How Octiga works

Octiga watches two things about each tenant: how it’s configured and what’s happening in it. It keeps the configuration in line with your baselines by repeating three steps (sync, compare and act), and it grades the activity as it arrives. Once you know how the two fit together, the rest of the product is easier to reason about.

Microsoft 365Users, groups, policies, mailbox settings

Octiga's synced copyScheduled, on demand, and after every change notification

Compared against your baselinesThe configuration you have required

DeviatedThe setting no longer matches

Alerted, or fixed automaticallyThen written back to Microsoft 365

A deviation feeds an alert or an automatic fix, then the next sync starts the loop again.

Sync

Octiga pulls a tenant’s users, groups, policies, mailbox settings and sign-in data from Microsoft 365 on a schedule. It also syncs sooner when you run an on-demand sync, when a tenant is first connected, when Microsoft sends a change notification, and right after Octiga writes a value during remediation.

Most changes show up within about an hour. On tenants where Octiga watches change notifications, mailbox and authentication details can take up to about two hours. Tenants without change notifications sync on a slower, fixed schedule.

Note

A tenant you’ve just connected shows “initial sync in progress” while its first full sync completes. That’s expected, not an error.

Compare

A baseline describes the configuration a setting should have. Octiga checks the tenant’s (or user’s) real configuration against every baseline that applies, and each check has one of four outcomes:

• Passing — the setting matches the baseline.
• Deviated — it doesn’t, and Octiga has opened a deviation.
• Excluded — the tenant or user lacks the Microsoft licence the baseline needs, so Octiga leaves it out rather than reporting it as failing.
• Not assessed — Octiga has no answer yet, because nothing has synced for it, a read failed, or there’s no way to evaluate it. The reason is shown alongside.

Deviations are counted. Baselines and deviations carry no severity or importance ranking.

Act

When a setting deviates, Octiga either raises an alert or writes the correct value back, depending on how you’ve configured that baseline. Alerts covers where alerts go; Remediation covers automatic and manual fixes.

Monitoring activity

Microsoft 365 audit logSign-ins, admin actions, mailbox rule changes

Collected by OctigaEach event Microsoft logs for the tenant

LocatedCountry, region and network operator, resolved from the IP address

Graded once, on arrivalCritical, danger, warning or info, with your event rules applied

Alerted, if warning or worseIn the app, by email, or as a PSA ticket

An event is graded once, when it arrives, so a rule you add later applies to future events only.

Audit events take a different path. Microsoft 365 logs what happens in a tenant (sign-ins, admin actions, mailbox rule changes), and Octiga collects those events and grades each one once, on arrival, as critical, danger, warning or info. There’s no baseline to compare an event against: the grade reflects the kind of event and where it came from, and an event rule you create can re-grade or hide future events from a source you trust. An event graded warning or worse shows up as an alert, alongside deviation alerts, and goes wherever you’ve routed it. Events covers one tenant’s events, Event rules covers rules, and Alerts covers every tenant’s alerts and where they go.

Findings about accounts and mailboxes

The same sync feeds two more checks that aren’t baselines. Account risk looks at each user’s identity data, such as sign-in activity, MFA registration and the roles they hold, for a fixed set of risks like a dormant admin or an account without a second factor. Mail flow looks at each mailbox’s inbox rules, forwarding and remote access protocols and grades what it finds by severity. Both produce findings for you to work through, with the remedies beside each one; where a baseline governs the risk, the finding points at it. See Account risk, Mail flow and User remedies.

Evidence retention

A resolved deviation stays on record for 13 months after it closes: a twelve-month audit period plus a month’s margin, which is what frameworks such as SOC 2 and ISO 27001 expect of evidence. Open deviations are never removed on a timer.

Vocabulary

Baseline

One desired security setting that Octiga can sync, compare and, in most cases, fix. See Baselines.

Deviation

An open finding: the setting in Microsoft 365 doesn’t match the baseline. It resolves when the setting comes back into line, or when the baseline itself changes. See Deviations.

Remediation

Octiga writing a baseline’s required value back into Microsoft 365, either automatically on detection or when you start it by hand. See Remediation.

Event

A Microsoft 365 audit-log record, graded critical, danger, warning or info the moment Octiga collects it. See Events.

Alert

Anything graded that reaches your alert list. An alert comes from an event, a deviation or a notification from Octiga itself. See Alerts.