Before
Security teams likely had to check each email address for credential exposure, search the user directory for affected accounts, and determine which users required action. They then had to update each account manually to enforce a password change.
How it works
- Process each email address and check whether associated credential data has been exposed.
- Search the managed-user directory for the affected email address and verify the corresponding account.
- Automatically require a password change at the user’s next sign-in when the leak condition is met.
Workflow details
- Credential exposure check: The workflow processes each email address in the supplied list and queries the credential intelligence service to determine whether credential data associated with the address has been exposed.
- User validation: When the credential check indicates a potential password leak, the workflow searches the managed-user directory for the matching email address and retrieves the corresponding user account.
- Conditional response: The workflow evaluates whether a leak was detected and proceeds only when the condition is met, keeping unaffected accounts outside the password-enforcement path.
- Password protection: For a matched affected user, the account is updated so that the user must change their password at the next sign-in, creating a direct remediation step for the detected exposure.
What changed
Credential exposure checks, account matching, and the remediation decision now occur within one workflow. When a leak is detected for a managed user, the password-change requirement is applied automatically instead of waiting for a separate manual account update.
Work removed
Checking email addresses one by one for leaked credentials, searching the user directory for matching accounts, deciding whether remediation is required, and manually enabling the next-sign-in password-change requirement.
Expected outcome
The workflow can remove at least two recurring lookups per email—credential exposure checking and user-directory searching—and automatically apply password-change enforcement for detected leaks.
