# How Octiga works > Learn how Octiga keeps each tenant's configuration in line with its baselines, grades its activity into alerts, and finds the accounts and mailboxes at risk. Octiga watches two things about each tenant: how it's configured and what's happening in it. It keeps the configuration in line with your baselines by repeating three steps (sync, compare and act), and it grades the activity as it arrives. Once you know how the two fit together, the rest of the product is easier to reason about. 1. **Microsoft 365** — Users, groups, policies, mailbox settings 2. **Octiga's synced copy** — Scheduled, on demand, and after every change notification 3. **Compared against your baselines** — The configuration you have required 4. **Deviated** — The setting no longer matches 5. **Alerted, or fixed automatically** — Then written back to Microsoft 365 *A deviation feeds an alert or an automatic fix, then the next sync starts the loop again.* ## Sync Octiga pulls a tenant's users, groups, policies, mailbox settings and sign-in data from Microsoft 365 on a schedule. It also syncs sooner when you run an on-demand sync, when a tenant is first connected, when Microsoft sends a change notification, and right after Octiga writes a value during remediation. Most changes show up within about an hour. On tenants where Octiga watches change notifications, mailbox and authentication details can take up to about two hours. Tenants without change notifications sync on a slower, fixed schedule. > **Note:** A tenant you've just connected shows "initial sync in progress" while its first full sync completes. That's expected, not an error. ## Compare A baseline describes the configuration a setting should have. Octiga checks the tenant's (or user's) real configuration against every baseline that applies, and each check has one of four outcomes: - **Passing** — the setting matches the baseline. - **Deviated** — it doesn't, and Octiga has opened a deviation. - **Excluded** — the tenant or user lacks the Microsoft licence the baseline needs, so Octiga leaves it out rather than reporting it as failing. - **Not assessed** — Octiga has no answer yet, because nothing has synced for it, a read failed, or there's no way to evaluate it. The reason is shown alongside. Deviations are counted. Baselines and deviations carry no severity or importance ranking. ## Act When a setting deviates, Octiga either raises an alert or writes the correct value back, depending on how you've configured that baseline. [Alerts](https://docs.octiga.io/monitoring/alerts/) covers where alerts go; [Remediation](https://docs.octiga.io/baselines/remediation/) covers automatic and manual fixes. ## Monitoring activity 1. **Microsoft 365 audit log** — Sign-ins, admin actions, mailbox rule changes 2. **Collected by Octiga** — Each event Microsoft logs for the tenant 3. **Located** — Country, region and network operator, resolved from the IP address 4. **Graded once, on arrival** — Critical, danger, warning or info, with your event rules applied 5. **Alerted, if warning or worse** — In the app, by email, or as a PSA ticket *An event is graded once, when it arrives, so a rule you add later applies to future events only.* Audit events take a different path. Microsoft 365 logs what happens in a tenant (sign-ins, admin actions, mailbox rule changes), and Octiga collects those events and grades each one once, on arrival, as critical, danger, warning or info. There's no baseline to compare an event against: the grade reflects the kind of event and where it came from, and an event rule you create can re-grade or hide future events from a source you trust. An event graded warning or worse shows up as an alert, alongside deviation alerts, and goes wherever you've routed it. [Events](https://docs.octiga.io/monitoring/events/) covers one tenant's events, [Event rules](https://docs.octiga.io/monitoring/event-rules/) covers rules, and [Alerts](https://docs.octiga.io/monitoring/alerts/) covers every tenant's alerts and where they go. ## Findings about accounts and mailboxes The same sync feeds two more checks that aren't baselines. Account risk looks at each user's identity data, such as sign-in activity, MFA registration and the roles they hold, for a fixed set of risks like a dormant admin or an account without a second factor. Mail flow looks at each mailbox's inbox rules, forwarding and remote access protocols and grades what it finds by severity. Both produce findings for you to work through, with the remedies beside each one; where a baseline governs the risk, the finding points at it. See [Account risk](https://docs.octiga.io/monitoring/account-risk/), [Mail flow](https://docs.octiga.io/tenants/mail-flow/) and [User remedies](https://docs.octiga.io/tenants/user-remedies/). ## Evidence retention A resolved deviation stays on record for 13 months after it closes: a twelve-month audit period plus a month's margin, which is what frameworks such as SOC 2 and ISO 27001 expect of evidence. Open deviations are never removed on a timer. ## Vocabulary **Baseline** — One desired security setting that Octiga can sync, compare and, in most cases, fix. See [Baselines](https://docs.octiga.io/baselines/). **Deviation** — An open finding: the setting in Microsoft 365 doesn't match the baseline. It resolves when the setting comes back into line, or when the baseline itself changes. See [Deviations](https://docs.octiga.io/baselines/deviations/). **Remediation** — Octiga writing a baseline's required value back into Microsoft 365, either automatically on detection or when you start it by hand. See [Remediation](https://docs.octiga.io/baselines/remediation/). **Event** — A Microsoft 365 audit-log record, graded critical, danger, warning or info the moment Octiga collects it. See [Events](https://docs.octiga.io/monitoring/events/). **Alert** — Anything graded that reaches your alert list. An alert comes from an event, a deviation or a notification from Octiga itself. See [Alerts](https://docs.octiga.io/monitoring/alerts/).