Automation Actions in Senturo: A Complete Reference

Overview

Actions are the "Then Do" half of a Security Policy Automation: when the automation's trigger fires, Senturo carries out the actions you've added, for every device in scope. You can add a single action or chain several together — all of them run, in the order they are listed from top to bottom.

This reference describes every available action, grouped into the four categories you'll see in the automation builder: Security, Admin, Tracking, and MDM Integrations. For each action, you'll find what it does, any prerequisites, and platform considerations, so you can choose the right response for your policy.

For how to add actions while building an automation, see How to Create a Security Policy Automation. For a conceptual overview of automations, see Understanding Security Policy Automations.

How Actions Work

A few rules apply to every action:

All added actions run. If your automation has three actions, all three execute when the trigger fires.
Order matters. Actions run from top to bottom in the order listed in the Then Do section. Use the up and down arrows on an action to reorder it, or the ✕ to remove it. For example, placing Set Missing Mode above Senturo Lock switches the device to real-time tracking before it locks.
Actions apply to the devices in scope. Actions run against the devices in the automation's selected device groups — specifically, the devices meeting the trigger condition.
Some actions have prerequisites. MDM Integration actions require the corresponding integration to be connected, and some actions are supported only on certain platforms (noted per action below).

Security Actions

These actions directly protect the device and its data — the responses you'll typically reach for when a device is off-site, off-network, or at risk.

Senturo Lock

Locks the device using Senturo's lock screen, preventing use until it is unlocked. Use this when a device violates a boundary — for example, leaving an approved site — and you want to render it unusable immediately.

Senturo Unlock

Removes a Senturo lock from the device, restoring normal use. Use this in automations that reverse a restriction — for example, unlocking devices when they return inside a geofence during allowed hours.

Wipe Files on Device

Erases files on the device to protect sensitive data. This is a destructive action: wiped data cannot be recovered from the device. Reserve it for scenarios where data protection outweighs device usability, and pair it with notification actions so administrators know it ran.

Set Missing Mode

Switches the device's security status from Secure Mode to Missing Mode, escalating it to real-time location tracking (with automatic screenshot capture on Windows, macOS, and ChromeOS). Use this as the first action in loss or theft scenarios so the device is already reporting intensively before any other action runs.

Admin Actions

These actions handle communication and fleet organization — notifying people and updating how the device is categorized in Senturo.

Send Broadcast

Sends a broadcast message to the device. Use it to display instructions or warnings — for example, telling a user their device has left an approved area. Broadcast messages are supported on all platforms.

Send Email to Administrator

Sends an email notification to an administrator when the automation fires. Add this to any automation where a person should know the trigger occurred — especially destructive or high-impact automations.

Add Device to Group

Adds the triggering device to a device group you specify. Useful for corralling devices that meet a condition — for example, adding devices that left an approved site to an "Out of Bounds" group for follow-up.

Remove Device from Group

Removes the triggering device from a device group you specify. The counterpart to Add Device to Group — for example, removing a device from a restricted group once it checks back in.

Add Tag to Device

Applies a tag to the triggering device. Tags are flexible labels, so this is a lightweight way to mark devices that met a condition without changing their group membership.

Remove Tag from Device

Removes a tag from the triggering device — typically used to clear a marker applied by another automation once the condition is resolved.

Add Note to Device

Adds a note to the device's record. Use it to leave an audit-friendly annotation — for example, recording that the device triggered a geofence violation and when.

Tracking Actions

These actions collect information from the device at the moment the trigger fires — useful both for recovery and for building an evidence trail.

Pull Current Location

Requests the device's current location immediately, rather than waiting for the next scheduled update. Use it to get a fresh fix the moment a condition is met.

Take Screenshots

Captures screenshots from the device. Valuable in recovery scenarios to see what the device is being used for. Screenshot capture is supported on Windows, macOS, and ChromeOS; it is not available on iOS/iPadOS or Android.

Pull Current Network Data

Retrieves the device's current network information, such as its connection details. Useful alongside IP Fencing triggers to record which network a device was on when the automation fired.

MDM Integration Actions

These actions execute through your connected MDM platform rather than the Senturo agent. Each requires the corresponding integration — Jamf Pro, Microsoft Intune, Cisco Meraki, or Google Admin Console — to be connected in Senturo with the necessary permissions, and applies to devices managed by that platform.

Jamf Lock

Locks the device through your Jamf Pro integration. Applies to Apple devices managed in Jamf Pro.

Jamf Lost Mode

Places the device into MDM Lost Mode through Jamf Pro, enabling the lost-device behaviors managed by your MDM. Applies to Apple devices managed in Jamf Pro.

Microsoft Intune Lock

Locks the device through your Microsoft Intune integration. Applies to mobile devices managed in Microsoft Intune.

Meraki Lock

Locks the device through your Cisco Meraki integration. Applies to devices managed in Cisco Meraki.

Meraki Wipe

Wipes the device through your Cisco Meraki integration. This is a destructive action — use it deliberately and pair it with a notification action.

Google Disable

Disables the device through your Google Admin Console integration, preventing it from being used until it is re-enabled. Applies to devices managed in Google Admin Console.

Choosing and Combining Actions

Because all actions run in order, you can compose a complete response in a single automation. Common patterns:

Device leaves an approved site: Set Missing Mode → Senturo Lock → Send Email to Administrator. The device escalates to real-time tracking, locks, and IT is notified.
Device returns during approved hours: Senturo Unlock → Remove Tag from Device. The restriction lifts and the marker applied on the way out is cleared.
Unapproved network detected: Pull Current Network Data → Pull Current Location → Add Note to Device → Send Email to Administrator. Evidence is collected and recorded before anyone intervenes.

Sequence deliberately: put tracking or escalation actions (like Set Missing Mode or Pull Current Location) before restrictive ones (like locks), and put notification actions where they'll report on everything that ran before them.

Troubleshooting

An MDM Integration action is unavailable or fails to run. These actions require the corresponding integration (Jamf Pro, Microsoft Intune, Cisco Meraki, or Google Admin Console) to be connected with the necessary permissions, and the target device must be managed by that platform. Confirm the integration's status in your Senturo dashboard.

An action didn't apply to some devices. Check platform support: Take Screenshots for example are not available on iOS/iPadOS or Android, and MDM actions only apply to devices managed by that MDM. Devices on unsupported platforms skip the action.

Actions ran in an unexpected order. Actions execute top to bottom as listed in the Then Do section. Reorder them with the up and down arrows.

A destructive action ran and no one was notified. Notification isn't automatic. Add Send Email to Administrator to any automation that includes Wipe Files on Device, Meraki Wipe, Google Disable, or other high-impact actions.

Conclusion

The action library gives you twenty building blocks across four categories: direct security responses, administrative communication and organization, on-demand tracking, and MDM-executed commands. Because every action in an automation runs, in the order you set, you can assemble a precise, complete response to any trigger — from a gentle broadcast to a full lock-track-and-notify sequence.

FAQs

Q: How many actions can I add to one automation? A: You can add multiple actions, and all of them run when the trigger fires, in the order listed from top to bottom.

Q: Do all actions work on every platform? A: No. Take Screenshots are supported on Windows, macOS, and ChromeOS but not on iOS/iPadOS or Android, and MDM Integration actions apply only to devices managed by the connected MDM. Devices on unsupported platforms skip the action.

Q: What's the difference between Senturo Lock and the MDM lock actions? A: Senturo Lock locks the device through the Senturo agent. Jamf Lock, Microsoft Intune Lock, and Meraki Lock send the lock command through your connected MDM platform instead. Use the MDM variants when you want the lock enforced at the MDM level for devices managed there.

Q: Is Wipe Files on Device reversible? A: No. Wiped data cannot be recovered from the device. Treat it as last-resort actions, and pair them with Send Email to Administrator so the action is visible.

Q: Can one automation mix categories — for example, a Security action and an Admin action? A: Yes. Actions from any categories can be combined in a single automation and run together in the order you set.