Offboarding Collaborator Cross-Check

Overview

Every weekday morning at 06:00 Eastern, this flow cross-references the collaborators on a configurable list of GitHub repositories against the Active Employees group in Microsoft Entra ID. Anyone present in GitHub but missing from the group is treated as potentially offboarded — the flow opens a ServiceNow incident for manual removal review and rolls every hit into a single HTML summary email sent to the Security Operations distribution list. On clean days the flow stays silent.

Use Case

External GitHub collaborators routinely outlive the engineers who added them — contractors finish projects, employees leave, and nobody remembers to revoke repo access. This flow gives Security Operations a daily, automated, zero-effort answer to the question "who has access to our repos that shouldn't?" without forcing IT to maintain a parallel access spreadsheet.

The flow is ideal for teams that:

• Daily detection of stale GitHub collaborators against the canonical employee group.
• Auto-create ServiceNow incidents so removal flows through the existing change process.
• Single consolidated email per day — no per-collaborator spam.
• Word-boundary CSV match avoids alex matching alexander.
• Multi-repo from one env var — add a repo by editing a string, no flow change.

Flow Architecture

Environment Variables

Connectors & Connections

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Different ITSM

Replace the HTTP POST with a Jira CreateIssue or Zendesk CreateTicket action and drop the flowlibs_ServiceNowEndpoint env var.

Tighten cadence

Change Recurrence to hourly for higher-risk repos — be mindful of GitHub API rate limits.

Multi-group active source

Replace flowlibs_ActiveEmployeesGroupId with a JSON array env var and union the members across all groups before building the CSV.

Auto-remove instead of ticket

Swap the HTTP action for GitHub RemoveCollaborator for a fully automated revocation — only after burn-in.

Skip bots

Add a Filter Array after List_Repository_Collaborators excluding logins ending in [bot] or matching a bot allowlist.

Per-repo owner email

Replace the single flowlibs_SecurityTeamEmail with a JSON map of repo → owner email and look up dynamically inside the Foreach.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

parameters('flowlibs_MonitoredRepoList (flowlibs_MonitoredRepoList)')

concat(',', join(body('Project_Active_Logins'), ','), ',')

toLower(coalesce(item()?['mailNickname'], split(item()?['userPrincipalName'], '@')[0]))

not(contains(variables('varActiveLoginsCsv'), concat(',', toLower(item()?['login']), ',')))

greater(variables('varTicketsCreated'), 0)