Before
A team member likely had to retrieve users from the domain, work through paginated results, and copy each email address into a breach-checking service. They then had to review the returned breach information and manually update a spreadsheet, repeating the process for every user.
How it works
- The workflow starts from an incoming email event, clears the existing spreadsheet data, and retrieves all users from the configured domain across available result pages.
- It extracts and flattens the user email list, then checks each account for known breaches with a short pause between requests.
- It extracts the breach findings and appends them to the spreadsheet for centralized review and record-keeping.
Workflow details
- Trigger and reset: An incoming email event starts the workflow, which first clears the target spreadsheet so the new run produces a refreshed record rather than retaining stale results.
- User collection: The workflow retrieves users from the configured domain, handles multiple result pages when necessary, extracts their email addresses, and flattens them into a list for processing.
- Breach checking: Each user email is processed individually. The workflow pauses between checks, retrieves all known breach records for the account, and extracts the relevant breach information.
- Record keeping: The extracted breach details are appended to the spreadsheet as each user is processed, creating a durable list for review and further analysis.
- Operational result: The complete process runs without showing a human approval step; the final spreadsheet contains the breach findings generated for the users retrieved during that run.
What changed
User collection, pagination, per-account breach checks, result extraction, and spreadsheet updates now happen in one automated run. The breach record becomes available in the refreshed spreadsheet without requiring a person to switch between directory records, a breach lookup service, and manual spreadsheet entry.
Work removed
Manually clearing prior spreadsheet results, paging through the domain user list, copying email addresses, checking each account for breaches, reviewing returned breach data, and entering findings into the spreadsheet.
Expected outcome
Each run produces a refreshed breach inventory for the retrieved users and removes at least two recurring manual actions per processed user: performing the breach lookup and recording the result.
