Baseline TypesThere are two main baseline types.

Tenant level baselines - Apply to the entire tenant. Do not have a user-level context
Group level baselines - Appy to a set of users in a group.

Group Baselines
This group should be chosen based on a specific and unique security need for a given group of users. An example of this might be adding a Management Group consisting of users whose data and habits require a unique set of baselines to best balance their business with their security.

Group Priority Order

Each security group may have different sets of security concerns consisting of various security configuration baselines. However, a group does not have to (and usually won't) define a baseline for each security configuration. Furthermore, a user may be part of two or more user groups given their various roles in the client organisation.

These groups may, in some cases, have conflicting security concerns. Take for example a remote worker who is also a manager. Their management role may dictate different access policies respectively.

To rationalise this we implement a group baseline priority order. The baseline engine evaluates each group of users and applies baselines to users in a first past the post approach. In this fashion, starting from the top, when a group is evaluated, if a user is found to have a given baseline defined it will be applied. If that same user is subsequently found in a lower priority group, which defines, the same baseline, the latter baseline will not be applied for that user.