Provisioning in one run
New-hire accounts exist before their first coffee; departures are revoked everywhere the same day.
FOR IT TEAMS
Automation that replaces your pile of scripts
Provision accounts, route alerts, and connect internal tools on a visual canvas instead of a cron job someone wrote in 2019. Every run in WEXTL keeps a step-by-step log, so you always know what ran and why.
Deploys this workflow into your workspace — you'll connect your own accounts.
Workflow that loops through account systems and provisions each one for a new hire
- GDPR
- Data Encryption
- 2FA
- Local Data Region
* Illustrative example, not measured customer data.
IT automation, at a glance
Alerts that find the right person
Route by service, severity, and schedule so the page reaches the one person who can fix it.
Glue without scripts
Connect internal tools on a canvas the whole team can read, instead of another repo of cron jobs.
An audit trail by default
Every run records what executed, with what input, and what came back — per step.
What IT teams run on WEXTL
Common patterns, built from real workflows. Start from a template or a blank canvas.
Accounts ready before day one
A signed offer kicks off one workflow that creates accounts, assigns groups, and requests hardware — in order, with a log.
- Trigger — an HR status change lands (a start date confirmed, a role change, or a termination date set), or the same workflow runs from a filled-in intake form when there's no HR feed yet.
- Information collected — the person's role, department, manager, start or end date, and whether they're a contractor with a fixed access window.
- Connected applications — Microsoft Entra ID for identity and group membership, Invgate for the hardware-request ticket and internal notes, Slack or Microsoft Teams for the confirmation.
- Decision logic — role and department map to a saved bundle of groups and licenses; elevated groups (admin, production) are flagged separately from the standard bundle; a mismatch between the HR signal and what's already provisioned pauses the run.
- AI step — drafts the onboarding confirmation and, on the leaver side, a note listing anything that needs manual follow-up because it has no API.
- Human approval — elevated or admin-level grants wait for a manager or security sign-off before they're applied; standard bundles do not.
- Actions — creates or updates the Entra ID account and groups, opens the Invgate hardware ticket, and posts the confirmation to Slack or Teams.
- Exception handling — a role with no mapped bundle, or a start-date mismatch, is held and flagged instead of provisioned with default access.
Workflow that loops through account systems and provisions each one for a new hire
What IT actually spends a day fighting
None of it is hard. A new hire needs six systems touched in the right order before their laptop even boots. An alert fires at 2am and pages four people because nobody trimmed the routing rule since the last reorg. A departing contractor's access sits open for a week because offboarding lives in someone's head, not a system. None of this needs deep expertise. All of it needs to happen exactly the same way, every time, including the week you're out.
- Step 1
A new-hire checklist, from memory
Identity, groups, ticketing seat, and hardware request — six systems, one person remembering the order.
- Step 2
An alert that pages four people
A routing rule nobody's trimmed since the last reorg wakes the whole rota for one incident.
- Step 3
Access that outlives the contractor
Offboarding lives in someone's head — so it slips the week that person is out.
WEXTL isn't trying to replace the sysadmin — it handles the repetitive provisioning and routing work so IT spends its attention on the systems that actually need a human decision.
Example: automate joiner, mover, and leaver access
A concrete run, start to finish — the kind of provisioning workflow IT clones from the template library and adjusts to match the role-to-access map that already exists somewhere in a spreadsheet.
Trigger: an HR status change lands — a start date confirmed, a role change, or a termination date set — or the same workflow runs from a filled-in intake form when there's no HR system feed yet.
WEXTL checks: the role-to-bundle mapping (which groups, licenses, and tools that title gets), whether the person is a contractor with a fixed access window, whether the request touches an elevated or admin group, and what's already provisioned if this is a change rather than a new start.
Human judgment
Elevated access, a role with no mapped bundle, and any mismatch between the HR signal and what's already provisioned all route to a person instead of getting a guess. The workflow proposes the bundle; a human clears anything outside it.
1. HR signal received, bundle matched
A start date, role change, or termination date lands, and role/department map to a saved bundle of groups, licenses, and tools.
2. Check for elevated access
Admin, finance-system, or production-environment groups get flagged separately from the standard bundle.
3. Provision identity and open the hardware ticket
Creates or updates the Microsoft Entra ID account, assigns the mapped groups, and opens the Invgate hardware ticket.
4. Hold elevated grants for approval
Admin-level or production-access groups wait for a manager or security sign-off before they're applied.
5. Notify the people who need to know
Manager and helpdesk get a Slack or Teams confirmation, not a status meeting.
6. Reverse on the leaver date, log every step
Every mapped system revokes the day access should end, with each grant, ticket, and revoke recorded for the audit trail.
Example: automate alert routing and escalation
The same logic applied to incidents: collapse the noise, page the rota that actually owns the service, and escalate on a timer instead of hoping someone notices.
Trigger: a monitoring alert arrives — a Cloudflare health check failing, or any monitoring tool posting through a webhook or the HTTP step.
WEXTL checks: whether this is a duplicate of an alert already open for the same service, the service-to-rota mapping, severity against the paging rules for that rota, and whether the primary on-call has acknowledged within the window.
Human judgment
Whether the alert is actually an incident, and what fixes it, stays a person's call. The workflow's job stops at getting the right page to the right person before the fifteen-minute window closes.
Step 1
1. Alert arrives
A monitoring webhook or health-check failure starts the run.
Step 2
2. Collapse duplicates, match the rota
Repeat alerts for the same service fold into the one already open; service-to-team mapping decides who owns it.
Step 3
3. Check severity rules
Low severity routes to a digest; paging severity moves to the next step.
Step 4
4. Draft the summary
AI turns the raw alert payload into a one-line summary instead of a JSON dump.
Step 5
5. Page the rota, escalate on a timer
Sent to Slack or Teams first, Twilio SMS as fallback; no acknowledgment after fifteen quiet minutes pages the secondary on-call.
Step 6
6. Log the incident
Opens or updates the Invgate ticket so the timeline exists without anyone typing it up after.
- Step 1
Automate the standard bundle
Groups, licenses, and tickets that follow a known role assemble without you.
- Step 2
Elevated access waits
Admin and production grants are a human approval step, not a default.
- Step 3
Irreversible infra changes wait too
A DNS cutover or firewall rule with real blast radius gets proposed, not applied, until someone signs off.
What IT should not automate blindly
Admin and production-level access, an alert with ambiguous severity, and any change to a system with no rollback are exactly where automation should stop and hand back to a person — not because the tooling can't attempt them, but because a wrong automated grant or a wrong automated revoke costs more than doing it slowly.
Where a human stays on
Anything granting admin or production access, any DNS or firewall change with real blast radius, any offboarding for a role with a legal hold on their data. The workflow drafts, flags, and proposes for these — it does not decide.
Who IT workflow automation is for
Not every IT role needs this on day one. It's built for the parts of the job that repeat across a lot of accounts, a lot of alerts, or a lot of disconnected systems.
Sysadmins running provisioning solo
— The same role-to-bundle logic runs per hire, not reconstructed from memory each time.On-call engineers tired of alert storms
— Duplicate collapsing and rota mapping cut the noise before it reaches a person.Identity and access admins doing JML by hand
— Joiner, mover, and leaver events drive the same workflow in both directions.IT leads who owe an auditor evidence
— Per-step logs answer who-had-access-when without reconstructing it from five consoles.Whoever inherited the internal glue scripts
— A canvas the next person can actually read, instead of a repo only one person understands.Helpdesk leads drowning in the same five tickets
— Routine requests get triaged and answered before they hit a queue.
Connect the systems IT already runs on
IT doesn't get to pick a clean stack. The identity provider, the ticketing system, and the infra platform are whatever's already in place — automation has to meet them there.
These are the integrations most IT workflows actually use. An HTTP step reaches anything else with an API.
Developer Tools
- Microsoft Entra IDCreate, update, and deprovision user and group access for the identity side of provisioning.
- LansweeperAsset inventory, software detail, and vulnerability data for what's actually running.
- CloudflareDNS, firewall rules, health checks, and tunnels for the infrastructure side of alerts.
- GitHubRepo and issue events feed workflows that touch developer tooling.
Communication
Project Management
See the full catalog — every app we support, plus an HTTP step for anything else.Explore all WEXTL integrations
95+ apps for IT
Integrate IT workflows with the tools your team already uses.
Supported integrations
Account provisioning, by hand vs. with WEXTL
| Task | By hand | With WEXTL |
|---|---|---|
New-hire setup | Five tickets and two days of waiting | One workflow, runs when the offer is signed |
Offboarding | A checklist in someone’s head | Every system revoked on the end date |
Alert routing | Everything pages everyone | Filtered, grouped, sent to the right on-call |
Connecting internal tools | A cron job only its author understands | A canvas the whole team can read |
Per-step run logs | Scattered across scripts and inboxes | Supported |
When something breaks | Silent until a user complains | The failing step is flagged, with its input |
Frequently asked questions
A role-to-bundle mapping table drives it — department and title map to a saved set of Microsoft Entra ID groups and licenses, so the workflow proposes the same bundle every time instead of a fresh judgment call per hire.
Yes — the leaver event drives the same bundle in reverse, scheduled for the exact date on file, so access doesn't linger past a last day or get pulled early on a role change.
Duplicate alerts for the same service inside a set time window collapse into the incident already open, so one flapping check pages once, not once per flap.
It doesn't vanish — it pages a fallback channel instead of a specific rota, so an unmapped alert still reaches a person.
Yes — that's the internal-glue pattern: watch one system, map the fields, create or update the matching record in the other, and log every sync so drift is visible.
The audit-trail digest filters run history down to access changes and approvals and delivers it on a schedule, so the evidence exists before the auditor asks instead of being reconstructed from five consoles.
An HTTP step reaches its API directly, with the same field-mapping, branching, and per-step logging as a native app.
Yes — elevated and production-level groups are flagged separately from the standard bundle and wait for a sign-off before they're applied; the standard bundle does not need one.
Start automating with IT or browse more workflows
Start automatingDrop this workflow into your WEXTL workspace and connect your own accounts.
Browse solutions & templatesExplore team solutions and ready-made workflow templates.