Build an action once in your service-provider team and publish read-only copies to your clients' managed teams
If you're an MSP, you can build an action once in your service-provider team and publish a copy to each client's managed team. Each copy runs in that client's team, with that team's own credentials, groups and members.
Before you begin
- You're in your service-provider team, as an Engineer or Admin.
- Your service-provider team has a primary PSA connection. The managed teams you can publish to are the managed teams of that connection.
- The action has a script and works. Test it first. See Create an action.
Publish to managed teams
- Open the action under Workflows → Actions.
- Select Publish. If the action is already published, open the menu next to Edit action and select Publish to teams, or use the action's Teams tab and select Publish action to teams.
- In Publish action?, under "Also publish into these managed teams:", tick each team, or tick Select all. Teams that already have a copy are ticked.
- Select Publish.
A team where an action with the same name already exists fails on its own; the other teams still get their copy.
What each managed team gets
Each copy has the action's name, description, runtime, published script, inputs, target, timeout and Run automatically setting, plus:
- The authorization rules, as a snapshot. The copy holds a copy of your policy's rules, not a link to the policy. If you change the policy, publish the action again to update the copies. Rules match groups in the managed team, so make sure the same
superit:*groups exist there. See Authorization policies and approvals. - Blank credentials. Each linked credential arrives with the same name, type and settings, but no secrets. See Fill in the credentials.
- Except existing credentials. If the managed team already has a credential with the same name and type, the copy uses it as it is, secrets included, so the copy may run without further setup. If the name matches but the type is different, publishing to that team fails: "Credential '…' exists in this team with a different type".
Copies are read-only. In the managed team, the action can be run but not edited, published or deleted: "Managed copies are read-only; edit the origin action in the publishing team". To change a copy, change the action in your service-provider team, test it, and publish it again.
Fill in the credentials
A copy can't run until each of its credentials is filled in. Until then, runs are refused with "Credential '…' is an unconfigured placeholder — set its values before running".
- In the managed team, go to Workflows → Credentials. Credentials that need filling in show Needs configuration.
- Open each one and enter its secret, or for a Microsoft Graph credential, select Re-authorize and sign in as an admin of that client's Microsoft 365 tenant.
This keeps each client's secrets in its own team: a copy of an offboarding action, for example, acts only in that client's tenant. See Credentials.
Check where an action is published
The action's Teams tab lists each managed team with:
- Status: Published or Draft.
- Credential: Configured, or Not set if an admin in that team must still fill in the secrets.
- Last run.
Retract copies
- From some teams: open Publish to teams, untick those teams and select Publish. Unticking a team retracts its copy.
- From every team: untick every team, or Unpublish the action. Unpublishing turns the action and all its copies back into drafts, so they can't run; the copies aren't deleted.