All use cases

Coordinate Device Containment Actions

This automation receives an authorized lost-device containment plan and routes each action to the appropriate endpoint, identity, or device-management operation. It isolates devices, revokes sessions, locks devices, wipes them, or retires corporate data while continuing with other actions and returning a submission record.

Incident Response

Endpoint security

Access Control

Data Protection

Trigger

A parent lost-device workflow submits an action list with action types, targets, labels, and an optional reason.

Outcome

A record of dispatched or ignored actions is returned after each submitted action is routed and processed.

Trigger

A parent lost-device workflow submits an action list with action types, targets, labels, and an optional reason.

Outcome

A record of dispatched or ignored actions is returned after each submitted action is routed and processed.

Before

An operator had to translate the response decision into separate actions across endpoint, identity, and device-management consoles. They also had to process each item individually, track what was submitted, and continue the remaining work when one action failed.

How it works

Receive the parent workflow’s authorized containment plan.
Match each action type to the corresponding isolation, session, lock, wipe, or corporate-data retirement operation.
Continue processing the remaining items and return the resulting submission record.

Workflow details

Plan intake: The workflow receives an action list containing an action type, target, label, and optional reason from a parent lost-device response workflow.
Action routing: Each item is evaluated and sent to the matching operation: machine isolation, session revocation, remote lock, device wipe, or corporate-data retirement.
Containment handling: Isolation is applied when the machine reconnects, session revocation requires reauthentication, remote lock secures the device, retirement removes corporate data and applications, and wipe performs an irreversible factory reset.
Resilient execution: An individual failure does not stop the remaining actions, while unknown action types are skipped and marked as ignored.
Execution handoff: The workflow returns the submitted actions so the calling workflow retains control of authorization and receives a repeatable execution record.

What changed

The calling workflow now sends one action list, while routing, operation selection, failure continuation, and execution-result collection happen automatically. Authorization remains with the calling workflow, including the decision to issue an irreversible wipe.

Work removed

Switching between endpoint, identity, and device-management consoles; translating each action type into the correct operation; manually tracking submitted actions; and restarting the sequence after an individual failure.

Expected outcome

For a plan containing all supported categories, one automated pass can route up to five action types and produce one execution record without separate manual console routing.

Connected tools

Microsoft Graph Device Management Actions

Microsoft Defender for Endpoint

Microsoft Graph - Users Actions

Related flows

All use cases

Explore more workflows with similar topics or tools.

Automated Employee Offboarding

Automates employee offboarding by identifying recently changed employee records, checking whether offboarding is due today, removing qualifying users from Slack, suspending their Google Workspace and Okta access, and sending a detailed status email. This replaces a multi-system manual checklist with a consistent automated sequence.

Explore use case

Automated Notable Event Status Updates

This automation receives notable security alerts, locates the corresponding notable event through a controlled search process, and updates its status with a comment in the security platform. It also monitors search completion and emails an administrator when the search fails.

Explore use case

Interactive Identity Incident Remediation

This automation turns Teams security event messages into actionable remediation workflows, allowing authorized users to reset passwords, lock accounts, revoke sessions, investigate session identifiers, or route supported requests to specialized subflows. It updates the original incident message with the selected action, actor, and timestamp so the response remains visible in the incident conversation.

Explore use case

Less busywork. More possibility.

Let your agents handle the routine. Make room for what comes next.

Let’s talk