> For the complete documentation index, see [llms.txt](https://hub.equipme.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hub.equipme.io/documentation/automation/connectors/microsoft-entra-id-connector/workflow-examples.md).

# Workflow Examples

Individual components are only half the picture. What makes the connector useful is chaining them, so a request or a schedule turns into a finished process.

These five patterns cover most of what teams build first. Each one is short on purpose — they are starting points to adapt, not finished flows to copy.

#### Credential expiry with escalation

App secrets expire quietly and take integrations down with them. This flow makes sure someone hears about it in time, and that the message gets louder as the deadline approaches.

Start with the **Secret Expiring** trigger, set to a daily check. Give it a warning threshold with plenty of runway and a shorter escalation threshold. Turn on service principals so SAML signing certificates are included.

Then route each output somewhere different:

* **warning** → an email to the team that owns the application
* **escalation** → a ticket in your service desk, so it stops being optional
* **overdue** → a chat alert to IT leadership

The point of three destinations is that each one has a different audience. A warning is information; an escalation needs an owner; something already expired needs attention now.

#### Employee onboarding

A new starter needs an account, a license, group memberships and a way to set up their own MFA. Doing this by hand is where inconsistencies creep in.

1. **Add User** — with the usage location set, the manager assigned, and no password, so the connector generates a secure one
2. **Assign License** — using an SKU from **List Licenses**
3. **Add Group Members** — department and default groups
4. **Create Temporary Access Pass** — so the new starter can sign in once and register their own MFA

Send the access pass and the generated password to the line manager rather than the new account, since the new starter cannot reach their mailbox yet.

{% hint style="warning" %}
Set the usage location in step 1. Without it, Microsoft rejects the license assignment in step 2 and the flow fails halfway through.
{% endhint %}

#### Employee offboarding

The goal here is stopping access immediately and cleaning up afterwards — in that order.

1. **Update User** — set the account to disabled
2. **Revoke User Sessions** — disabling the account alone does not end sessions that are already running
3. **Remove License** — stop paying for it
4. **List Group Members** — to find and clean up memberships
5. After your retention period, **Delete User**

Steps 1 and 2 belong together. An account can be disabled while an active session keeps working, which is exactly the gap you are trying to close.

#### Weekly hygiene report

This one costs almost nothing to run and surfaces things nobody is looking for.

A scheduler on Monday morning, feeding **Monitor Inactive Users**, **Monitor Unused Licenses**, **Monitor Groups Without Owner** and **Monitor Stale Devices**. Route each findings output to a CSV file or an email to IT.

Unused licenses on disabled accounts are usually the one that pays for the effort.

#### Group-based provisioning

Instead of granting access per person, let group membership drive it.

Use the **New Group Member** trigger on the group that represents the access, then run whatever action provisions it in the target system. Build the mirror image with **Removed Group Member** to take the access away again.

The deprovisioning half is the part people skip, and it is the half auditors ask about.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hub.equipme.io/documentation/automation/connectors/microsoft-entra-id-connector/workflow-examples.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.