Skip to main content
Access automation in Nexus lets you define policy rules that run continuously against your Entra estate. Instead of relying on manual checks, periodic spreadsheet reviews, or reactive clean-up after an incident, automation enforces your governance policies in real time. Every time Nexus syncs with your tenant, it evaluates your active rules and fires the configured actions for any objects that match — keeping your environment compliant around the clock without adding work to your team’s plate.

​
Automation rules

Each automation rule is built from two components: a trigger condition that defines what Nexus is watching for, and an action that defines what Nexus does when it finds a match.

​
Trigger conditions

Triggers evaluate the state of objects in your Entra tenant. Common examples include:
  • Inactive user — a member or guest account has not signed in for 90 or more days (threshold is configurable)
  • Unreviewed guest account — a guest user has not been included in an access review in the last 30 days
  • Privileged role assigned without PIM — a user has been given a directory role as a permanent assignment rather than through Privileged Identity Management
  • MFA not registered — a new account has existed for 7 or more days without the user registering any MFA method

​
Actions

When a trigger condition is met, Nexus can take one or more of the following actions:
  • Disable account — sets the account to blocked in Entra ID, preventing sign-in immediately
  • Send notification — emails the user’s manager, a named administrator, or the user directly with a description of the condition and a recommended next step
  • Create an access review — automatically opens an on-demand access review scoped to the matched object, routing it to the appropriate reviewer
  • Add to remediation queue — places the matched object in the Nexus remediation queue for a human administrator to review and act on
A single rule can chain multiple actions. For example, you can configure a rule that both notifies a manager and adds the account to the remediation queue, giving the manager visibility while ensuring no object falls through the cracks.

​
Creating an automation rule

1

Open the Rules editor

Navigate to Automation in the left navigation sidebar, then select Rules. Click New Rule in the top-right corner.
2

Name and describe the rule

Give the rule a clear, descriptive name — for example, Disable Inactive Guest Accounts or Alert on Permanent Global Admin Assignment. Add a description that explains the intent of the rule so other administrators understand its purpose when reviewing the rule list later.
3

Set the trigger

Choose a condition category from the dropdown:
  • Inactive Users — triggers on accounts with no sign-in activity beyond a configurable threshold
  • Guest Accounts — triggers on guest users who haven’t been reviewed or who have remained inactive
  • Privileged Access — triggers on permanent role assignments, role assignments outside PIM, or roles assigned to accounts missing MFA
  • MFA Compliance — triggers on accounts that haven’t registered MFA within a defined grace period after creation
After selecting a category, configure the specific thresholds (such as number of days) to match your organization’s policies.
4

Set the action

Choose what Nexus should do when the rule fires. You can select one or more actions: Disable Account, Send Notification, Create Access Review, or Add to Remediation Queue. Configure any action-specific settings, such as the notification recipient or the reviewer for auto-created access reviews.
5

Set the scope

Define which objects in your tenant the rule applies to:
  • All users — the rule evaluates every user account in the tenant
  • Specific groups — the rule evaluates only members of one or more named groups
  • Specific roles — the rule evaluates only users holding a particular directory role
Scoping rules narrowly reduces noise and lets you apply different thresholds to different populations — for example, enforcing a 30-day inactivity threshold for privileged users but a 90-day threshold for regular members.
6

Enable and save

Toggle the rule to Enabled and click Save. Nexus begins evaluating the rule on the next sync cycle. The rule status on the Rules list page changes to Active and the Last Evaluated timestamp updates after each sync.

​
Viewing rule activity

Every action taken by an automation rule is recorded in the Automation Log, accessible from Automation > Log in the left navigation. The log gives you a full audit trail of rule activity and is structured for easy filtering and export. Each log entry includes:
  • Rule name — the rule that fired
  • Timestamp — the exact date and time the action was taken
  • Matched object — the user, group, or service principal that triggered the rule, with a link to its detail panel
  • Action taken — what Nexus did in response (account disabled, notification sent, review created, etc.)
  • Outcome — whether the action completed successfully or encountered an error, with error details if applicable
If an automation rule is configured to Disable Account, the action takes effect immediately on the next sync cycle after the trigger condition is met. Make sure you have reviewed the rule scope carefully before enabling it in a production environment.
Use the Filter bar in the log to narrow entries by rule name, action type, date range, or outcome status. You can export the filtered log as a CSV for inclusion in audit reports or incident investigations.

​
Built-in policy templates

To help you get started quickly, Nexus ships with a library of pre-built automation rule templates for the most common governance scenarios. Templates are fully configured with sensible default thresholds and can be enabled with a single click — no manual configuration required.

Inactive Guest Cleanup

Automatically disables guest accounts that haven’t signed in within 30 days and haven’t been included in an access review. Fires a notification to the inviting user’s manager before disabling the account.

MFA Enforcement

Flags any account that has not registered an MFA method within 7 days of creation. Sends a reminder notification to the user and their manager, and adds the account to the remediation queue if registration is still missing after 14 days.

PIM Promotion Alerts

Detects when a directory role is assigned permanently (outside of PIM) and immediately notifies your security team. Optionally creates an access review scoped to the assignment for rapid certification.
To browse and enable templates, navigate to Automation > Templates. Each template shows a description, the default thresholds it uses, and the actions it will take. Click Enable on any template to activate it instantly, or click Customize to open it in the rule editor and adjust thresholds before enabling.
Start with the built-in templates to get immediate value, then customize thresholds to match your organization’s policies. Most teams find that enabling the MFA Enforcement and Inactive Guest Cleanup templates alone resolves a significant portion of the risk flags surfaced on the Identity Dashboard.