38 runbooks for the L1 IT helpdesk

Access Role Change

Multi-system orchestrated role transitions for promotions, transfers, and contractor-to-FTE conversions. Five seed roles ship out of the box (support tiers, sales SDR/AE, engineering contractor/FTE/intern, HR generalist/manager); each transition produces a single approval card showing the full access diff and executes sequentially across Okta + Entra + Jira + M365 with per-step audit outcomes.

OktaEntra IDJira+1

Account Unlock

Automate Microsoft Entra ID and Okta account unlocks from Slack and Teams. Identity verification, approval-gated unlock, failed-login counter reset.

OktaEntra ID

Compromised Account Response

Contain a suspected account compromise in one approval: revoke every active session, invalidate the password, and force MFA re-enrollment, fully audited.

OktaEntra ID

Dormant Account Review

Find Okta accounts inactive beyond a configurable threshold and propose suspending them in one approval-gated review, fully audited.

Group Membership Management

Automate Microsoft Entra security group, M365 group, and distribution list membership changes from Slack and Teams. Name-resolved, approval-gated, idempotent.

Guest Account Cleanup

Remove a stale external guest account from Slack or Teams in one approval-gated pass. A safety gate refuses member accounts, and removal is restorable for 30 days.

MFA Re-enrollment

Automate Okta and Microsoft Entra ID MFA factor reset and re-enrollment from Slack and Teams, with approval-gated execution and audit-friendly logging.

OktaEntra ID

Password Reset

Automate password resets in Okta or Microsoft Entra ID directly from Slack and Microsoft Teams. Approval-required by default, with full audit trail.

Entra IDOkta

Service Account Credential Rotation

Find Entra ID app secrets nearing expiry and rotate them with approval: a fresh secret is added, expired credentials are cleaned up, and the new value is retrieved once from the dashboard, never posted to chat.

SSO App Assignment

Assign a SaaS application directly to a user in Okta from Slack or Teams, approval-gated, idempotent, and audited.

Temporary Privilege Elevation

Grant time-boxed elevated access to a privileged group with automatic removal at the end of the window, approval-gated and fully audited.

Provisioning

9 runbooks

Contractor Onboarding

Provision a time-boxed contractor account in Okta with scoped groups and an automatic end-date sign-in suspension, approval-gated and audited.

Device Enrollment Assignment

Approve a user into the Intune enrollment group from Slack or Teams so their devices can enroll into management, with current devices reported, audited.

Entra IDIntune

Distribution List Creation

Create a mail-enabled Microsoft 365 group and seed its members from Slack or Teams, approval-gated and fully audited.

M365Entra ID

Employee Offboarding

Automate end-to-end employee offboarding across Okta, Microsoft 365, Jira, and Intune. Suspend accounts, revoke OAuth tokens, transfer files, revoke licenses, archive mailbox.

OktaM365Jira+1

M365 License Assignment

Automate Microsoft 365 license assignment from Slack and Teams. Pool-availability check, approval-gated assignment, optional Intune or Jamf endpoint policy push.

IntuneJamf ProM365

New Hire Provisioning

Automate new-employee account creation across Okta, Microsoft 365, and Jira with single-approval workflow. License assignment, group membership, and welcome kit delivery.

M365OktaJira

Microsoft 365Microsoft Intune

Software Decommission

Reclaim a specific M365 license seat from a user with full audit trail — distinct from full offboarding. Snapshots the seat pool before/after, optionally surfaces the user's Intune-enrolled devices that have the matching app for follow-up cleanup visibility.

Unused License Reclamation

Find licensed Microsoft 365 accounts that are disabled or inactive beyond your threshold and reclaim the reviewed seats in one approval, fully audited.

ProvisioningTemplate

Shared Mailbox Provisioning

Create a Microsoft 365 shared mailbox and delegate full-access or send-as permissions to the right team, approval-gated and audited.

Network

5 runbooks

Network Live

DNS Record Change

Add or update a Cloudflare DNS record from chat behind an approval gate, with an explicit change summary and a drift gate that refuses stale plans.

Cloudflare

Network Live

VPN Access Grant

Automate VPN access provisioning via Intune and Microsoft Entra ID — approval-gated, with optional immediate device sync so the VPN profile pushes without waiting for the natural ~8-hour Intune cycle.

IntuneEntra ID

NetworkTemplate

Firewall Rule Change

Turn a plain-language firewall request into a reviewable change summary, then apply it on approval, with a full audit record.

Palo AltoCisco Meraki

NetworkTemplate

Guest Wi-Fi Access

Issue temporary, expiring guest Wi-Fi credentials on request, delivered back in chat, with a low-risk auto policy and audit.

Cisco Meraki

NetworkTemplate

Internal App Access Grant

Add a user to a zero-trust access policy for an internal application, scoped and approval-gated, with a full audit record.

CloudflareZscaler

Security

6 runbooks

Conditional Access Policy Review

Review current conditional-access posture, flag common gaps, and record the reviewed findings on the tamper-evident audit chain with approval; policy changes remain manual.

Endpoint Containment

Lock a suspected-compromised user's Intune-managed devices and contain their account (sign-in disabled, sessions revoked) with one approval and a security-namespaced audit row.

IntuneEntra ID

Security Alert Triage

IT-admin-initiated security triage: invoke /alert-triage on a user account when you spot suspicious activity, AscendCore proposes account suspension pending investigation, suspension executes only on explicit approval. Distinct security-event audit namespace for SOC-2 evidence separation.

Suspicious Sign-In Investigation

Pull a user's recent sign-in activity into one summary card and offer an approval-gated containment action, fully audited.

Entra IDOkta

SecurityTemplate

Exposed Secret Response

Respond to a leaked credential by rotating or revoking it and notifying the owner in one approval-gated action, fully audited.

Entra IDGitHub

SecurityTemplate

Sensitive Data Access Revocation

Remove a user's access to a sensitive SharePoint site, library, or Google shared drive in one approval-gated action, fully audited.

M365Google Workspace

Collaboration

7 runbooks

Confluence Space Provisioning

Self-serve Confluence space creation with propose-time key-collision detection and audit-chain coverage. Approval-gated; the approval card surfaces conflicts before the admin clicks Approve so wasted approval cycles are eliminated.

Atlassian Confluence

Email Distribution List Add

Add or remove users from Microsoft 365 distribution lists, mail-enabled security groups, and Microsoft 365 groups via Slack or Teams — same audited approval flow as security-group membership, with the group type clearly labeled on every approval card.

Jira Project Access Grant

Add a user to a Jira project with a specific role, approval-gated and audited, so project access stays deliberate.

Atlassian

Microsoft Teams Provisioning

Create a Microsoft Teams team with its M365 group and named owner from one approval-gated request, fully audited.

SharePoint Site Provisioning

Create a group-backed SharePoint team site with a named owner from one approval-gated request, with the site URL verified after provisioning and a full audit record.