Workflow Actions

This page lists every step you can add to a workflow, what it does and the options it has. Steps act on the person the workflow runs for: the new employee, the person being changed, or the person leaving.

Field names below are the labels the editor shows. Required fields are marked with a red asterisk in the editor. The rest are under Show advanced options on the step.

Overview

Step	Group in the picker	What it does	Runs once	Active Directory only
Create User	User Management	Creates the account	Yes	Yes
Update User Profile	User Management	Writes the changes from an Edit Employee request		Yes
Enable User Account	User Management	Turns sign-in on	Yes	Yes
Disable User Account	Security	Blocks sign-in	Yes	Yes
Delete User	User Management	Deletes the account	Yes	Yes
Reset Password	Security	Sets a new random password	Yes	Yes
Revoke All User Sessions	Security	Signs the user out everywhere	Yes
Add to Group/s	Groups	Adds the user to groups		Yes
Remove from Group/s	Groups	Removes the user from groups		Yes
Remove from All Groups	Groups	Removes every removable membership		Yes
Apply Role Template	Other	Adds the groups in a role template		Yes
Remove Role Template	Other	Removes the groups in a role template		Yes
Send Email	Email	Sends an email template
Set Auto-Reply	Mailbox	Turns on automatic replies
Set Email Forwarding	Mailbox	Forwards incoming mail
Set Mailbox Delegation	Mailbox	Gives others access to the mailbox
Remove Mailbox Delegation	Mailbox	Takes that access away again
Convert to Shared Mailbox	Mailbox	Turns the mailbox into a shared mailbox	Yes
Set Calendar Permissions	Mailbox	Shares the calendar
Grant OneDrive Access	Storage	Shares the user's OneDrive

Runs once means only the highest-priority workflow's copy of the step runs when several workflows match. See When several workflows match.

Active Directory only shows which steps companies with Active Directory as their only directory can use. Hybrid and Entra ID companies can use all of them. See Active Directory and Hybrid.

Mailbox and calendar steps run through Exchange Online and need the Exchange certificate set up. Where a step takes email addresses, you can use internal or external addresses unless the step says otherwise.

Accounts

Create User

Creates the account from the details in the New Employee request. Use it in New Employee workflows. Without it, no account is created.

What Adcyma does:

Builds the username and display name from the name formats in Preferences, and picks a different username if the first one is taken.
Sets a random passphrase that the user must change at first sign-in. You can send it with the {{ password }} variable, see Email Templates.
Copies job title, department, office, company, address, country, preferred language, employee type and phone numbers from the request. The country also becomes the usage location, which Microsoft needs before it assigns licences.
Sets the manager, adds the user to the Adcyma managed group, and uploads the profile photo if the form had one.
Sets Employee Hire Date to the day the account is created.

Advanced options:

Option	What it does
Account Enabled	Use trigger default keeps what the form sent. Enabled or Disabled overrides it. Only pick Disabled if a later Enable User Account step turns the account on.
Domain	The domain in the username. Leave it on Use primary domain to use your primary domain.
Email Domain	Gives the user a primary email address on another domain than the username. Leave it on Use UPN domain to keep them the same.
Aliases	Extra domains. The user also gets mailNickname@domain as an email alias for each one.
Create user in	Hybrid companies only. Company default, Active Directory or Entra ID.

Steps that run right after Create User wait a few seconds for Microsoft to finish creating the account, and retry if it takes longer.

Update User Profile

Writes the changes from an Employee Change request to Entra ID or Active Directory: job title, department, office, company, address, phone numbers, manager and so on. Fields that weren't sent are left as they are. There are no options.

An Edit Employee request only changes the directory if a matching workflow has this step.

Enable User Account

Turns sign-in on for the account when the step runs. Use the step's timing to decide when, for example on the start date when Create User ran a week earlier with Account Enabled set to Disabled.

Disable User Account

Blocks sign-in for the account. The account, its groups and its mailbox stay as they are.

Delete User

Deletes the account. In Entra ID, Microsoft keeps deleted users under Deleted users for 30 days, so you can still restore it in that window. Adcyma also takes the user out of its managed users.

Use a delay, for example 30 days after the leaving date, so mail and files can be handed over first.

Reset Password

Sets a new random password and requires the user to change it at the next sign-in. Adcyma doesn't send or show the new password anywhere. Use it to lock someone out, together with Revoke All User Sessions.

Revoke All User Sessions

Signs the user out of every device and app by revoking their refresh tokens in Entra ID. Apps that already hold an access token can keep working until it expires, usually within an hour. Pair it with Disable User Account so they can't sign in again.

Groups

Add to Group/s

Adds the user to the groups in Group Ids. Search by name, or paste a group's object ID and click Add Object ID.

If some groups go through and others fail, the step fails and lists which groups were added and which weren't. A retry skips the groups that already worked.
On hybrid companies, Entra groups are changed through Microsoft Graph and Active Directory groups through the agent, in the same step.
Distribution lists and mail-enabled security groups are owned by Exchange, and Microsoft doesn't let Adcyma add members to them this way. For those, use a Dynamic Group that targets the distribution list.

Remove from Group/s

Removes the user from the groups in Group Ids. A user who already isn't a member counts as done, so the step doesn't fail on that. The same distribution list limit applies. Remove from All Groups handles those.

Remove from All Groups

Removes the user from every group they can safely be removed from. Use it for leavers, or for movers before you apply their new role. Place it before any steps that add groups, with the arrows if they share a timing.

It never removes the user from:

Groups on the Protected Groups list in Preferences, and the Adcyma managed group, which is always protected
Entra dynamic groups, whose membership Entra manages with its own rule
On hybrid companies, Active Directory groups that are the target of an active Adcyma dynamic group, or that sit outside the agent's scope

Mail-enabled security groups and distribution lists are removed through Exchange Online. Without the Exchange connection, the step removes everything else and then fails, telling you which groups are left.

Users removed from a group that an Adcyma Dynamic Group manages are added back on the next sync if they still match its rules.

Apply Role Template

Adds the user to every group in the Role Template picked in Template Id. On hybrid companies, Active Directory groups in the template go through the agent.

Remove Role Template

Removes the user from every group in the role template picked in Template Id. It doesn't check whether another template or workflow also gave the user one of those groups.

Email

Send Email

Sends the email template picked in Email Template. Recipients, subject and body come from the template, with variables filled in for the person the workflow runs for.

The editor warns you when the picked template has no recipient in its To field or no subject, because the step will fail. If the To field only holds a variable that is empty for this person, for example {{ manager_email }} for someone without a manager, the step is marked Skipped instead of failed.

Mailbox

Set Auto-Reply

Turns on automatic replies for the user's mailbox.

Field	What it does
Message (required)	The reply. It goes to people inside the organization, and to people outside unless you write an external message.
People outside the organization	Reply to everyone outside the organization, Reply only to senders in the user's contacts, Don't reply outside the organization, or Keep the mailbox's current setting. New steps start on everyone.
External message	A separate reply for people outside. Leave it empty to send the message above. Hidden when you don't reply outside.
Start Time, End Time (advanced)	When both are set, the reply only runs in that window. Otherwise it starts when the step runs and stays on until someone turns it off.
Internal Message (advanced)	A separate reply for people inside the organization, instead of the message above.

All three message fields take the same variables as email templates, except {{ password }}. That way one offboarding workflow works for everyone:

Code

I no longer work at {{ company_name }}. Please contact {{ manager_name }} at {{ manager_email }}.

Use the Variable button next to a field to insert one. See Variables in automatic replies for how they are filled in.

Set Email Forwarding

Forwards the user's incoming email.

Field	What it does
Forward To Address (required)	Where to forward mail. Internal and external addresses both work.
Keep Copy (advanced)	Yes (the default) keeps a copy in the user's mailbox. No only forwards.
Forward All (advanced)	Has no effect. All incoming mail is forwarded either way.

Set Mailbox Delegation

Gives other people access to the user's mailbox.

Field	What it does
Delegate Users (required)	Email addresses, one per line.
Permission Level (required)	Read, Full Access (including Send As), Send As only or Send on Behalf.
Delegation Expiry Date (advanced)	When to take the access away. Adcyma schedules a Remove Mailbox Delegation for the same people and level on that date.

Full Access opens the mailbox for the delegate and adds it to their Outlook automatically, plus the right to send as the user. Send As and Send on Behalf only cover sending.

Read is not read access to mail

Read grants Exchange's ReadPermission right, which on its own doesn't let the delegate open the user's email. If someone has to read the mail, for example a manager taking over a leaver's inbox, use Full Access.

Remove Mailbox Delegation

Takes away access that Set Mailbox Delegation gave.

Field	What it does
Delegate Users (required)	Email addresses, one per line.
Permission Level (required)	Typed as text: `read`, `full`, `sendas` or `sendonbehalf`. Use the same level that was granted. Empty means `read`.

Convert to Shared Mailbox

Turns the user's mailbox into a shared mailbox. A shared mailbox needs no licence, so Adcyma then removes the user's licences that include Exchange Online. Licences without Exchange are left alone.

Field	What it does
Maintain Licenses (advanced)	Yes keeps the licences. Known issue: the field shows Yes before anything is saved, and the licences are removed unless a Yes is actually saved. To keep them, switch the field to No and back to Yes, then save.
Auto Map To Users (advanced)	Has no effect. Use Set Mailbox Delegation with Full Access to give people the mailbox.

Convert before you delete. Run Delete User later, with a delay, if you want to keep the shared mailbox around.

Set Calendar Permissions

Shares the user's calendar.

Field	What it does
Granted Users (required)	Email addresses, one per line.
Granted Groups (advanced)	A group's email address to share with.
Access Level (advanced)	Reader or Reviewer (can see details), Writer (can edit), Owner (full control). The default is Reader.

If someone already has a permission on the calendar, it is replaced with the new level.

Storage

Grant OneDrive Access

Shares the root of the user's OneDrive with other people, so files can be handed over before the account is deleted.

Field	What it does
Granted Users (required)	Email addresses, one per line. Each must sign in to open the files.
Permission Level (advanced)	Read, Write or Owner. The default is Read.
Expiry Date (advanced)	When the access ends. Microsoft enforces the date.
Notify Users (advanced)	Yes (the default) has Microsoft send each person an email with a link. No shares silently.

If some people can't be added, the step fails and names the addresses Microsoft refused.

Not Available as Workflow Steps

There is no step for assigning or removing individual licences. Use group-based licensing in Entra ID and assign the groups with Add to Group/s or a role template. Profile photos are set from the New Employee and Edit Employee forms, not from a workflow step.