wherever you start.