Before
An administrator likely had to review each lockout request, confirm the requester’s details, search the device inventory, and locate the relevant local account manually. They then had to create the unlock command, track its status, and notify both the team and the user of the decision.
How it works
- Receive the unlock request and present the team with an approval decision in the operations channel.
- If approved, match the requester to the managed computer and local account, authenticate, and queue the unlock command.
- Update the team and notify the user with either the successful unlock status or the decline decision.
Workflow details
- Request intake: A webhook receives each device unlock request and posts a message to the operations channel with the requester’s identity and Yes/No approval options.
- Approval decision: A team member makes the unlock decision directly from the request message, sending the workflow down an approved or declined path.
- Account and device resolution: When approved, the workflow retrieves the requester’s email, finds the matching computer inventory record in Jamf Pro, and identifies the local account and computer needed for the command.
- Unlock execution: The workflow authenticates with Jamf Pro and queues an UnlockUserAccount command for the identified computer, then updates the team message and tells the user that the device was unlocked, noting that the change may take a few minutes to take effect.
- Decline handling: When the request is rejected, the original team notification is updated and the requester receives a message explaining that the request was declined and that they may retry or contact an administrator.
What changed
The approval, identity lookup, device and account matching, command creation, and outcome notifications now happen in one workflow. The team still makes the Yes/No decision, but the approved action is queued automatically and both approval outcomes are communicated without separate handoffs.
Work removed
Reviewing requests one by one, looking up the requester’s email, finding the matching managed computer and local account, authenticating to Jamf Pro, creating the unlock command, updating the team, and messaging the user manually.
Expected outcome
A conservative estimate is that each request removes roughly four to six recurring manual actions, while delivering a documented approval outcome and user notification through the same workflow.
