Automation that replaces your pile of scripts
Provision accounts, route alerts, and connect internal tools on a visual canvas instead of a cron job someone wrote in 2019. Every run in WEXTL keeps a step-by-step log, so you always know what ran and why.
Deploys this workflow into your workspace — you'll connect your own accounts.
Workflow that loops through account systems and provisions each one for a new hire
- GDPR
- Data Encryption
- 2FA
- Local Data Region
- 6
- systems one offboarding has to touch, by hand
- 15 min
- of quiet before an unacknowledged page escalates
- 0
- systems left over after the leaver date
* Illustrative example, not measured customer data.
IT automation, at a glance
What IT teams run on WEXTL
Common patterns, built from real workflows. Start from a template or a blank canvas.
Accounts ready before day one
A signed offer kicks off one workflow that creates accounts, assigns groups, and requests hardware — in order, with a log.
- Trigger — an HR status change lands (a start date confirmed, a role change, or a termination date set), or the same workflow runs from a filled-in intake form when there's no HR feed yet.
- Information collected — the person's role, department, manager, start or end date, and whether they're a contractor with a fixed access window.
- Connected applications — Microsoft Entra ID for identity and group membership, Invgate for the hardware-request ticket and internal notes, Slack or Microsoft Teams for the confirmation.
- Decision logic — role and department map to a saved bundle of groups and licenses; elevated groups (admin, production) are flagged separately from the standard bundle; a mismatch between the HR signal and what's already provisioned pauses the run.
- AI step — drafts the onboarding confirmation and, on the leaver side, a note listing anything that needs manual follow-up because it has no API.
- Human approval — elevated or admin-level grants wait for a manager or security sign-off before they're applied; standard bundles do not.
- Actions — creates or updates the Entra ID account and groups, opens the Invgate hardware ticket, and posts the confirmation to Slack or Teams.
- Exception handling — a role with no mapped bundle, or a start-date mismatch, is held and flagged instead of provisioned with default access.
Workflow that loops through account systems and provisions each one for a new hire
What IT actually spends a day fighting
None of it is hard. A new hire needs six systems touched in the right order before their laptop even boots. An alert fires at 2am and pages four people because nobody trimmed the routing rule since the last reorg. A departing contractor's access sits open for a week because offboarding lives in someone's head, not a system. None of this needs deep expertise. All of it needs to happen exactly the same way, every time, including the week you're out.
- Step 1
A new-hire checklist, from memory
Identity, groups, ticketing seat, and hardware request — six systems, one person remembering the order.
- Step 2
An alert that pages four people
A routing rule nobody's trimmed since the last reorg wakes the whole rota for one incident.
- Step 3
Access that outlives the contractor
Offboarding lives in someone's head — so it slips the week that person is out.
WEXTL isn't trying to replace the sysadmin — it handles the repetitive provisioning and routing work so IT spends its attention on the systems that actually need a human decision.
Example: automate joiner, mover, and leaver access
A concrete run, start to finish — the kind of provisioning workflow IT clones from the template library and adjusts to match the role-to-access map that already exists somewhere in a spreadsheet.
Trigger: an HR status change lands — a start date confirmed, a role change, or a termination date set — or the same workflow runs from a filled-in intake form when there's no HR system feed yet.
WEXTL checks: the role-to-bundle mapping (which groups, licenses, and tools that title gets), whether the person is a contractor with a fixed access window, whether the request touches an elevated or admin group, and what's already provisioned if this is a change rather than a new start.
Human judgment
Elevated access, a role with no mapped bundle, and any mismatch between the HR signal and what's already provisioned all route to a person instead of getting a guess. The workflow proposes the bundle; a human clears anything outside it.
1. HR signal received, bundle matched
A start date, role change, or termination date lands, and role/department map to a saved bundle of groups, licenses, and tools.
2. Check for elevated access
Admin, finance-system, or production-environment groups get flagged separately from the standard bundle.
3. Provision identity and open the hardware ticket
Creates or updates the Microsoft Entra ID account, assigns the mapped groups, and opens the Invgate hardware ticket.
4. Hold elevated grants for approval
Admin-level or production-access groups wait for a manager or security sign-off before they're applied.
5. Notify the people who need to know
Manager and helpdesk get a Slack or Teams confirmation, not a status meeting.
6. Reverse on the leaver date, log every step
Every mapped system revokes the day access should end, with each grant, ticket, and revoke recorded for the audit trail.
Example: automate alert routing and escalation
The same logic applied to incidents: collapse the noise, page the rota that actually owns the service, and escalate on a timer instead of hoping someone notices.
Trigger: a monitoring alert arrives — a Cloudflare health check failing, or any monitoring tool posting through a webhook or the HTTP step.
WEXTL checks: whether this is a duplicate of an alert already open for the same service, the service-to-rota mapping, severity against the paging rules for that rota, and whether the primary on-call has acknowledged within the window.
Human judgment
Whether the alert is actually an incident, and what fixes it, stays a person's call. The workflow's job stops at getting the right page to the right person before the fifteen-minute window closes.
- Step 1
Automate the standard bundle
Groups, licenses, and tickets that follow a known role assemble without you.
- Step 2
Elevated access waits
Admin and production grants are a human approval step, not a default.
- Step 3
Irreversible infra changes wait too
A DNS cutover or firewall rule with real blast radius gets proposed, not applied, until someone signs off.
What IT should not automate blindly
Admin and production-level access, an alert with ambiguous severity, and any change to a system with no rollback are exactly where automation should stop and hand back to a person — not because the tooling can't attempt them, but because a wrong automated grant or a wrong automated revoke costs more than doing it slowly.
Where a human stays on
Anything granting admin or production access, any DNS or firewall change with real blast radius, any offboarding for a role with a legal hold on their data. The workflow drafts, flags, and proposes for these — it does not decide.
Who IT workflow automation is for
Not every IT role needs this on day one. It's built for the parts of the job that repeat across a lot of accounts, a lot of alerts, or a lot of disconnected systems.
Sysadmins running provisioning solo
— The same role-to-bundle logic runs per hire, not reconstructed from memory each time.On-call engineers tired of alert storms
— Duplicate collapsing and rota mapping cut the noise before it reaches a person.Identity and access admins doing JML by hand
— Joiner, mover, and leaver events drive the same workflow in both directions.IT leads who owe an auditor evidence
— Per-step logs answer who-had-access-when without reconstructing it from five consoles.Whoever inherited the internal glue scripts
— A canvas the next person can actually read, instead of a repo only one person understands.Helpdesk leads drowning in the same five tickets
— Routine requests get triaged and answered before they hit a queue.
Connect the systems IT already runs on
IT doesn't get to pick a clean stack. The identity provider, the ticketing system, and the infra platform are whatever's already in place — automation has to meet them there.
These are the integrations most IT workflows actually use. An HTTP step reaches anything else with an API.
- Microsoft Entra IDCreate, update, and deprovision user and group access for the identity side of provisioning.
- LansweeperAsset inventory, software detail, and vulnerability data for what's actually running.
- CloudflareDNS, firewall rules, health checks, and tunnels for the infrastructure side of alerts.
- GitHubRepo and issue events feed workflows that touch developer tooling.
