Baselines

Baselines define your expected configuration state. Drift detection compares current settings against baselines to identify changes.

Understanding Baselines

A baseline captures what your configuration should look like:

• Snapshot baseline - Current configuration captured at a point in time
• Policy baseline - Explicitly defined expected values
• Template baseline - Industry-standard configurations

Creating Baselines

From Current Configuration

Capture your current settings as a baseline:

1. Go to Drift Detection > Baselines
2. Click Create Baseline
3. Select From Current Configuration
4. Choose resource type (e.g., Conditional Access Policies)
5. Select specific resources or all
6. Click Create Baseline

This creates a snapshot of current settings as your expected state.

From Policy Definition

Define explicit expected values:

1. Go to Drift Detection > Baselines
2. Click Create Baseline
3. Select Policy Baseline
4. Choose resource type
5. Define expected values using the form
6. Click Create Baseline

Use this when you know the exact values you want enforced.

From Template

Use pre-built industry templates:

1. Go to Drift Detection > Baselines
2. Click Create Baseline
3. Select From Template
4. Choose a template (e.g., CIS Benchmark)
5. Review and customize
6. Click Create Baseline

Baseline Configuration

Comparison Rules

Define how current values are compared to baselines:

Example Comparison Rules

Exact Match

Expected: "enabled"
Current: "enabled" → Pass
Current: "disabled" → Fail

Contains

Expected: ["admin@company.com"]
Current: ["admin@company.com", "security@company.com"] → Pass
Current: ["user@company.com"] → Fail

Regex

Expected: "^(daily|weekly)$"
Current: "daily" → Pass
Current: "monthly" → Fail

Severity Assignment

Assign severity to baselines:

1. In baseline settings, find Severity
2. Select: Critical, High, Medium, or Low
3. This severity applies to all drift events from this baseline

Managing Baselines

Viewing Baselines

The baselines list shows:

Editing Baselines

To modify a baseline:

1. Click on the baseline name
2. Click Edit
3. Update expected values or rules
4. Click Save Changes

Deactivating Baselines

Temporarily stop monitoring:

1. Click on the baseline
2. Click Deactivate
3. Monitoring pauses; existing events remain

Reactivate by clicking Activate on an inactive baseline.

Deleting Baselines

Permanently remove a baseline:

1. Click on the baseline
2. Click Delete
3. Confirm deletion

Baseline Best Practices

Start with Critical Resources

Prioritize baselines for:

1. Conditional Access Policies - Authentication controls
2. Admin Roles - Privileged access
3. External Sharing - Data exposure risk
4. Mail Flow Rules - Communication security

Review Regularly

Schedule baseline reviews:

Document Changes

When updating baselines:

• Record why the change was made
• Note who approved the change
• Update related documentation

Test Before Production

For new baselines:

1. Create in "monitoring only" mode
2. Review detected differences
3. Adjust rules as needed
4. Enable alerting when confident

Baseline Templates

Available Templates

Using Templates

Templates provide:

• Pre-configured expected values
• Recommended severity levels
• Industry-aligned comparison rules

Customize templates for your environment:

1. Select template as starting point
2. Review all settings
3. Adjust for organizational requirements
4. Save as your baseline

Troubleshooting

Too Many Drift Events

If baselines generate excessive events:

• Review comparison rules for accuracy
• Consider using "contains" instead of "exact"
• Increase threshold values where appropriate
• Split broad baselines into specific ones

Baseline Not Detecting Changes

If expected drift isn't caught:

• Verify baseline is active
• Check monitoring schedule is running
• Ensure comparison rules match the data format
• Review API permissions for resource access

Baseline Conflicts

If multiple baselines cover the same resource:

• Only the most specific baseline applies
• Review baseline scope for overlap
• Consider consolidating baselines

What's Next?

• Visual Builder - Create baselines visually
• History - View configuration changes
• Alerts - Configure notifications