Orchestration Template

An orchestration template is a reusable sequence of actions that the product carries out as a single unit. You build a template by connecting blocks, each of which performs one action, and the template runs those blocks along the connections you draw between them. Blocks cover Active Directory (AD), Exchange, Microsoft 365, and Google Workspace actions, along with custom scripts, webhooks, notifications, and database operations, so one template can complete work that spans the directory and the applications around it. Build a template once to define a multi-step process such as user onboarding or offboarding, then reuse it instead of assembling the same sequence each time it is needed.

How orchestration templates work

When you apply an orchestration template, it acts on the objects supplied to it, and each block reports success or failure on completion. Each outcome can lead to a different next action, so the template continues along the matching route instead of stopping, and a block's output is passed forward as a macro to the blocks that accept macro input. Execution follows the connections, including loops. A block that repeats more than 15 times in a single run stops and reports an infinite loop error.

Prerequisites

  • Configure the Microsoft 365 or Google Workspace tenant in ADManager Plus before you use any cloud action block.
  • Configure the webhook template, notification template, custom script, or database connection you need, so that is available for selection in the corresponding block.

Note: Cloud actions apply only to Microsoft 365 and Google Workspace users who are synchronized through directory sync.

Steps to create a new orchestration template

  1. Navigate to Automation > Configuration > Orchestration Template.
  2. Click the + Create New Template button.
  3. Enter a suitable Template Name and Description for the template.
  4. To create your own custom Orchestration Template, drag and drop the required orchestration blocks. While creating the template:
    • All blocks must be connected to the start block, either directly or indirectly through other blocks.
    • Each block can have multiple input connections, and flow arrows can be adjusted as needed to align with your logic. Appropriate action items can also be defined for both success and failure scenarios.
  5. Click Save once the template has been created. If you wish to undo all the changes made to the template, click Clear to start over.

Orchestration blocks

Category Block Description
Logic Decision Based on Previous Block Result Triggers the next action based on the result of the previous block and the conditions set.
Decision Based on Criteria An Orchestration Template is triggered for an AD object, and a decision is made based on the properties of the AD object.
Time Delay Add a time delay in seconds, minutes, hours, or days between two consecutive actions.
Custom Actions Custom Script Add custom scripts to the workflow.
Webhook Add webhook templates to the workflow.
Notification Add notification templates to the workflow.
Database Operations Perform database actions such as insert, update, or query directly within your workflow.
Custom Actions Custom Script Add your custom scripts to the orchestration.
Webhook Add webhook templates to the workflow.
Notification Add notification templates to the workflow.
Database Operations Perform database actions such as insert, update, or query directly within your workflow.
Workflow Approval Add a workflow approval process to the orchestration.
AD Actions Sync User to Other Domain Synchronize user objects from AD as well as non-AD objects (such as users from integrated applications) from one domain to another.

Users can be created, modified, and deleted on the target domain using this template. Custom synchronization of user attributes is also supported in this block.

Delete/Move Profile Delete or move profiles to a different location.
Delete Object Delete an AD object.
Delete TS Profiles Delete Terminal Services (TS) profiles from AD.
Disable User Disable a user account.
Modify User Modify user objects using inputs from CSV files, user management templates, or custom inputs such as macros from a previous block.

Note: When modifying users using CSV files, the list of attributes selected in the Select Attributes field will be used to match the data of the CSV file and the user on whom the orchestration was triggered. The matched row data will be used to update this user.

Move/Delete Home folders Delete or move home folders to a different location.
Move/Delete TS Home folders Delete or move TS home folders to a different location.
Move Object Move objects to a specified container.
Override 'Protect object from accidental deletion' Enable or disable the option to protect an object, such as a user account or group, from accidental deletion.
Remove Direct Reports Remove all the direct reports of the user.
Remove Object From All Groups Remove a user account from all groups.
Reset Password Reset a user account's password.
Exchange Actions Delete/Disable Mailbox Delete or disable the mailbox of a user account.
Export User Mailbox Export a user mailbox.
Set Mailbox Rights Set mailbox rights.
Hide From Exchange Address Lists Hide a user account from the Exchange address lists.
Remove EUM Address Remove the EUM address associated with a user account.
Enable Mail Forwarding Enable mail forwarding for a user account.
Enable Archive Mailbox Enable archive mailbox for a user account to preserve emails.
Enable Remote Mailbox Enable remote mailbox for a user account to allow mailbox access through a remote mail server.
Cloud Actions

Note Cloud Actions will be performed only on users synced via DirSync.

Block Microsoft 365 Users Block a Microsoft 365 user account.
Convert Microsoft 365 Mailbox To Shared Mailbox Convert a Microsoft 365 mailbox to a shared mailbox.
Delete Google Workspace User Account Delete the associated Google Workspace accounts.
Enable Google Workspace User Account Enable the associated Google Workspace accounts.
Add Google Workspace Roles Assign and manage Google Workspace roles for associated accounts.
Remove Google Workspace Roles Revoke and manage Google Workspace roles for associated accounts.
Add Google Workspace Groups Add the associated Google Workspace groups.
Remove Google Workspace Groups Remove the associated Google Workspace groups.
Delete Microsoft 365 Account Delete the associated Microsoft 365 accounts.
Disable (Suspend) Google Workspace User Account Disable or suspend a Google Workspace account.
Enable/Disable Litigation Hold Enable or disable a litigation hold on a mailbox.
Hide/Unhide From Exchange Address List in Microsoft 365 Hide or unhide a user account from the Exchange address lists.
Remove User From All Microsoft 365 Groups Remove a user from all Microsoft 365 groups.
Remove User From All MS Teams Remove a user from all Microsoft teams.
Reset Password in Google Apps Reset a user account's password in Google Workspace.
Reset Password in Microsoft 365 Reset a user account's password in Microsoft 365.
Revoke Microsoft 365 User License Revoke a user's Microsoft 365 license.
Remove All Microsoft 365 Inbox Rules Remove the inbox rules of Microsoft 365 user accounts.
Mailbox Auto Reply Send automatic replies to Microsoft 365 user accounts.
Add Google Workspace License Add the associated Google Workspace licenses.
Remove Google Workspace License Remove the associated Google Workspace licenses.
Other Actions Invalidate Authtoken Invalidate the authentication tokens of a technician or technicians in a group.
Delete/Disable Skype (Lync) User Delete or disable a user's Skype account.
Remove All NTFS Permissions Remove all NTFS permissions assigned to a user across a file server.

Note The Remove All NTFS Permissions action checks for and removes all the permissions on the server for the specified objects. This may cause the process to take longer than expected. You can check its status under Management > More > More Management Actions > Delayed Management Tasks.

Remove All ACE Permissions Remove all ACE permissions assigned to a user.
Note Outputs from previous blocks can be passed as inputs to subsequent blocks. These outputs will be available as macros only in the following blocks:
  • Decision Based on Previous Block Result
  • Decision Based on Criteria
  • Custom Script
  • Webhook
  • Notification
  • Database Operations
  • Workflow Approval
  • Modify User
  • Reset Password

Note: Outputs from previous blocks can be passed as inputs to subsequent blocks. These outputs will be available as macros only in the following blocks:

  • Decision Based on Previous Block Result
  • Decision Based on Criteria
  • Custom Script
  • Webhook
  • Notification
  • Database Operations
  • Modify User
  • Reset Password