Before
Reviewers checked notification history, searched the directory for the user, and verified account status one case at a time. They then prepared and sent separate email and Teams messages and recorded the outreach manually, creating opportunities for duplicate notices or delayed handoffs.
How it works
- Check recent notification history for the user and application, then stop if an equivalent notice was sent within 30 days.
- Resolve the user in the directory and verify that the account exists and is active before preparing a localized, risk-aware message.
- Send the notice by email and Teams, then record the delivery details for future deduplication.
Workflow details
- Trigger and deduplication: The flow starts when an application-use event provides the user login, application, normalized application identifier, risk level, risk reasons, and any approved alternative. It checks notification history and stops when the same user and application were notified within the previous 30 days.
- Identity validation: For new cases, the workflow searches the directory for the login, resolves the person’s name, email, preferred language, department, manager, and account status, and continues only when a matching account is found and active. Missing or disabled accounts end without delivery.
- Message preparation: The flow creates a French or English notification using the user’s preferred language. The message identifies the unapproved application, explains the supplied risk reasons, recommends an approved alternative when available, provides an exception-request link, and clarifies that the notice is informational.
- Multichannel delivery: The prepared notice is sent to the resolved email address and followed by a direct Teams message containing the application, risk level, alternative, and exception link. The workflow then records the channels used and the notification timestamp.
- Operational result: The output reports the login, notification outcome, delivery status, email receipt, and deduplication record. In this website demonstration, the external reads and writes return simulated responses while preserving the configured routing.
What changed
Each eligible event is checked for duplicates and account eligibility automatically before any outreach occurs. The approved message is assembled and delivered through both channels, while the notification record is created as part of the same handoff; human review is only needed for cases that do not meet the automated criteria or require an exception.
Work removed
Reviewing notification history, searching directory records, verifying account status, preparing localized messages, sending separate email and Teams notices, and recording delivery details.
Expected outcome
A consistent, auditable notice for each eligible event, with roughly four or more recurring manual actions removed per case as a conservative estimate.
