Automation Rules
The Automation page lets you define rules that watch your environment and take action automatically when a site falls outside policy — without waiting for a nightly scan or manual review.
What Are Automation Rules?
An automation rule has two parts:
- Trigger — a condition that Tenaxis evaluates against every managed site
- Action — what Tenaxis does when a site matches the trigger
Rules run on a schedule and can also be triggered on demand. Every match is logged with the site's before-state and after-state so you have a full audit trail.
Trigger Types
| Trigger | What it detects |
|---|---|
| Risk Score Above | Sites whose risk score exceeds a configurable threshold (default: 70) |
| Sharing Unrestricted | Sites whose sharing capability is more permissive than your allowed level |
| Orphaned Site | Sites that have had no owner for longer than a configurable number of days |
| Excessive Guests | Sites with more external (guest) users than a configurable limit |
Each trigger type has its own condition parameters you set when creating the rule — for example, the risk score threshold or the maximum number of allowed guests.
Action Types
| Action | What it does |
|---|---|
| Notify Admins | Sends an email to all tenant admins listing every site that matched, with the trigger value for each |
| Restrict Sharing | Patches the site's sharing capability in SharePoint to a target level (e.g. ExistingExternalUserSharingOnly) |
| Assign Owner | Adds a specified user as an owner on the site via Microsoft Graph |
| Flag Lifecycle | Sets the site's lifecycle status to ESCALATED, surfacing it in the Lifecycle dashboard for manual follow-up |
Dry-Run Mode
Before enabling a rule for real, you can run it in dry-run mode. In dry-run mode, Tenaxis:
- Finds all matching sites as normal
- Logs them as
DRY_RUNinstead of taking action - Sends an email showing what would have happened
This lets you validate that your trigger conditions are catching the right sites before any changes are made in Microsoft 365.
To test a rule in dry-run mode, open the rule and click Run (Dry Run).
Cooldown Period
To prevent a rule from firing repeatedly on the same site, each rule has a 24-hour cooldown per site. After a rule acts on a site (or runs in dry-run mode against it), that site is excluded from the next run of that same rule for 24 hours.
If a site matches but is still in cooldown, the log entry shows outcome COOLDOWN.
Creating a Rule
- Go to Automation in the left sidebar
- Click New Rule
- Give the rule a name and (optionally) a description
- Choose a Trigger Type and fill in its condition parameters
- Choose an Action and fill in any required action parameters (e.g. the target sharing level, or the owner UPN to assign)
- Choose whether to start the rule Enabled or leave it disabled until you're ready
- Optionally check Dry Run to start in preview mode
- Click Save
Running a Rule On Demand
You can run any rule immediately without waiting for the scheduled run:
- Open the rule from the Automation list
- Click Run Now (runs the real action) or Run (Dry Run) (preview only)
- The results appear in the Automation Log below
The Automation Log
Every time a rule runs, Tenaxis records a log entry for each site that was evaluated and matched. The log shows:
| Column | Meaning |
|---|---|
| Site | Which site matched |
| Trigger Value | The exact value that caused the match (e.g. riskScore is 82) |
| Outcome | ACTIONED, DRY_RUN, COOLDOWN, or FAILED |
| Before | Snapshot of relevant site state before the action |
| After | Snapshot after the action (null for notify-only or cooldown) |
| Triggered At | Timestamp of when the rule ran |
Use the log to verify that rules are working as expected and to satisfy audit requirements.
Automation Summary
The top of the Automation page shows a 30-day summary:
- Active Rules — number of enabled rules
- Actioned — number of
ACTIONEDlog entries in the last 30 days - Dry Run — number of
DRY_RUNentries (preview matches) - Cooldown — sites that matched but were skipped due to the 24-hour cooldown
- Failed — rule executions that encountered an error (e.g. a Graph call failed)
Disabling and Deleting Rules
- Disable: toggle the rule off to pause it without losing its configuration. A disabled rule never runs, even if triggered manually.
- Delete: permanently removes the rule and all its log history. This cannot be undone.
Relationship to Alerts and Webhooks
Automation rules complement — but do not replace — the Alerts and Webhooks systems:
- Alerts (in Settings) notify admins reactively when specific events happen (e.g. a new external user is added)
- Webhooks push structured event payloads to external systems
- Automation rules pro-actively scan the current state on a schedule and can change site configuration, not just notify
For pure notification workflows, Alerts or the NOTIFY_ADMINS action on an automation rule both work. For active remediation (restricting sharing, assigning owners), automation rules are the right tool.