Admin Change Role Notification
Provides automated security workflow that monitors user role changes and sends real-time email notifications to system administrators when administrative roles are modified. This provides an audit trail and immediate awareness of critical permission changes within the system.
Detecting when user roles are added, removed, or modified.
Immediately notifying administrators of role changes for high-privilege accounts.
Providing visibility into permission escalations or de-escalations.
Helping prevent unauthorized privilege changes.
The workflow is triggered by the Update User event, which fires whenever a user entity is updated in the system.
Workflow Process
Detect Role Changes: When a user is updated, the workflow checks if the user's roles field has changed. If no role changes occurred, the workflow stops.
Store Updated User: Captures the updated user entity into a token for use throughout the workflow.
Filter Original Roles: Removes the default "authenticated" role from the original roles list to focus only on meaningful administrative roles.
Filter New Roles: Removes the default "authenticated" role from the new roles list and trims whitespace to ensure clean data.
Switch to Service Account: Changes to a service user account with appropriate permissions to create and send email entities.
Set Admin Roles List: Defines which roles are considered "administrative" that should trigger notifications:
Content Admin
SEO Admin
Site Admin
Administrator ( Super Admin)
Admin Role Check: Verifies that the role change involves administrative roles (not just "editor" or "authenticated"). If the change only affects non-admin roles like "editor", the workflow stops.
Query Admin Users: Retrieves the list of active administrator users who should receive the notification from the system.
Send Notifications Loop: For each administrator in the list:
Pops the first administrator from the list
Creates a role change notification email entity
Populates it with information about which user's roles changed
Queues the email to be sent
Loops back to send to the next administrator
The workflow continues until all administrators have been notified
Last updated