Late to this thread, picking up on forum messages I'd missed. A few notes from the field on what's actually landed for customers over the last couple of months:
1. PSK rotation with scheduled distribution. SSIDs with shared passphrases (retail, healthcare guest networks) on a rotation cadence, with the new key posted to Teams or Webex for staff. Takes the helpdesk out of the loop.
2. Bulk firewall rule pushes by tag. Same outbound block across 50+ MX networks (a known-bad domain, a deprecated SaaS) is much cleaner via a tag-driven workflow than the dashboard UI. Audit trail is also tidier.
3. Pre-change config snapshot. Before a meaningful change window we trigger a workflow that pulls the relevant endpoints and stores a baseline. If anything regresses, rollback is a known-good JSON, not "let's diff screenshots in the change log."
4. New-site provisioning glue. Claim devices, bind to template, set address, notify the site lead. Not magic, but removes the click-fatigue when you're rolling out 200+ networks.
Where we've kept things outside Workflows: cross-org orchestration, signed audit trails for regulated customers, and full restore-from-backup parity. Workflows is genuinely good inside a single org, but multi-tenant ops still want a layer above the dashboard.
Curious what others are running. Especially interested if anyone has wired Workflows into the new EVPN-VXLAN cloud-managed fabric yet, since that's where we're spending design cycles next.
