> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://support.atomicwork.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://support.atomicwork.com/_mcp/server.

# Provisioning access with custom workflows

> Use a Custom action entitlement and a request workflow to provision access in any app, with any steps you need.

Not every app has an Okta or Entra group behind it. With a **Custom action** entitlement, an access request becomes a service request, and a workflow you build picks it up and does the provisioning. Call an API, run a third-party action, ask an AI coworker, notify the app owner. You decide the steps.

## How it works

1. You add an entitlement to an application and set its provisioning method to **Custom action**.
2. Atomicwork creates a service form for that entitlement. It's listed under the **Access Management** service category as **\<Application> - \<Entitlement>**, for example **Figma - Figma Editor**.
3. When an employee's access request for the entitlement is approved, Atom raises a service request for that form in the workspace you picked on the entitlement.
4. A request workflow in that workspace triggers on **Request is created** with that **Service form** and **Service category**, and runs your provisioning steps.

## Before you begin

* You need permission to manage applications (**Settings → Access management → Applications**) and to create workflows in the target workspace.
* The **AccessOps Manager** coworker must be published so Atom can take access requests. See [Setting up agentic access provisioning](/documentation/identity-access-management/access-management/setting-up-agentic-access-provisioning).

## Step 1: Create a Custom action entitlement

1. Go to **Settings → Applications**, open the application (or click **Add** to create it), and open the **Entitlements** tab.
2. Click **Add**. Give the entitlement a name and description, for example **Figma Editor**, "Edit access to Figma design files". Click **Next**.
3. Under **Provisioning action**, set **Method** to **Custom action** ("Grant access through a custom workflow or manual agent action").

![Provisioning method set to Custom action](/_fern-files/_img/e96f3733be9a9578cd058fbc6c6e58aebd9e90e12351646467f171821231c536.webp)

4. Pick the **Workspace** where the service request should be created. Your workflow has to live in this workspace.
5. Leave **De-provisioning action is same as the provisioning action** checked, or clear it to set a separate revoke method.
6. Optional: under **Collect information**, click **Add a question** for anything your workflow needs from the requester, such as a team name or a license tier. The answers arrive on the request, so your workflow can read them.
7. Click **Save**.

![Custom action entitlement with the It Support workspace selected](/_fern-files/_img/4aec2cf044037c01132abdddd2eea825c99f3e92652a205f33c224511a1dba52.webp)

## Step 2: Add the entitlement to a published access policy

The entitlement's service form only appears in workflow filters once a **published** access policy includes it.

1. On the application, open **Access policies** and click **Add**.
2. Pick the **Audience** (segment) and approvals. Click **Next**.
3. Select the Custom action entitlement. Click **Next**.
4. Choose **Just-in-time** or **Permanent** access, then click **Publish**.

![Access policy with the Figma Editor entitlement selected](/_fern-files/_img/72d90ebe24449ffd1f12d66cbaba9fbcb300bd6bae6d154807de3119fd026463.webp)

## Step 3: Build the provisioning workflow

1. Go to **Automations → Event-based**, pick **Request** and the workspace you selected on the entitlement, then click **New**. Describe the workflow to AI Assist, or start from a draft and edit it in the **Builder**.
2. Open the trigger and set:
   * **Events**: **Request is created**
   * **Filters**:
     * **Service form** is **\<Application> - \<Entitlement>** (search for the app name; the form sits under **Access Management**)
     * **Service category** is **Access Management**

![Picking the entitlement's service form in the trigger filter](/_fern-files/_img/87f540aa4212b88c4604f925bc187bdf80c9d87d856b4175afeac088d254eb99.webp)

![Trigger filtered on the Figma Editor service form and the Access Management category](/_fern-files/_img/c4de4b851be738d87dd3659dd7255c93dae0fe75c105e70e01554a5b94877430.webp)

3. Add the steps that provision access. Some examples:
   * Call the app's API or a [third-party action](/documentation/enterprise-workflows/actions-and-integrations/third-party-actions-in-workflows) to create the account or add the user to a group.
   * Use form answers from **Collect information** in the call.
   * Add a note on the request with what was done.
   * Set the request to **Resolved** once provisioning succeeds, or assign it to an agent when it fails.
4. Click **Publish**.

![Published workflow: add a provisioning note, then resolve the request](/_fern-files/_img/77e27c5027a6fa86ac16f9fc5b5b4f663ba7802d570d84521ffa6768ac8ebd88.webp)

The example above adds a private note ("Provisioning Figma Editor access for the requester") and then resolves the request. In a real setup, put your provisioning call between those two steps.

## Step 4: Test it

1. As a user in the policy's audience, ask Atom for the entitlement, for example "I need Figma Editor access".
2. Once the request is approved, Atom raises a service request for **Figma - Figma Editor** in your workspace.
3. Open the workflow's **Overview** tab and check **Run logs** for a successful run, then open the request to see your workflow's notes and status changes.

## Tips

* **One workflow per entitlement** keeps provisioning logic easy to follow. To share logic, add several service forms to the same **Service form** filter.
* **Revoking access**: if you set a separate Custom action for de-provisioning, add a matching workflow for revoke requests.
* **Can't find the service form in the filter?** Check that the entitlement is in a published access policy and that you're building the workflow in the workspace selected on the entitlement.