Automations
Build multi-step automation pipelines that run actions across your endpoints - on a schedule, in response to events, or on demand.
What Are Automations#
Automations let you chain a series of actions into a single pipeline that runs across one or more endpoints. Instead of performing each task by hand - restarting a device, installing updates, sending a notification - you define the steps once and let the pipeline run them in order, automatically.
A pipeline is made up of actions. Each action does one thing - restart a device, run a script, send an email - and the pipeline runs them sequentially. You decide how the pipeline starts: on a schedule, when an event occurs, or only when someone runs it manually.
- Build multi-step pipelines of actions that run on your endpoints
- Mix device power control, security scans, app installs, and notifications in one flow
- Trigger automatically on a schedule or in response to an event
- Run manually from any endpoint detail page
- Every step records its result so you can audit what happened
Creating a Pipeline#
Creating an automation pipeline takes a few minutes. You name the pipeline, add the actions you want in the order they should run, and choose how it should be triggered.
- 1Open the Automations section
Navigate to Automations from the sidebar. You will see a list of existing automation pipelines with their status, action count, and trigger type.
- 2Create a new pipeline
Click the "New Automation" button. Give the pipeline a name and an optional description so your team can recognize it later.
- 3Add actions to the pipeline
Add one or more actions in the order you want them to run. Each action is added through a three-step wizard (see below). Actions run sequentially - the next one starts only after the previous one completes.
- 4Choose a trigger
Decide how the pipeline should start: on a fixed schedule, in response to an event, or only when someone runs it manually. You can leave a pipeline without a trigger if it will always be started by hand.
- 5Save and activate
Review the pipeline, then save it. Active pipelines run automatically according to their trigger. Archived pipelines are hidden and never run.
Action Types#
There are 26 action types organized into five categories. When you add an action to a pipeline, a three-step wizard guides you through choosing the type, configuring it, and setting failure behavior.
The three-step wizard
- 1Choose Action Type
Browse a category-grouped card grid. There are five categories - Device, Security, App Management, Notifications, and Other. Each card shows an icon, label, short description, and an "Agent" badge for actions that require the endpoint agent to be online.
- 2Configure Action
Give the action a display name and fill in the type-specific fields. Depending on the action, these may include a script, package name, message text, URL, delay in minutes, scan type, SMS phone number, or email fields.
- 3Conditions & Failure Behavior
Optionally add conditions that must be met for the action to run. Choose what happens on failure - for example, whether the pipeline should stop or continue - and set a retry count. A three-bar progress indicator at the top of the wizard shows which step you are on.
Category summary
| Category | Actions | Covers |
|---|---|---|
| Device | 7 | Power control, group assignment, maintenance mode, tags, deletion |
| Security | 5 | OS updates, Defender update and scan, disk encryption |
| App Management | 5 | winget, Linux packages, Homebrew, Microsoft 365 |
| Notifications | 5 | On-screen toast, approval gate, SMS, email, email report |
| Other | 4 | Run script, HTTP request, custom field, delay |
Device
| Action | Runs on | Description |
|---|---|---|
| Restart Device | Agent | Restart the device through the endpoint agent |
| Shutdown Device | Agent | Shut down the device through the endpoint agent |
| Assign to Group | Server-side | Move the endpoint into a different group |
| Enable / Disable Maintenance Mode | Server-side | Toggle the endpoint maintenance mode on or off |
| Delete Device | Server-side | Remove the endpoint from management entirely |
| Apply Tag | Server-side | Add a tag to the endpoint |
| Remove Tag | Server-side | Remove a tag from the endpoint |
Security
| Action | Runs on | Description |
|---|---|---|
| Install OS Updates | Agent | Install all available Windows, macOS, or Linux updates |
| Windows Defender Update | Agent | Update Defender signature definitions (Windows only) |
| Windows Defender Scan | Agent | Run a quick or full Defender scan (Windows only) |
| Enable / Disable Disk Encryption | Agent | Turn BitLocker (Windows), FileVault (macOS), or LUKS (Linux) on or off |
| Rotate Disk Encryption Key | Agent | Generate a new disk encryption key |
App Management
| Action | Runs on | Description |
|---|---|---|
| Install / Uninstall / Upgrade winget Package | Agent | Manage Windows packages via winget |
| Install / Uninstall / Upgrade Linux Package | Agent | Manage Linux packages via apt, dnf, or yum |
| Install Homebrew | Agent | Install the Homebrew package manager on macOS |
| Install / Upgrade / Uninstall Homebrew Package | Agent | Manage macOS packages via Homebrew |
| Install Microsoft 365 | Agent | Install Microsoft 365 on Windows or macOS |
Notifications
| Action | Runs on | Description |
|---|---|---|
| Notify User | Agent | Show a toast message on the endpoint screen |
| User Approval | Server-side | Pause the pipeline until a person approves it |
| Send SMS | Server-side | Send an SMS message to a phone number |
| Send Email | Server-side | Send an email notification |
| Send Email Report | Server-side | Email an endpoint report to recipients |
Other
| Action | Runs on | Description |
|---|---|---|
| Run Script | Agent | Run a library or custom script on the endpoint |
| HTTP Request | Agent | Send an HTTP request to an external webhook or API |
| Set Custom Field | Server-side | Update a custom field value on the endpoint |
| Delay | Server-side | Hold the pipeline for a specified duration before continuing |
Triggers#
A trigger decides how and when a pipeline starts. You can choose a schedule, an event, or no automatic trigger at all.
| Trigger type | How it works |
|---|---|
| Schedule | The pipeline runs on a recurring schedule - for example, every day at a set time, or weekly on a chosen day. Use this for routine maintenance like installing updates or running security scans on a cadence. |
| Event-based | The pipeline runs automatically in response to an event - such as a monitoring alert being triggered. This lets you react to conditions on your endpoints without manual intervention. |
| Manual | The pipeline has no automatic trigger and only runs when someone starts it by hand. You can run any automation manually from the endpoint detail page by selecting it and confirming "Run Now". |
Run History#
Every time a pipeline runs - whether automatically or manually - the result is recorded. You can review what ran, when it started, how long it took, and whether each action succeeded or failed.
- Each pipeline run is recorded with its start time, total duration, and overall status (success or failed).
- Within a run, every individual action has its own result - running, succeeded, or failed - along with any output or error message.
- On the endpoint detail page, the Automations tab shows available automations as a card grid and lists the 20 most recent runs for that endpoint.
- The global Automations page lists runs across all endpoints, so you can see trends and spot recurring failures.
Edit Mode Behavior#
Editing an existing action is safe by design. Your changes are kept locally until you explicitly save them, so you can experiment without affecting the live pipeline.
- When you edit an existing action, the wizard skips the type-selection step and opens directly on the configuration step, since the action type cannot be changed after creation.
- Changes you make in edit mode are kept locally in your browser until you press "Done". Nothing is saved to the server until you explicitly confirm.
- If you navigate away or close the wizard without pressing "Done", your local edits are discarded and the previously saved version remains unchanged.
- Pressing "Done" commits all local changes at once, so the pipeline only ever reflects either the fully saved state or your complete set of edits.