Demystifying Different Workspace ONE Intelligence Freestyle Orchestrator Triggers

Introduction

Have you created a Workspace ONE Intelligence Workflow that never runs when you think it should have? Why is my automatic trigger in the workflow not triggering? Why does it trigger sometimes, but not the other times? Why is there so much inconsistency? Fear not! This article will help demystify some misconceptions you may have with how Workspace ONE Intelligence Freestyle Orchestrator operates, specifically around the workflow triggers.

Since there are a few nuances in how these triggers operate, this article will walk through each type of trigger and elaborate how it is designed to work and which trigger works best for different scenarios, starting from the simplest trigger to the most complex trigger.

Manual Trigger

Best for: One-time execution or any on-demand workflow such as ad-hoc surveys, one-time script deployment, on-demand device clean-up, etc.

This is the simplest trigger as it only executes once. When the manual trigger is selected in the workflow, an administrator can choose when to enable and run the workflow. The workflow can be re-run manually but will never run by itself. When an administrator chooses to run the workflow, the workflow will evaluate the impact based on the criteria defined in the filter and take actions for each item in the impact list.

Schedule Trigger

Best for: Tasks requiring repeated executions such as daily device clean-up, twice-daily re-install actions on devices without a required app, etc.

Schedule trigger executes the workflow based on a defined time schedule. When the schedule trigger is selected, there are options for recurrence (hourly, daily, or weekly), when the workflow would start, as well as an optional end date. This is equivalent to scheduling a workflow with the manual trigger.

Example 1: Schedule Trigger

Consider the example below. A Workspace ONE Intelligence Freestyle Orchestrator workflow is created with a schedule trigger setting, executing daily at 10 AM to sync any iOS device that does not have Workspace ONE Intelligent Hub installed or has an unknown install status. The sync command will re-evaluate any missing assigned resources and re-deploy those resources to the devices. This workflow will re-evaluate every day at 10 AM for the impacted devices. Then, it will send a sync command to all the devices meeting the criteria. The workflow will continue to execute on the devices every day if they still are within the defined criteria or until the defined end date is met.

Figure 1: A Freestyle Orchestrator Workflow with a schedule trigger.

Automatic Trigger

Best for: Executing a one-time action based on data changes such as survey result follow-up, executing scripts based on changes in sensor data, etc.

Automatic trigger acts on changes in Workspace ONE Intelligence data. These data point update can be time-series events or snapshot data from different sources including Workspace ONE UEM such as a change from app installation from True to False, an updated enrollment status, or a change in battery level and Workspace ONE Intelligence such as new survey responses or device risk score.

When a new data point arrives in Workspace ONE Intelligence database, if that new data point qualifies the in the filter ruleset, then actions defined in the action set will be executed. The action set will execute once. Once the action set is executed, even though new data points are received that still meet the filter ruleset, the action set will not be executed. This is referred to as Execution Tracking, to avoid repeat firing of executions.

This type of trigger can be tricky when it comes to data points like timestamps such as enrollment dates or device last seen time. If these data points do not change, a workflow with automatic trigger will not be executed even though the amount of time may have passed to allow the devices to be qualified in the filters defined in the workflow. Example 3 and 4 further elaborate on this.

Example 2: Execution Tracking

Consider the following example. A Workspace ONE Intelligence Freestyle Orchestrator workflow is created to automatically generate a ServiceNow ticket when Zebra device battery health becomes less than 50%.

Figure 2: A Freestyle Orchestrator Workflow with an automatic trigger.

At time T, Workspace ONE Intelligence receives a sample from Device A stating its Zebra battery health to be at 51%. Since it does not qualify to be in the filter, the workflow will not trigger.
At time T+1, Workspace ONE Intelligence receives a new sample from Device A stating its Zebra battery health decreases to 49%. Now that it falls under the defined ruleset, the workflow is automatically triggered, and the ServiceNow ticket is generated for the help desk team to order a new battery replacement.
At time T+2, Workspace ONE Intelligence again receives a new sample from Device A stating its battery health continue to decrease to 45% since the new battery has not been installed yet. This will not trigger the workflow since it has already been triggered at T+1.
At time T+3, Workspace ONE Intelligence receives a new sample from Device A stating its Zebra battery health is now back to 100% after the new battery has been installed. The battery health is now outside of the defined filter.
At time T+100, Workspace ONE Intelligence receives a new sample from Device A stating that its Zebra battery health decreases to 49%. Since it now re-qualifies in the filter ruleset, the workflow will then be automatically triggered again, generating a new ServiceNow ticket.

Figure 3: Timeline for example 2.

If the data point does not change but happens to fall under the defined criteria (e.g., timestamp), the workflow will not execute.

Example 3: Timestamp Data Behavior with Automatic Trigger vs Schedule Trigger

Another popular example would be a workflow to manage a stale device. Considering two workflows, A and B, below. Workflow A leverages a schedule trigger while workflow B leverages an automatic trigger. The goal for both workflows is to delete stale devices not seen for more than 60 days.

Figure 4: Comparing a schedule workflow A and an automatic workflow B.

With workflow A, the workflow is triggered every day at 9 AM to delete all devices as long as they meet the condition listed in the filter ruleset. Workflow B, however, will not get triggered as device last seen becomes more than 60 days. This is because the Device Last Seen date/time does not change. Since there is no change in the Device Last Seen sample timestamp, the workflow will not get triggered.

Figure 5: Timeline for example 3, comparing behaviors from Workflow A and Workflow B.

Example 4: Timestamp Data Behavior with Automatic Trigger when a delay is added

Here is another example. Two Workspace ONE Intelligence Freestyle Orchestrator workflows are created to send out a welcome email to the user after the device is enrolled.

Workflow A is created with an automatic trigger to send out a welcome email for any devices enrolled within the past hour, effectively sending out email to any users as soon as Workspace ONE Intelligence detects the device enrollment.

Workflow B is created with an automatic trigger to send out a welcome email for any devices enrolled within the past hour but not within five minutes, hoping to delay the email to be sent out by five minutes after enrollment.

Figure 6: Comparing an automatic workflow A without time delay and an automatic workflow B with time delay.

As a new device is enrolled at time T, workflow A will be triggered, as expected. As Workspace ONE Intelligence receives a new data point from Workspace ONE UEM with a new device record with an enrollment date/time within an hour, the workflow would trigger, sending out a welcome email to the user.

Since the enrollment date/time does not fall under the filter for workflow B, the workflow will not trigger.

After five minutes have passed, it is still expected that workflow B will still not be triggered. This is because the automatic trigger acts on data point changes, not whether the data point becomes qualified in the defined filter criteria. With the enrollment date/time does not change, even though it is now qualified, the workflow will not be triggered. The timeline below illustrates how each workflow behaves as time passes.

Figure 7: Timeline for example 4, comparing behaviors from Workflow A and Workflow B.

In this example, instead of using an automatic trigger, a schedule trigger would be more appropriate. A workflow can be created to send welcome emails out every 4 hours to devices enrolled in the past 4 hours to introduce the delay, effectively achieving the same goal.

Summary

By leveraging the appropriate triggers for different tasks, organizations can ensure that their device management processes are not only more efficient but also aligned with their operational goals and compliance requirements. The Workspace ONE Intelligence Freestyle Orchestrator’s robust triggering options provide the flexibility and control needed to maintain an optimized, secure, and compliant IT environment. Understanding these triggers thoroughly will help ensure that any critical operations are managed correctly.