Run and schedule SuperIT workflow actions

Previous Next

Run a published action from a chat, from the app or from a ticket investigation, schedule it in chat, and read its run history

A published action can run in four ways: SuperIT runs it in a chat, someone runs it from the app, a schedule runs it every few days, or a ticket investigation recommends it. Every run is checked against the action's authorization policy and recorded in its run history. Only published actions run.

Before you begin

  • The action is published. See Create an action.
  • Every linked credential is filled in. A run with an empty credential is refused with "Credential '…' is an unconfigured placeholder — set its values before running".
  • You're allowed to run the action under its authorization policy. With no policy, only Engineers and Admins can run it.

Run from a chat

SuperIT knows every published action in your team by its name and description, and runs them through a single run tool. Ask in plain language, for example "Jane Smith left today, please offboard her" or "look up Contoso's firewall in IT Glue".

  1. SuperIT finds the matching action and reads its inputs.
  2. SuperIT asks for any input it can't fill in from the conversation. It doesn't guess input values.
  3. If you've selected a device in the chat and the action can run on a device, SuperIT asks whether to run it on that device or in the cloud sandbox.
  4. SuperIT links the run to the chat's ticket where there is one, so the ticket gets notes as the run progresses.
  5. SuperIT runs the action and reports the result, or tells you it's waiting for approval.

This works in all three ways SuperIT works: engineers in the copilot chat or the Pod, end users in self-service chat when the policy lets them, and SuperIT itself on a ticket. If you aren't allowed to run the action, SuperIT says so and names people who can help.

Chats can't start test runs. In Plan mode, SuperIT doesn't run actions.

Run from the app

  1. Go to Workflows → Actions and open the action.
  2. Select Run.
  3. In the Run "" dialog, fill in the inputs.
  4. For a PowerShell action, choose a Run target. With no device selected, the help text reads "Runs in the cloud sandbox. Pick a device to run on the machine instead." With a device selected, it reads "Runs elevated as SYSTEM on the device via the mesh."
  5. Select Run action.

If you aren't allowed to run the action, the dialog shows Who can help.

Device runs need an action set to run on a device. The Run target picker appears for every PowerShell action, but a device run of an action set to the cloud sandbox is refused with "Only mesh_device actions can run on a device — this action is configured for the cloud sandbox". The action's page shows Cloud sandbox or Device. To change it, see Set an action to run on a device. A device run also needs an online Windows device with the SuperIT RMM agent.

To run an action again with the same inputs, open a past run and select Re-run.

Run from a ticket investigation

When SuperIT investigates a ticket, it can recommend one of your published actions, with the inputs it found. The recommendation appears in the ticket's Recommended actions panel as Run workflow, showing "Recommended workflow:" and the action's name.

  • Run it yourself. An Engineer or Admin fills in anything marked Needs input and selects Run workflow. If the run couldn't start, the button reads Try again.
  • Let it run automatically. Switch on Run automatically in the action's Approvals step. When an investigation recommends the action and resolves every required input, it runs without waiting for an engineer. Use this only for cloud sandbox actions.

When an action runs automatically, it's requested on behalf of the ticket's contact, who must be linked to a SuperIT user. The authorization policy is checked for that person, and a run that needs approval still waits for its approver. If the contact isn't linked to a SuperIT user, the recommendation waits for an engineer instead.

An action with no authorization policy that uses a credential or runs on a device never runs automatically from a ticket. Give such actions a policy. See When an action has no policy.

Don't run device actions automatically

A device action started from a ticket recommendation isn't necessarily sent to the ticket contact's device. Leave Run automatically off for actions that run on a device, and run them from the Run dialog, where you choose the device.

Investigations follow your ticket automation settings.

Schedule an action

Schedules are created and managed in a chat with SuperIT only. There is no schedule page for creating them. You need the Engineer or Admin role.

  1. Ask SuperIT, for example "Run the stale guest account report every 7 days, starting Monday at 9am Sydney time".
  2. SuperIT checks for an existing schedule, finds the action and collects its inputs and target.
  3. SuperIT confirms the action, inputs, target, first run and interval. Reply to agree.
  4. SuperIT creates the schedule and replies with a View schedule link.

How schedules work:

  • A schedule repeats every N days, from 1 to 3650; the default is 30. A day is 24 hours, so it isn't "monthly" and can drift by an hour across daylight-saving changes. Calendar (cron) schedules aren't supported.
  • Without a first run time, the first run is one interval after you create the schedule.
  • If a previous run, including one waiting for approval, is still active, the next run is skipped. After downtime, at most one missed run is made up.
  • Each run uses the latest published script and the current authorization policy. A schedule doesn't bypass approval.
  • A schedule for a device action is tied to the device you confirmed.

To list, pause, resume, change or cancel schedules, ask SuperIT, for example "list my action schedules" or "pause the guest account report schedule". Cancelling is permanent. Changing or resuming a schedule makes you its Runs as identity.

The View schedule page is read-only. It shows the Saved action, Target, Interval, Next due, Runs as, Scheduled inputs and Recent occurrences, and a Manage in chat link.

See run history

Each action's Executions tab lists its runs, with the columns Run ID, Action, Status, Device (Sandbox or the device), Origin, Requester, Approver, Timestamp and Duration. Filter by Status or Origin. The Overview tab shows Total executions, Success rate, Avg duration and Last run.

Origin shows how a run started: Manual (from the app), a chat label (from a chat with SuperIT), Scheduled, or Investigation (from a ticket recommendation).

Open a run to see:

  • Execution timeline: queued, waiting for approval, preparing, running, script execution.
  • Details: requester, approver and approval date, start and end times, durations, runtime and target device.
  • Inputs and the Script that ran.
  • Output, with Stdout, Stderr and Result tabs and Download JSON.
  • Diagnostic log, with Copy log.

A test run shows a banner that authorization and approval were bypassed.

End users see only their own runs, and a redacted view of the output unless they're also an approver.

Cancel a run

The person who requested a run, or an Engineer or Admin, can cancel a run that hasn't finished: open it and select Cancel execution.

If something goes wrong

  • "You are not authorised to run this action". No rule in the action's policy matches you. Ask one of the people listed, or an Admin, to change the policy. See Authorization policies and approvals.
  • "Engineer access required to run this action". The action has no policy, so only Engineers and Admins can run it.
  • "Device runs require a PowerShell action" or "Device runs are only supported on Windows devices". Run it in the cloud sandbox, or on a Windows device.
  • "Device is offline". Wait for the device to come online. See Troubleshoot the SuperIT RMM agent.
  • The run ends with "Approval expired". Nobody approved it within 7 days. Request it again.
Authorization policies and approvals for SuperIT actions Publish SuperIT actions to managed teams