Automation Blueprints

These reusable patterns give MSPs and IT consultants a practical starting point for user lifecycle work, billing reconciliation, security triage, endpoint maintenance, and reporting. Configure each one for the client’s systems, approval process, and operating procedures.

---

1. Zero-Touch Joiner Provisioning (M365 & Security Stack)

Automate new hire onboarding across directory services, license assignment, password management, and documentation without manual technician steps.

How to build this in Glow:

1. Trigger (Webhook): Ingest the HR ticket or onboarding form submission ({{ 1.first_name }}, {{ 1.last_name }}, {{ 1.department }}, {{ 1.manager_email }}).
2. Credential Generation (Code Execution): Generate a compliant random temporary password and format the User Principal Name (UPN): {{ 1.first_name }}.{{ 1.last_name }}@clientdomain.com.
3. Directory Creation (HTTP Request): Call Microsoft Graph API (POST /v1.0/users) to provision the user object in Entra ID.
4. License & Security Groups: Assign the appropriate M365 Business Premium / Standard license SKU and add the user to departmental security groups.
5. Password Manager: Invite the user to the client organization’s 1Password or Bitwarden tenant.
6. PSA & Documentation Update: Create the contact record in HaloPSA, ConnectWise, IT Glue, or Hudu to link future tickets and asset configurations.
7. Manager Notification (Teams / Slack): Send a direct message to the hiring manager with a secure one-time link to access initial credentials.

---

2. EDR Threat Detection Triage & Host Isolation Routing

Process high-volume security alert webhooks, extract incident forensic indicators with AI, and isolate affected endpoints when critical threats are confirmed.

How to build this in Glow:

1. Trigger (Webhook): Inbound webhook from SentinelOne, Huntress, or CrowdStrike containing process hash, command line, threat classification, and host ID.
2. AI Analysis (AI Prompt): Prompt the AI step with the raw command line arguments and detection details to summarize the attack technique and extract indicator of compromise (IoC) context in plain text.
3. Severity Routing (Conditions):
   • Critical (High Confidence Threat): Call the EDR API (POST /web/api/v2.1/agents/{id}/actions/isolate) to disconnect the host from the network, trigger an on-call alert via PagerDuty/Twilio, and open a Critical priority PSA ticket.
   • Low/Medium (Informational or Quarantined): Log the event as a standard service ticket on the client’s PSA service board for routine review during business hours.

---

3. CSP / SaaS License Reconciliation vs. PSA Agreements

Cross-reference active M365 / Pax8 subscription quantities against billed PSA recurring agreement additions to prevent unbilled license leakage.

How to build this in Glow:

1. Trigger (Scheduler): Executes automatically on the 1st of each month at 02:00 UTC before the billing cycle closes.
2. Fetch Cloud Quantities (HTTP Request): Query Pax8 API or Microsoft Graph API for active assigned license counts per client tenant.
3. Fetch Contract Quantities: Query HaloPSA or ConnectWise Manage for the current recurring addition unit count on the client’s agreement.
4. Variance Calculation (Data Transformation): Subtract the billed seat count returned by step 3 from the active seat count returned by step 2. Pick both numbered outputs from the Workflow data panel rather than inventing field references.
5. Reconciliation Routing (Conditions):
   • If the calculated variance is greater than zero: update the agreement addition count through the PSA API, or create a billing-variance review ticket with the supporting line items.
   • If the calculated variance is zero: record the successful check in run history.

---

4. Immediate Leaver Deprovisioning & Session Invalidation

Execute time-sensitive employee offboarding immediately to close security attack surfaces and stop unneeded recurring license costs.

Key automated operations:

• Revoke Active Sessions: Call Microsoft Graph (POST /v1.0/users/{id}/revokeSignInSessions) to immediately terminate all active OAuth refresh tokens, browser sessions, and mobile connections.
• Convert Mailbox: Disable the account, convert the user’s Exchange mailbox to a Shared Mailbox, and delegate read access to the direct manager.
• Reclaim Licenses: Remove paid M365 Business Premium, Copilot, or add-on SKUs to stop unnecessary recurring billing.
• Vault Deletion: Revoke the user from 1Password / Bitwarden company collections.
• Documentation & Ticket Closure: Update the user state to “Inactive” in the documentation system and add the completed actions to the offboarding ticket.

---

5. Automated Tier-1 RMM Disk Space Remediation

Resolve recurring low-disk-space alerts across client workstations and servers without requiring level-1 technician dispatch.

How to build this in Glow:

1. Trigger (Webhook): Ingest alert payload from NinjaOne or Datto RMM when volume free space drops below the monitor threshold (e.g., < 5%).
2. Execute Remediation Script (HTTP Request): Trigger an approved maintenance script via RMM API to clear Windows Update caches (C:\Windows\SoftwareDistribution), purge temp directories, and empty system recycle bins.
3. Wait Step (Wait): Pause workflow execution for 2 minutes while the remote agent script finishes execution.
4. Re-query Endpoint Health: Query the RMM device status API for the updated free space metric on the affected drive.
5. Evaluate Outcome (Conditions):
   • If free space is restored above threshold: Auto-resolve the RMM alert, append the recovered gigabytes to the PSA ticket, and close the ticket.
   • If free space remains below threshold: Escalate the ticket to Tier-2 service queue with full diagnostic output attached.

---

6. Hardware Asset Warranty & Lifecycle Reporting

Automate asset aging analysis to streamline Quarterly Business Review (QBR) prep and identify workstation replacement opportunities.

How to build this in Glow:

1. Trigger (Scheduler): Executes on the 15th of every month.
2. Fetch Device Lifecycle Data (HTTP Request): Query ScalePad, IT Glue, or Microsoft Intune for client devices with OEM warranties expiring within 90 days or running unsupported OS builds.
3. Data Aggregation (Summarize): Group expiring assets by client department, compute estimated budget impact, and generate a structured overview table.
4. Delivery: Send a formatted summary card to your account management team’s channel in Microsoft Teams or Slack to prepare client upgrade quotes.

---

Deploying a Blueprint to Clients

Once you have built and tested a pattern in your own workspace:

1. Start a push and choose one client workspace as the target.
2. Review the preflight. It shows the app connections, variable and secret keys, files, and sample data that need attention.
3. Resolve client-specific items with the client. If they have no account for an app, or more than one, the copied step arrives without an account selected. Missing variables and secrets are created without values for the client to fill in.
4. Start the push. The workflow arrives as an inactive copy, so the client can review its configuration, complete any missing values, and switch it to Live.
5. Repeat the push for each additional client.

---

What’s Next?

👉 Pushing Workflows to Clients → — review the preflight, resolve client-specific connections and values, and deliver an inactive copy.

Sideways from here: return to the App Directory when a pattern needs another client system.