AvePoint Docs
Graph API
My support tickets
Graph API
My support tickets
English

    Home > Workflows > Supported Workflow Triggers, Conditions, and Actions

    Export to PDF

    Supported Workflow Triggers, Conditions, and Actions

    The supported conditions for each trigger are listed in the following table.

    TriggerConditionDescription
    User is created / User is disabledDepartmentThe workflow will be triggered when the department of the target user falls into the configured scope.
    User is created / User is disabledJob titleThe workflow will be triggered when the job title of the target user falls into the configured scope.
    User is created / User is disabledPassword ageThe workflow will be triggered when the password age of the target user falls into the configured scope.
    User is created / User is disabledPassword never expiresThe workflow will be triggered when the password setting of the target user is to expire or never expire.
    User is created / User is disabledCountryThe workflow will be triggered when the country of the target user falls into the configured scope.
    User is created / User is disabledManagerThe workflow will be triggered when the manager of the target user falls into the configured scope.
    User is created / User is disabledWithin security groupThe workflow will be triggered when the target user is or is not in the configured security group.
    User is created / User is disabledWith Microsoft 365 GroupThe workflow will be triggered when the target user is or is not in the configured Microsoft 365 Group.
    User is created / User is disabledWithin distribution groupThe workflow will be triggered when the target user is or is not in the configured distribution group.
    User is created / User is disabledWithin mail-enabled security groupThe workflow will be triggered when the target user is or is not in the configured mail-enabled security group.
    User is created / User is disabledStatusThe workflow will be triggered when the status of the target user falls into the configured scope.
    User is created / User is disabledCreated byThe workflow will be triggered when the user template from which the target user is created falls into the configured scope.
    User is created / User is disabledTypeThe workflow will be triggered when the user type of the target user falls into the configured scope.
    User security is scannedConditional access policy disabledThe workflow will be triggered when conditional access policies are disabled for the target user.
    User security is scannedDevice out of complianceThe workflow will be triggered when the target user’s device is not in compliance.
    User security is scannedEmail not forwarded to domainThe workflow will be triggered when the target user’s emails are not forwarded to the configured domains.
    User security is scannedGuest user out of trusted domainThe workflow will be triggered when the target user is a guest user out of the configured trusted domains.
    User security is scannedGuest user with admin privilegeThe workflow will be triggered when the target user is a guest user with admin privilege.
    User security is scannedSign-ins from multiple IP addressesThe workflow will be triggered when the number of the target user’s sign-in IP addresses in one week is greater than the configured value.
    User security is scannedFailed sign-ins in last 7 daysThe workflow will be triggered when the number of the target user’s failed sign-in in last 7 days is greater than the configured value.
    User security is scannedSign-in out of IP address rangeThe workflow will be triggered when the target user’s sign-in IP addresses is out of the configured range.
    User security is scannedUser statusThe workflow will be triggered when the target user has not enabled MFA.
    User security is scannedAccess from untrusted devicesThe workflow will be triggered when the target user accesses from untrusted devices.
    User security is scannedFile deletion activities in a dayThe workflow will be triggered when the number of the target user’s file deletion activities in a day is greater than the configured value.
    User security is scannedFile modification activities in a dayThe workflow will be triggered when the number of the target user’s file modification activities in a day is greater than the configured value.
    User security is scannedSign-in from regionsThe workflow will be triggered when the target user’s sign-in country or region falls into the configured scope.
    User security is scannedSensitive information accessThe workflow will be triggered when the target user accesses sensitive information.
    Risk is detectedSensitive information access without MFA enabledThe workflow will be triggered when the target user accesses sensitive information without MFA enabled.
    Risk is detectedFailed sign-ins in last 7 daysThe workflow will be triggered when the number of the target user’s failed sign-in in last 7 days is greater than the configured value.
    Risk is detectedSign-in out of IP address rangeThe workflow will be triggered when the target user’s sign-in IP addresses is out of the configured range.
    Risk is detectedSign-in from regionsThe workflow will be triggered when the target user’s sign-in country or region falls into the configured scope.
    Risk is detectedSensitive information access from unmanaged deviceThe workflow will be triggered when the target user accesses sensitive information from an unmanaged device.
    Risk is detectedSensitive information access from non-compliant deviceThe workflow will be triggered when the target user accesses sensitive information from a non-compliant device.
    Risk is detectedSensitive information access without conditional access policy enabledThe workflow will be triggered when the target user accesses sensitive information without conditional access policy enabled.
    Risk is detectedSensitive information access from invalid IP addressesThe workflow will be triggered when the IP address that the target user accesses the sensitive information is out of the configured range.
    Risk is detectedSensitive information access from regionsThe workflow will be triggered when the country or region where the target user accesses the sensitive information falls into the configured scope.
    Risk is detectedFile deletion activities in a dayThe workflow will be triggered when the number of the target user’s file deletion activities in a day is greater than the configured value.
    Risk is detectedFile modification activities in a dayThe workflow will be triggered when the number of the target user’s file modification activities in a day is greater than the configured value.
    User license status is scannedAssigned licensesThe workflow will be triggered when the licenses of the target user fall into the configured scope.
    User license status is scannedUser inactive for x daysThe workflow will be triggered when the target user has been inactive for a duration exceeding the configured number of days.
    User license assignment is scannedUser labelThe workflow will be triggered when the target user’s license assignment label falls into the configured scope.
    Deviation is detectedDetected deviations have not been processedThe workflow will be triggered when the tenant’s detected deviations have not been processed for the configured number of days.

    The supported actions for each trigger are listed in the following table.

    TriggerAction CategoryActionAction
    User is createdLicenseAssign licenseAssign license
    User is createdUser basicAdd to departmentAdd to department
    User is createdUser basicEnforce start date and end dateEnforce start date and end date
    User is createdUser basicSet managerSet manager
    User is createdGroupAdd to distribution groupAdd to distribution group
    User is createdGroupAdd to mail-enabled security groupAdd to mail-enabled security group
    User is createdGroupAdd to Microsoft 365 GroupAdd to Microsoft 365 Group
    User is createdGroupAdd to security groupAdd to security group
    User is createdNotificationSend notification emailSend notification email
    User is disabledUser actionDisable userRemove user from groups
    User is disabledUser actionDisable userRemove licenses from user
    User is disabledUser actionDelete userDelete user
    User is disabledUser actionRevoke cloud sessionsRevoke cloud sessions
    User is disabledNotificationSend notification emailSend notification email
    User security is scannedRiskAdd to dashboardAdd to dashboard
    User security is scannedRiskDisable userDisable user
    Risk is detectedRiskMark as riskyMark as risky
    User license status is scannedLicenseMark user license statusMark user license status
    User license assignment is scanned (User license auto downgrade)LicenseDowngrade licenseDowngrade license
    User license assignment is scanned (User license auto unassignment)LicenseUnassign licenseUnassign license
    Deviation is detectedNotificationSend notification emailSend notification email