GAT Flow is the user management tool for Google Workspace Admins to create workflows to take a single or bulk action to Onboard (create), Offboard (delete), or Modify (update) user accounts.
Flow can also handle conditional use cases.
This article will demonstrate how a more complex conditional case can be handled.
Objective #
Consider the following example
A new Employee has been hired by your company. He is being put into the position of Manager of the Accounts department. The new manager has been onboarded already, though the employees need to be introduced to the new hire. Before leaving, the old accounts manager started a project but didn’t pass the project to the rest of his team. The Accounting team needs access to this folder. The old accounts manager has been suspended.
You as the admin have been tasked with the following:
- Introduce everyone in the company to the new hire
- Allow everyone to see the new hire’s calendar as a ‘free/busy reader’, except the CEO.
- Ask the company CEO to introduce the new hire to the accounts department and let him know you removed the old manager.
And for the people in the accounts department:
- Set the new hire as Manager for everyone in the accounts department
- Allow ‘write’ access to the new manager’s calendar for the accounts department
- Transfer a project folder from the old accounts manager to the rest of the accounts department
- Remove access to all folders from the old accounts manager and wipe his old devices
We will use GAT Flow to do all of this in one fell swoop!
Set up a Conditional Workflow #
Firstly, launch GAT Flow, select ‘Create workflow’.
Everyone in the company is going to be affected by this workflow, as we need to introduce them to the new hire, so we will filter by OU, select the root OU (/) and click ‘Recursive’ to include all child OU’s below that and users within them.
The next screen will display all the users on your domain, you can deselect some if you want, though, for this case, we are using them all.
When you are finished selecting the users, click ‘Submit’.
Click ‘Next’ to continue to the workflow.
The full workflow we are going to create is outlined below. We will break this down in the next section.
Setting up the workflow #
First off, we have two sets of actions to achieve, one set of actions has to deal with the accounts department, and the other is for everyone else, so we will start with a condition.
Click the ‘+’ (1) button with your mouse, and the ‘Add condition’ button will appear.
Click the button and a condition will appear. Double click the condition node to then configure the settings.
We have a different set of tasks for the Accounts department, so select ‘Department’ from the dropdown menu and type ‘Accounts’ into the field below.
The ‘No’ side #
The first task is to introduce everyone else to the new manager, we will do this by sending an email. Click the ‘+’ button next to the No path.
We want to send the users an email. So choose ‘send an email’ from the list of actions that appears.
Daisy-chaining from the ‘Send email’ box we need to add another condition to differentiate the CEO from everyone else.
Click the + button beside the Send email action and click ‘Add condition’.
This time we are going to select ‘Employee title’ from the dropdown menu and enter ‘CEO’ in the field below, as is his job title.
Now we can add an action for the CEO only.
We want to send the CEO an email, so click the ‘+’ button beside the Yes path and select ‘send email’ again.
That’s all we need to do on the CEO side, now we still need to add everyone else to the new managers’ calendar.
Go to the previous condition box and for ‘If Employee title equals CEO’ and click the + button beside the No path.
Select ‘Add user to calendars’ from the list. Choose ‘free/busy reader’.
We have finished with this part of the workflow now too.
What we have now is as follows:
If a user is not in the accounts department, one set of actions will be triggered for those users. (The ‘No’ side)
This set of actions is outlined in the screenshot below.
The ‘Yes’ side #
Moving onto the second part of the workflow.
For the people in the accounts department:
- Set the new hire as Manager for everyone in the accounts department
- Allow ‘write’ access to the new managers’ calendar for the accounts department
- Transfer a project folder from the old accounts manager to the rest of the accounts department
- Remove access to all folders from the old accounts manager and wipe his old devices
We will work on the first three tasks first, they are outlined in the orange box below.
To start the second set of actions for the accounts department.
Click the ‘+’ button beside the ‘yes’ path of the first conditional box (Department equal Accounts).
Add the action ‘Set user manager’.
Double click the action node to configure the settings, for this example, we will choose Adam’s email address and click outside the action box to ‘save’ and go back to the workflow.
From the Set user manager box, click the ‘+’ button, and select ‘Add user to calendars’.
Again, we will use Adam’s email address in the ‘Add to’ box for this example and select ‘writer’ from the dropdown menu.
The rest of the Accounts department still needs access to the Project folder from the objective
Following on from the ‘Add user to calendars’ box, click ‘+’.
Select ‘Copy folder to selected users’.
In this example, we are copying the folder from the old manager Paul.
Clicking outside the action box will save the settings and bring us back to the workflow.
The Last Part #
We have one final step to achieve.
Remove access to all folders from the old accounts manager and wipe his old devices.
As the old manager is the only suspended user in the Accounts department, we will continue with this same workflow.
Click the ‘+’ button beside the Copy folder to selected users box and Add condition.
We will add a condition for Suspended users. Click the dropdown menu and choose ‘Suspended’
The final part of the workflow is outlined in the orange box below.
We have no other actions to take on the rest of the accounts department, so we can leave the ‘No’ side of the condition empty.
On the Yes side of the condition click the ‘+’ and add the action ‘Wipe mobile devices’. For this assignment, we will choose ‘Remote wipe’ and click outside the dialogue box to save the settings.
- Next, click ‘+’ and add the action ‘Folder, Shared Drive permission change’.
- For the ‘Type’ field select ‘remove’ from the dropdown menu.
- Select ‘Folder’ from the file type dropdown menu.
We are removing all permissions, so click each scope from the dropdown menu (Viewer, Commenter, Editor).
Enter the old manager’s email address, we’ll be using Paul’s.
You can then select the individual folders you’d like to remove permissions from. Though for this example we will be removing them all with the ‘select all’ button.
We have come to the very end of the workflow. Click ‘Send approval request’ and a request will be sent to the security officer for approval via email.
NOTE: The last part of this example works because the old manager is the only suspended user in the accounts department, so it singles him out. If there were other suspended users, these actions would be executed on them also.
Always be careful with more complex workflows and read over what is going to happen.
Ensure that your workflow makes sense and will have the desired results.
There is no ‘Undo’ button and workflows cannot always easily be reversed!
