M1_Support — Customer Success Report

1. Intune MDM Policy & Configuration Auditing

Description: Automates querying and inventorying Microsoft Intune resources — compliance policies, configuration profiles, compliance scripts, and endpoint security intents — via the Microsoft Graph API. Provides on-demand visibility into the device management posture without requiring manual navigation of the Intune portal.

Business Problem: Security and compliance teams need continuous visibility into device compliance policies and configurations to detect drift, support audits, and ensure endpoints meet security baselines. Manual checks in the Intune UI are time-consuming and inconsistent at scale.

Integrations: Microsoft Graph (Intune / DeviceManagement)

2. Azure AD Group & Identity Lookup

Description: Provides on-demand retrieval of Azure AD group details and full membership lists via Microsoft Graph, and includes a scheduled weekly check for deleted user accounts with results delivered by email. Serves as a core identity lookup and lifecycle-monitoring primitive for access review, incident investigation, and account hygiene.

Business Problem: Access reviews, incident investigations, and permission audits all require fast, reliable group membership data. Manual queries in Entra ID are slow and non-repeatable; this use case enables group data to be retrieved programmatically and fed into downstream automation, while the weekly deleted-user check gives IT recurring visibility into account lifecycle changes without a manual portal review.

Integrations: Microsoft Graph (Entra ID / Azure AD), Email delivery

3. Employee Offboarding Automation

Description: Triggered by a Freshservice webhook when an offboarding ticket is raised, this workflow extracts the ticket ID, retrieves and parses the ticket details, and evaluates conditional logic to drive downstream Entra ID deprovisioning actions.

Business Problem: Manual offboarding is slow and error-prone, and delayed deprovisioning leaves departed employees with active accounts and access — a material security risk. This playbook connects the ITSM ticketing system (Freshservice) directly to identity actions in Entra ID, closing the loop between ticket creation and account deprovisioning.

Integrations: Freshservice (ITSM), Microsoft Entra ID, Python scripting

4. Bulk Account Provisioning

Description: Ingests a CSV file of user records, parses it into structured JSON, determines the required CRUD action per row (create, update, or deactivate), and executes provisioning operations iteratively via a for-loop with Python-driven formatting logic.

Business Problem: Onboarding or offboarding large cohorts of users — contractor batches, org restructuring, acquisitions — via manual IT ticketing is slow and error-prone. This playbook enforces a consistent, auditable provisioning process that scales to hundreds of accounts in a single run.

Integrations: Blink file utilities (CSV parsing, working directory), Python scripting

5. Automated Security Reporting

Description: Invokes a Blink AI reporter agent with structured report data, content instructions, and a title; generates a formatted HTML report; converts it to PDF; and conditionally delivers it to specified email recipients.

Business Problem: Producing recurring or ad-hoc security reports manually is time-intensive and inconsistent. This playbook enables any upstream workflow to trigger a polished, consistently formatted report delivery with no manual effort — decoupling data collection from presentation.

Integrations: Blink AI Agents (Reporter), PDF conversion utility, email delivery

6. Platform Onboarding & Demo

Description: A standard "Hello World" starter playbook that exercises Blink's three core runtime primitives: internal print, Bash execution, and Python execution.

Business Problem: Validates platform connectivity and confirms developer onboarding. Not a production use case.

Integrations: Core runtime (Bash, Python)

Strengths

• Microsoft Graph is the dominant integration. Virtually all production workflows are built on it, covering both Intune (device compliance, configuration profiles, security intents) and Entra ID (group membership, deleted user monitoring). This indicates a mature, Microsoft-first environment and provides a strong foundation for expanding MDM and IAM automation.
• Group identity lookup is the highest-volume use case. With 60 executions in 12 months, Get group and members by ID is clearly a workhorse — likely feeding access review processes, incident investigations, or downstream provisioning logic that depends on group data.
• AI-assisted reporting is in place. The Call Reporter Agent workflow demonstrates early adoption of Blink's agentic capabilities, positioning the team to scale security reporting and operational summaries without analyst involvement in formatting or delivery.
• Offboarding automation now connects ITSM to identity actions. The new Freshservice to Entra offboarding workflow has already run 39 times, directly closing the previously identified employee lifecycle gap by triggering Entra ID deprovisioning logic from Freshservice ticket intake.

Gaps

• No event-driven or alert-triggered automation, aside from offboarding. With the exception of the new Freshservice-triggered offboarding workflow, all other workflows are on_demand or scheduled with no SIEM integration or reactive response playbooks. There are no SOC, triage, or EDR use cases — the remaining automation is query-oriented and manually initiated.
• MDM audit playbooks are used ad hoc, not systematically. List Compliance Policies (6 runs), List Device Configuration Profiles (1 run), and List Endpoint Security Intents (1 run) show low cadence. These would deliver significantly more value if scheduled or chained into a recurring compliance hygiene workflow.
• Two subflow playbooks have never been executed. Get Compliance Policy and Get Compliance Script have zero runs. They appear to be building blocks for a deeper compliance drill-down workflow that was never completed or wired up.
• ITSM integration is limited to a single offboarding trigger. Freshservice is now connected via the new offboarding workflow, but compliance audit results, provisioning completions, and report deliveries still aren't fed back into the team's operational ticket queues — there's room to extend Freshservice integration beyond the single offboarding use case.

Integration Ecosystem