# Groups and priority

> How Octiga decides which value a user gets when several sources supply one, and how to set the priority of the Azure groups it tracks.

A baseline can reach a user directly, through a scheme deployed to them, or through an Azure group, and a user can belong to several groups that disagree. Octiga resolves these routes in a set order, and you decide the priority of the groups it tracks on the Groups page.

1. **1 · Direct value** (Not set) — None set for this user
2. **2 · Managed scheme: User's managed scheme** (Wins) — Sets the value
3. **3 · Highest-priority group: Highest-priority group the user belongs to** (Superseded) — Also sets it, but ranks below
4. **4 · Fallback: Not applied** — Reached only if nothing above sets it

*Resolution order for Enforce MFA, checked top to bottom for one user. The first route that sets a value wins; everything below it is kept as provenance and has no effect.*

## Resolution order

For each baseline that reaches a user, Octiga checks these routes in order and uses the first one that applies:

1. **Direct value** — a value applied to this specific user. Always wins.
2. **The user's Managed scheme** — a scheme deployed Apply as managed to this user, if it carries this baseline.
3. **The highest-priority Azure group** the user belongs to, that applies this baseline.
4. **Not applied** — none of the above supplied a value.

Values from lower routes are kept as provenance: Octiga can show what a user would have had from them, but they have no effect. What the user has now is the winning value alone.

## The priority stack

Tracked Azure groups form an ordered stack, and a higher group wins.

1. **Executives — priority 1** — Not one of this user's groups
2. **Finance — priority 2** (Wins) — This user's highest-priority group · sets the value
3. **Marketing — priority 3** (Superseded) — Also one of this user's groups, but ranks below
4. **Default group — the floor** — Every user belongs to it · checked last

*Illustrative example: this user belongs to Finance and Marketing. Finance ranks higher, so it wins; Marketing is kept as provenance. The Default group matches everyone and is always checked last.*

> **Note:** You choose which groups Octiga tracks, and in what order. Group membership stays in Microsoft 365: Octiga never changes it.

> **Note:** Reordering the stack has wide reach. The drag order on the Groups page is the priority order, so moving a group changes which value wins for its members, for every baseline it supplies.

Every user in the tenant belongs to the **Default** group. It's pinned to the bottom of the stack and can't be reordered or removed, so every tracked user has at least one group source.

## Group-direct baselines

You can also add a baseline to a group by hand, alongside anything a scheme supplies: the group equivalent of adding a Direct baseline to a user. A group's effective set is its scheme-supplied baselines **plus** its own group-direct ones. See [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/#adding-a-baseline-to-a-group) for how.

A group can still be Managed by only one scheme at a time. That rule covers deploys, and adding one baseline by hand isn't a deploy. A group-direct baseline resolves at the group's own priority, the same as a scheme-supplied one, and a user's provenance names the group either way.

Unlike a user's Direct value, a group-direct baseline can't take precedence over one the group's own scheme already supplies. The picker marks those as already added and doesn't let you select them, so the two sets never overlap.

## The Groups page

*Screenshot: The Groups page, showing tracked Azure groups in priority order.*

1. Drag handle — reorder priority
2. Group name and member count
3. Scheme — the deployed scheme, if any
4. Direct — the group's own hand-added baseline count
5. Row kebab — Deploy scheme, Detach, Remove

Default is always the last row and can't be dragged. Every other group can be reordered, deployed to, or removed from tracking.

## The group's own detail

Opening a group shows its baselines and its members.

*Screenshot: A group's Baselines tab, showing scheme-supplied and group-direct baselines.*

1. Baseline table — a "via Scheme" tag marks scheme-supplied rows; an empty cell marks a group-direct one
2. Footer — Deploy Scheme and + Baseline

## The roster's four states

A user's baselines are in one of four states, depending on whether they're in a tracked group, hold Direct values, both, or neither:

| State            | Meaning                                                                         |
| ---------------- | ------------------------------------------------------------------------------- |
| Group only       | Every applied baseline the user has comes from a group                          |
| Group and Direct | The user has group-sourced baselines and at least one Direct value              |
| Direct only      | The user isn't in any tracked group beyond Default, so only Direct values apply |
| Unmanaged        | The user has no applied baselines at all                                        |

A user has no single source: source is recorded per baseline. The four states describe the mix of what a user has, not where each baseline came from.

## Detach behaviours

- **Detaching a scheme from a group** offers a choice. **Keep and unlink** leaves the group's current baselines in place as its own group-direct set, no longer tracking the scheme; **Delete baselines** clears them. Either way, baselines you added to the group by hand stay, because they were never the scheme's.
- **Detaching a user's Managed scheme** re-resolves each baseline the scheme supplied: it falls to whichever group would otherwise win, or to not applied if the user has neither a qualifying group nor a Direct value. Nothing is deleted; it reverses deploying the scheme to that user.

## Vocabulary

**Direct** — A value applied to one specific user or, group-side, a baseline added to one specific group by hand. Always wins for a user.

**Supersedes** — Provenance language only: "Direct supersedes Finance's value" describes what's kept for display, not an action you take.

**Effective value** — The winning value: the one Octiga enforces and displays for a user's baseline.

**Provenance** — The winning value plus everything it superseded. Octiga keeps it and can display it, but only the winner has any effect.

**Default group** — The group every user in the tenant belongs to. Always pinned to the bottom of the priority stack.