Before
An operator would review each incoming request, determine the identity and remediation type, and decide which credential or session action was required. They would then switch between identity and cloud administration tools to locate service principals, update credentials, revoke sessions, or reset passwords before confirming completion.
How it works
- Receive the email-triggered request and check the identity type to determine whether the workflow should continue.
- Route the request according to the identity and remediation type, including service-principal credential updates, session revocation, password generation, or password reset.
- Complete the selected action, restore the service-principal configuration when applicable, and mark the workflow done.
Workflow details
- Trigger and qualification: The workflow starts when an email event is received and evaluates the identity type associated with the request. Unsupported or nonmatching identity types can exit the workflow without further action.
- Identity-based routing: For service-principal cases, the workflow retrieves the available service principals, temporarily unlocks the relevant configuration, adds a new password, and locks the configuration again after the update.
- Remediation decision: For supported identity cases, the workflow checks the requested remediation type and selects the appropriate response, including revoking an access session or proceeding with password-related remediation.
- Credential and session actions: The selected branch can revoke a user session, generate a new application publishing password, or reset a user password in the applicable environment. These actions are performed through the connected Microsoft and Azure services.
- Completion: After the selected remediation path finishes successfully, the workflow marks the process as done; service-action failures stop the execution rather than continuing with later steps.
What changed
Identity and remediation checks now determine the action automatically from the incoming email, and the selected credential or session operation is executed through the appropriate cloud service. The human handoff changes from performing each administrative action to submitting or originating the request while the workflow completes the qualifying branch and stops safely on service failure.
Work removed
Reviewing remediation emails one by one, identifying the affected identity type, selecting the correct remediation path, listing service principals, unlocking and relocking configurations, adding replacement passwords, generating application publishing passwords, revoking sessions, and manually resetting user passwords.
Expected outcome
Each qualifying request receives consistent branch-specific remediation with at least two routing checks automated per event; no measured time-savings claim is available.
