Customize a workflow

Before you start

• Your role lets you manage workflows. That is what shows ExecutionWorkflow Builder in your menu. On a new instance only administrators have that permission.
• Someone else who can approve workflows, unless you are an administrator. Building and approving are separate rights, and by default nobody but an administrator can approve their own design.
• Your MFA device. Saving and approving a workflow can ask you to confirm it is you.

Open the pipeline

1. 1

   Step 1: Pick onboarding or offboarding

   Go to ExecutionWorkflow Builder and choose the “Onboarding” or “Offboarding” tab. The pipeline’s name sits at the top; click it to switch to another pipeline. The live one for unnamed runs is marked “DEFAULT”.

   Its status shows as “APPROVED”, “PENDING”, “REJECTED” or “DRAFT”. If a reviewer rejected a version, a notice at the top of the builder gives their reason. Change what they asked for and send it for approval again.

   The third tab, “Runs”, lists the runs. The information icon beside the tabs opens a short guide to how onboarding or offboarding is usually laid out.

Change the steps

1. 2

   Step 2: Add a step

   In “Add a step” on the left, pick from the “Steps” shelf, or type in “Search steps and apps…” to find one. Clicking a step adds it to the end. To place it somewhere else, use the “Insert a step” button between two steps on the canvas.

   The steps you can add include “IT Setup”, “Manager Approval”, “IT Task (dated)”, “Create Zonitix Account”, “Assign Hardware” or “Hardware Recovery”, “Assign Persona”, and adding to or removing from a directory group. Some only appear on onboarding or only on offboarding.

   Each step can be added once per pipeline. The exception is “IT Task (dated)”, which you can add as many times as you need.

   The second shelf, “Fixed apps”, lists your connected systems. You rarely need it: apps normally come from each person’s persona. Adding one here gives that app to everyone who runs this pipeline, whatever their role, so Zonitix asks “Add … as a fixed step?” first. If the persona also lists the app, the run can try to set it up twice and stall. Click “Add anyway” only if every person on this pipeline must get it.

   To start from a draft instead, click “Generate from description” at the bottom of the palette, describe the approvals and IT checkpoints in plain English, and click “Generate steps”. The AI model on your instance drafts the steps and replaces what is on the canvas (the HR trigger is kept, and you are asked to confirm before existing steps are replaced). It only drafts the human steps: it never adds account, hardware or directory-group steps. Nothing is saved until you save, and the draft still goes through approval.

2. 3

   Step 3: Configure it

   Click a step to open its settings on the right. For a step a person completes, set “Who completes this step”: only members of that group see its form and can submit it. For an “IT Task (dated)”, set “Due” and “Instructions for IT”. Click “Apply changes”.

3. 4

   Step 4: Reorder, skip or remove

   Drag a step by its handle to move it (or focus the handle and use the arrow keys). The trigger must stay first.

   Switch a step off to skip it while keeping its settings. To remove it for good, click its remove icon and confirm “Remove this step?”. The trigger cannot be removed.

4. 5

   Step 5: Choose the automation mode

   Click “Manage” and pick one under “AUTOMATION”:

   “Runs manually”: every step waits for a person. Account steps wait for an administrator to run them.

   “Accounts automatic”: accounts are created and disabled on their own, and approvals still wait.

   “Fully automatic”: every step marked automatic runs unattended.

   The current mode is shown beside the tabs.

Save and send for approval

1. 6

   Step 6: Save

   Click “Save as Draft” to keep working later, or “Submit for approval” to send it for approval. Zonitix checks the pipeline first and lists any problems, for example a trigger that is not first, or, on an onboarding pipeline, a Manager Approval with no manager collected at the trigger. (Offboarding uses the manager already on the leaver’s record.)

   Editing an approved pipeline never changes the live version. Changing its steps, its automation mode or what it provisions saves a new version. The approved one keeps running until the new one is approved.

   While a version is pending, its steps are locked. To change it, click “Edit (Withdraw from Approvals)”.

2. 7

   Step 7: Have someone else approve it

   The approver opens ExecutionWorkflow Tasks, goes to the “Approvals” tab, selects the pipeline and clicks “Approve”, or “Reject” with a reason.

   If you built it, you see “You built this workflow, so it needs a different approver.” Administrators are always exempt and can approve their own. Approval also re-checks the pipeline and refuses one that does not validate.

Roll back

1. 8

   Step 8: Promote an earlier version

   Click ManageVersion history. The live version is marked “ACTIVE”. On an earlier approved version, click “Promote” to make it live again. “View / Switch” loads a version into the editor so you can look first. Promoting needs the approve right, like any approval.

   Earlier versions stay in the list unless someone archives them. An archived version can no longer be promoted.

More than one pipeline

1. 9

   Step 9: Create or duplicate a named pipeline

   You can keep several onboarding or offboarding pipelines side by side, for example one for contractors. Click “Manage”, then “New pipeline” to start with just the trigger, or “Duplicate” to copy the one on screen with its steps, persona trims and automation setting. Give it a name (people pick this name when they start a run) and click “Create draft” or “Copy to draft”.

   A new pipeline starts as a draft. Nothing runs through it until it is saved and approved.

2. 10

   Step 10: Choose the default, retire or delete

   ManageMake default makes the pipeline on screen the one used when a run is started without naming a pipeline. It is offered only on an approved, live pipeline that is not already the default.

   ManageRetire pipeline stops a pipeline being offered when someone starts a run. Runs already under way keep going, nothing is deleted, and it stays viewable for audit. A retired pipeline shows a “RETIRED” label, and ManageReinstate pipeline brings it back.

   You cannot retire the default pipeline, or the only approved pipeline of its kind. Make another one the default, or publish a replacement, first. Neither item is offered on a version that is switched off only because it was rejected: edit it and submit it again instead.

   “Delete permanently” appears only for a draft that was never approved and never used by a run. It cannot be undone.

3. 11

   Step 11: Trim what one pipeline provisions

   At the end of the pipeline, “Provision from persona” (on offboarding, “Revoke from persona”) shows what a persona brings to this pipeline. Click “Review”, pick a persona, and untick anything this pipeline should leave out, or on offboarding should keep rather than revoke. A trim can only take items away for this pipeline; the persona itself is not changed.

What you should see

If something goes wrong

"Cannot submit for approval: The first step must be the HR Trigger."

Drag the trigger back to the top, then save again. The same message lists any other problems, such as a step with nobody set to complete it.

Save as Draft and Submit for approval are greyed out.

The version on screen is approved and unchanged, so there is nothing to save. Change a step, the automation mode or what it provisions, and the buttons turn on.

"… is the default onboarding pipeline. Make another pipeline the default first, then retire this one."

Open the pipeline that should take over, click Manage, then Make default. Then come back and retire this one. If the message says it is the only active pipeline, create or approve a replacement first.

"You cannot approve a workflow you created."

Ask a different person who can approve workflows. An administrator can also approve it. Administrators can switch this rule off under Security Settings, Workflow Approvals, Require a separate approver, but we recommend keeping it on.

"This workflow does not validate and cannot be approved: …"

The message says what is wrong, often a step for a system that has no active connection under Identity Hooks. Fix the connection or the step, then save and send it again.

Still stuck? See When something goes wrong, or Contact Zonitix support.

Where next

• Work through workflow tasks
• Create a persona
• Offboard someone
• Roles, groups and permissions