IT OPS
Offboarded-User Orphan Seat Sweep
When an HR offboarding event fires, it sweeps every SaaS app for seats still assigned to the departed user, cross-checks SSO to confirm no recent activity.
How it runs
The automated pipeline, trigger to output.
- TriggerHRIS offboarding webhook firesHTTP webhook
- ActionFind all seats for departed user in PostgresPostgres
- LogicConfirm no post-departure SSO activity, total cost
- ActionCreate reclaim task per orphan seat in Mondaymonday.com
- OutputPost consolidated orphan-seat alert to SlackSlack
What it does
This workflow catches the seats that survive employee departures. On an offboarding event, it searches all tracked SaaS apps for any seat still tied to the leaving user, confirms against SSO last-login that the account is genuinely dormant, and tallies the orphaned licenses and their cost. It then opens reclaim tasks and alerts IT so nothing keeps billing after someone leaves.
When to use it
Use this as the safety net on your offboarding process. Even with deprovisioning automation, niche or shadow-IT tools slip through — this sweep finds the leftover paid seats that quietly accrue cost for months.
How it works
- 1An offboarding webhook from your HRIS triggers the run with the departed user's identity.
- 2The workflow queries Postgres for every seat assignment matching that user across all apps.
- 3A logic step confirms each seat shows no SSO activity post-departure and computes total orphaned spend.
- 4If orphans exist, it creates a reclaim item per seat on the Monday.com board.
- 5It posts a consolidated Slack alert summarizing orphaned seats, cost, and links to the tasks.
Set it up
What you configure once, before turning it on.
- 1Connect HTTP webhookTrigger any URL on agent actions.
- 2Connect PostgresAny Postgres URL — query, write, migrate.
- 3Connect monday.comVisual work management for teams.
- 4Connect SlackChannels, DMs, threads, mentions.
- 5Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 6Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 7Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More IT Ops workflows
Recurring Sensor Fault Root-Cause Investigator
On a schedule, an agent reviews recent Monday work orders and BigQuery telemetry to identify equipment with repeating faults, drafts a root-cause hypothesis with a recommended fix.
Daily Building Anomaly Digest to MS Teams
Each morning queries BigQuery for the prior day's flagged sensor anomalies, summarizes them by site and system into a ranked briefing.
Agentic Inactive-Seat Reclamation Review
An agent investigates each idle SaaS seat by correlating SSO login gaps with HR status and ticket history, classifies it as reclaim, hold, or escalate, and drafts a reasoned…
Reconcile SSO logins against expense spend to find unmanaged tools
Joins SSO usage data with expense/payment records in Snowflake to surface tools that are being used but not paid for, or paid for but never logged.
Approved-Seat Deprovision Execution
Fires when an IT approver confirms a seat for removal, then executes deprovisioning via the IdP API and logs the action to an audit table and a Linear cleanup ticket.
HVAC Anomaly Detection to Severity-Routed Work Orders
Ingests building HVAC telemetry via webhook, flags out-of-band temperature, pressure, or runtime readings.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.