Workflow Examples

Individual components are only half the picture. What makes the connector useful is chaining them, so a request or a schedule turns into a finished process.

These five patterns cover most of what teams build first. Each one is short on purpose — they are starting points to adapt, not finished flows to copy.

Credential expiry with escalation

App secrets expire quietly and take integrations down with them. This flow makes sure someone hears about it in time, and that the message gets louder as the deadline approaches.

Start with the Secret Expiring trigger, set to a daily check. Give it a warning threshold with plenty of runway and a shorter escalation threshold. Turn on service principals so SAML signing certificates are included.

Then route each output somewhere different:

• warning → an email to the team that owns the application
• escalation → a ticket in your service desk, so it stops being optional
• overdue → a chat alert to IT leadership

The point of three destinations is that each one has a different audience. A warning is information; an escalation needs an owner; something already expired needs attention now.

Employee onboarding

A new starter needs an account, a license, group memberships and a way to set up their own MFA. Doing this by hand is where inconsistencies creep in.

1. Add User — with the usage location set, the manager assigned, and no password, so the connector generates a secure one
2. Assign License — using an SKU from List Licenses
3. Add Group Members — department and default groups
4. Create Temporary Access Pass — so the new starter can sign in once and register their own MFA

Send the access pass and the generated password to the line manager rather than the new account, since the new starter cannot reach their mailbox yet.

Set the usage location in step 1. Without it, Microsoft rejects the license assignment in step 2 and the flow fails halfway through.

Employee offboarding

The goal here is stopping access immediately and cleaning up afterwards — in that order.

1. Update User — set the account to disabled
2. Revoke User Sessions — disabling the account alone does not end sessions that are already running
3. Remove License — stop paying for it
4. List Group Members — to find and clean up memberships
5. After your retention period, Delete User

Steps 1 and 2 belong together. An account can be disabled while an active session keeps working, which is exactly the gap you are trying to close.

Weekly hygiene report

This one costs almost nothing to run and surfaces things nobody is looking for.

A scheduler on Monday morning, feeding Monitor Inactive Users, Monitor Unused Licenses, Monitor Groups Without Owner and Monitor Stale Devices. Route each findings output to a CSV file or an email to IT.

Unused licenses on disabled accounts are usually the one that pays for the effort.

Group-based provisioning

Instead of granting access per person, let group membership drive it.

Use the New Group Member trigger on the group that represents the access, then run whatever action provisions it in the target system. Build the mirror image with Removed Group Member to take the access away again.

The deprovisioning half is the part people skip, and it is the half auditors ask about.