Schemes

A scheme is a named bundle of baselines that you author once and deploy to as many tenants, groups or users as you like. Two choices shape how it behaves: its level (org or user), set when you create it, and its governance mode (Managed or Direct), chosen each time you deploy it. When you’re ready to apply one, see Deploying a scheme.

Org-level and user-level schemes

A scheme is one of two kinds, chosen when you create it and fixed from then on.

	Org-level scheme	User-level scheme
Targets	A whole tenant	Azure groups and individual users
Deployed from	A tenant’s Baselines screen, org-level tab, or the scheme’s own page	A tenant’s Baselines screen, user-level tab, or the scheme’s own page
One managed scheme per target	At most one per tenant	At most one per group, and at most one per user
Where you author it	Baseline Schemes → the scheme’s own page	Baseline Schemes → the scheme’s own page

Both kinds are listed together on the Baseline Schemes screen, and Managed and Direct work the same way for both.

Managed and Direct

Every deploy uses one of two governance modes, and one deploy can’t mix them:

• Managed is a link. The target takes every baseline in the scheme and keeps tracking it: edit the scheme later, and the change reaches every target still linked to it.
• Direct is a snapshot. You pick a subset of the scheme’s baselines, and Octiga copies their values onto the target once. Nothing tracks the scheme afterwards; the copy is independent from the moment it lands.

Managed

SchemeAll baselines · keeps tracking

TargetFollows every scheme changeWins

Direct

SchemeA subset, copied once

TargetA snapshot · does not followCopied

Managed is a link; Direct is a copy. Only Managed keeps tracking the scheme.

Everything else about deploying (what a Managed deploy does to a tenant already managed by another scheme, what Direct does to a Managed group, how baselines skipped for licence are reported) follows from this distinction. Deploying a scheme covers each case.

The library screen

Baseline Schemes lists every scheme you can see, org-level and user-level together, with one search that covers both lists.

1234

The Baseline Schemes library screen.

1. Search — matches a scheme name across both tables
2. Org-level schemes table — name, tenant count, last modified
3. User-level schemes table — name, deployment count, last modified
4. Row kebab — Deploy scheme, Duplicate, Make default, Delete

Every role can open this screen and see what a scheme contains. Creating, editing, duplicating and deleting schemes, and deploying one from this screen, needs L2 Support or Admin. L1 Read/Write can still deploy an existing scheme to a tenant it reaches, from that tenant’s Baselines screen (Deploying a scheme).

Scheme detail

Opening a scheme takes you to its own page: an editable title, a tenant or deployment count next to a star, and a table of the baselines it carries, grouped by category.

1234

An org-level scheme's detail page.

1. Editable title
2. Tenant count — opens the attached-tenants panel
3. Kebab — Deploy scheme, Import baselines, Duplicate, Make default, Delete
4. Category-grouped baseline table

A scheme Octiga ships with the product (a system scheme, such as Octiga’s own best-practice bundle) shows a banner explaining that its baselines are read-only. You can’t edit its baselines, but you can still deploy it, make it the default, or duplicate it into an editable copy.

Attached tenants

The tenant or deployment count next to the star opens a panel listing everywhere the scheme is deployed.

1

The attached-tenants panel for an org-level scheme — here, the read-only system scheme from the previous screenshot.

1. Attached tenants, as chips

For an org-level scheme, the panel shows the tenants it’s deployed to. On an ordinary scheme, an Add Tenants link (Manage Tenants once one is attached) sits beside the chips so you can add or remove tenants without opening the deploy wizard, and each chip has its own remove control. A system scheme, like the one shown here, has neither: Octiga manages where its bundled scheme is attached, so the panel is read-only and its chips can’t be removed.

For a user-level scheme, the panel is a read-only list of the groups and users following it. A user-level scheme reaches a target only through a deploy, never by attaching it here.

Default scheme

One scheme at each level can be the default. Octiga applies the default org-level scheme to a tenant automatically as soon as the tenant finishes connecting, so no one has to remember to deploy it. Set a new default at either level from a scheme’s kebab menu at any time. Changing the default doesn’t affect anything already deployed, and it isn’t reapplied to tenants that already have a scheme.

Vocabulary

Scheme

A named bundle of baselines, authored once and deployed to many targets.

Managed

A governance mode: the target takes every baseline in the scheme and keeps tracking it.

Direct

A governance mode: a chosen subset of the scheme’s baselines, copied once as an independent snapshot.

System scheme

A scheme Octiga ships with the product. Its baselines are read-only, but it can still be deployed, defaulted or duplicated.