Before
Security staff would likely query breach records for accounts one at a time, compare results with a separate history tracker, and manually coordinate sign-outs, password changes, spreadsheet updates, and notifications. Individual scans and organization-wide reports also depended on separate handoffs between directory administration, breach lookup, tracking, and team communication.
How it works
- A schedule or individual webhook request builds the account list, and the workflow retrieves active users or the submitted email address.
- Each account is checked for breaches, throttled requests are retried after a delay, and current findings are compared with the existing breach history to identify new exposures.
- Newly breached accounts are signed out, assigned a temporary password with a forced change at next login, logged in the tracker, and reported to administrators or the requesting user in Slack.
Workflow details
- Trigger and account collection: The workflow starts from either a scheduled trigger for an organization-wide scan or a webhook request containing an individual email address. For scheduled scans, it retrieves active users from the organization directory; for individual requests, it builds the scan list from the submitted account.
- Breach checking and throttling: Each account is checked against Have I Been Pwned. A not-found response is treated as no known breach, a successful breach response continues to remediation and reporting, and a throttling response pauses the workflow for 60 seconds before retrying the account scan.
- Historical comparison: The workflow reads the existing breach tracker from a spreadsheet and compares each account's current breach results with its recorded history. Previously known breaches are filtered from new-action processing, while newly identified breach information is prepared for tracking.
- Automated remediation: For a newly breached primary account, the workflow signs the user out of web and device sessions, resets sign-in cookies, generates a temporary password, updates the account, and requires a password change at the next login. It also updates the breach tracker with the account, breach names, and scan date.
- Notification and reporting: Administrators receive a confidential Slack message containing the remediation details and temporary password. After processing, the workflow sends a consolidated account breach report for scheduled scans or an individual result for webhook-triggered scans, while returning a no-breach outcome when no findings are produced.
What changed
Breach checks, historical comparison, remediation, tracking, and notification now happen in one automated workflow. Newly detected primary-account breaches trigger directory actions and confidential administrator alerts without requiring a separate manual handoff for each account, while the final report is routed according to whether the scan was scheduled or individually requested.
Work removed
Manually querying breach status for each account, comparing results with prior records, identifying new breaches, signing users out, resetting passwords and sessions, updating the breach spreadsheet, preparing reports, and notifying administrators.
Expected outcome
The workflow provides repeatable coverage of active accounts and can conservatively remove about five recurring manual actions for each newly detected breach, although this is an estimate rather than a measured result.
