What it replaced
Sign-in logs to review across tenants. Licenses to reconcile per client. Alerts arriving in one place and needing to reach someone else. All of it necessary, none of it interesting, and all of it competing with work that actually needed an engineer.
Approach
A self-hosted n8n instance on infrastructure I control, with credentials in our own secret store. Self-hosting was not a preference here. Several of these workflows touch tenant data, and routing that through a hosted automation service adds a party to the trust chain for no benefit.
What runs
- Sign-in monitoring. Risky and impossible-travel events pulled from Microsoft Graph, enriched with address reputation, delivered to the channel that owns the response.
- Alert routing and deduplication across sources, so one incident produces one notification.
- Scheduled license and tenant reporting, replacing a per-client console walk.
- Ticket automation. Workflows open, update, and annotate tickets directly from their output.
Result
The platform reports its own numbers, which is the reason I quote them rather than an estimate: 259 production executions, zero failures, 14 hours saved over the reporting window, across 30 workflows.
