Automation Blueprints

1. Approved Joiner Provisioning (M365 & Security)

Automate approved new-hire onboarding across directory services, licensing, password management, and PSA documentation. Verify HR approval, target tenant, and requested access before provisioning. An unverified form submission is not authorization.

1. Trigger (Webhook). With Body only enabled, read {{ 1.first_name }}, {{ 1.last_name }}, {{ 1.department }}, and {{ 1.manager_email }} (or under {{ 1.body }} by default).
2. Credentials (Code Execution). Format the UPN ({{ 1.first_name }}.{{ 1.last_name }}@example.com). Any password printed by Code editor enters Step output and execution history. Use an IdP setup link if client policy prohibits logged temporary passwords.
3. Entra ID and M365 (HTTP Request). Call Microsoft Graph (POST /v1.0/users), assign the M365 license SKU, and add security groups.
4. Vault and PSA. Invite the user to 1Password or Bitwarden and create the contact in HaloPSA, ConnectWise, IT Glue, or Hudu. Message the manager in Teams or Slack using an expiring credential link rather than plain text.

4. Leaver Deprovisioning & Session Invalidation

Run approved offboarding promptly, verify access removal in each system, and reclaim unused licenses.

• Revoke Active Sessions. Microsoft Graph’s revokeSignInSessions  invalidates refresh tokens and browser cookies. It can take several minutes and does not revoke external home-tenant sessions. Verify access removal directly.
• Convert Mailbox and Reclaim Licenses. Disable sign-in and convert the Exchange mailbox to a Shared Mailbox delegated to the manager. Remove unneeded licenses after checking retention rules, and review the CSP subscription separately to adjust billed seats.
• Vault and PSA Closure. Revoke 1Password or Bitwarden access, mark the user Inactive in documentation, and log completed steps on the ticket.

2. EDR Threat Triage & Host Isolation

Ingest security alert webhooks, summarize indicators of compromise (IoCs) with AI, and route confirmed threats according to the client’s isolation policy.

1. Trigger (Webhook). Receive alert payloads from SentinelOne, Huntress, or CrowdStrike (process hash, command line, classification, host ID).
2. AI Triage (AI Prompt). Summarize the attack technique and extract IoC context from the command line and detection metadata.
3. Severity Routing (Conditions). For Critical alerts, follow the client’s approved EDR isolation procedure and verify host isolation status. Alert on-call via PagerDuty or Twilio and open a Critical PSA ticket. Never rely on AI classification alone to authorize host isolation. Log Low or Medium events as standard PSA tickets.

5. Tier-1 RMM Disk Space Remediation

Run approved disk cleanup scripts on recurring low-space alerts, verify recovered storage, and escalate unresolved endpoints.

1. Trigger and Script (Webhook → HTTP Request). Receive the NinjaOne or Datto RMM low-disk alert. Trigger the client’s approved cleanup script after confirming target device, permitted paths, and retention rules.
2. Poll Job and Re-check (Wait → HTTP Request). Wait between RMM job status checks with a bounded timeout. Query updated free disk space once the job finishes.
3. Outcome (Conditions). Auto-resolve the alert and close the PSA ticket if free space is restored. Otherwise escalate to Tier-2 with diagnostic logs attached.

3. CSP / SaaS License Reconciliation

Compare active M365 or Pax8 subscription counts against PSA recurring agreement lines before billing closes.

1. Schedule and Query (Scheduler → HTTP Request). Run before billing closes (such as the 1st of the month at 02:00 UTC). Fetch the contractually relevant cloud seat count (assigned, purchased, or billable) and matching PSA agreement lines.
2. Variance (Data Transformation). Subtract billed PSA seats from provider seats using numbered outputs from the Workflow data panel.
3. Route (Conditions). Open a billing review ticket for any non-zero variance or unmatched SKU. Update billed quantities only after commercial approval, and log zero-variance matches.

6. Hardware Warranty & QBR Reporting

Aggregate expiring workstation warranties and unsupported OS builds by department for Quarterly Business Reviews (QBRs).

1. Schedule and Fetch (Scheduler → HTTP Request). Query asset records for devices with warranties expiring within 90 days or unsupported OS versions. Include department and an approved replacement cost estimate in one currency.
2. Aggregate (Summarize). Group by department, count devices, and sum the replacement-cost field (Summarize totals supplied numbers rather than estimating prices).
3. Deliver. Post the grouped summary to Teams or Slack, flagging missing cost estimates before preparing quotes.