IT playbook · AI Employee: Ivy

Asset / Inventory Sync

Asset ledger accuracy > 98%

Install this playbookBack to marketplace
The problem

Asset inventory is stale from the moment it's exported. IT spreadsheets say 847 laptops; MDM shows 902 devices enrolled; finance depreciates 780; procurement has 39 in-transit. Every quarter someone builds a reconciliation view by hand, argues with everyone about which system is right, and closes the ticket. Ghost devices linger in Jamf, decommissioned assets stay on the books, and the actual truth requires a physical count.

At a glance
Trigger
Cron (weekly)
Approvals
None (report-only; writes flagged for review)
What it does
Writes to your systems
Systems
Jamf · Intune · Asset DB
How it feels in production

An hour-by-hour walkthrough.

Every night, Ivy pulls the full asset inventory from every source of truth: Jamf / Intune / Kandji (managed devices), Okta (identity-attached devices), Kolide / Fleet (agent-reported), the procurement system (in-transit + on-order), finance's fixed-asset ledger, the RMA queue, and the physical asset-tag database. For each asset, Ivy resolves identity across sources — same serial number, same MAC address, same last-user — and builds one canonical asset record. Then it looks for discrepancies: - Device in MDM, missing from finance ledger: procurement date missing, needs finance-team addition. - Device in finance, missing from MDM: unenrolled, lost, wiped-and-abandoned, or actually not-in-service. - Device with no user check-in for 90+ days: potential ghost — Ivy pings the last-known-user before flagging as abandoned. - Serial number appearing in two locations (different Jamf + Intune records): duplicate that needs consolidation. - Asset assigned to an offboarded employee: retrieval-ticket owed. Each discrepancy routes to an owner with the action needed. Weekly IT-ops digest surfaces trends: net devices added / removed, ghost-devices identified + recovered, reconciliation completeness across sources. Finance runs quarterly depreciation from a ledger they trust rather than from a spreadsheet that took a week to build.
How it works

Step by step.

  1. 01

    Nightly pull from every source of truth

    MDM (Jamf / Intune / Kandji), identity (Okta / Entra), agent tools (Kolide / Fleet), procurement, finance ledger, RMA queue, physical-tag DB. Normalise to a common asset record.

    Jamf · Intune · Kandji · Okta · Kolide · Fleet · Procurement · Finance
  2. 02

    Cross-source identity resolution

    Match by serial, MAC, hostname, last-user, procurement-order line. Handle known aliases (device re-imaged with new hostname, warranty-swap keeping serial). Build one canonical record with per-source presence.

    Reconciliation engine · Asset registry
  3. 03

    Detect + classify discrepancies

    Missing-in-source, duplicate, ghost, abandoned, off-boarded-holder. Each class has a defined owner and remediation path. Not-actionable discrepancies (freshly ordered, in transit) filter to the wait queue.

    Discrepancy rules · Owner registry
  4. 04

    Route to owner + track resolution

    Ghost devices → last-known user for check-in. Off-boarded holders → HR retrieval ticket. Missing-from-finance → finance addition workflow. Duplicates → IT-ops merge. All tracked to closure.

    Slack · Teams · Ticketing · Finance workflow
  5. 05

    Rollup + finance-ready reporting

    Weekly IT-ops digest: net movement, ghost recovery, reconciliation completeness. Quarterly finance snapshot: authoritative asset count + depreciation base. Auditor-ready evidence for asset controls.

    Analytics · Slack digest · Finance ledger export
Systems and wiring

What you connect to make this run.

Jamf · Intune · Kandji · Workspace ONE

read+write

Read canonical MDM inventory + last-check-in. Write: unenrol ghost devices after user-confirmation timeout, merge duplicate records with the correct one flagged as canonical.

Okta · Google Workspace · Microsoft Entra

read

Identity-attached device lists — the Trusted-Device population from an identity plane view. Cross-check against MDM to catch identity-known devices not managed.

Coupa · Ramp · Procurement

read

In-transit + on-order devices to prevent false-negative discrepancies. A laptop ordered last Friday shouldn't appear as missing today.

NetSuite · Sage · Finance ledger

read+write

Fixed-asset ledger for depreciation. Write additions from procurement, removals from decommission, revaluation adjustments per asset lifecycle events. Finance signs off on quarterly reconciliation.

What changes

Before and after, honestly.

Time from procurement to finance ledger inclusion
Before
30-90 days
After
1-3 days
Ghost devices in MDM (no user, no check-in)
Before
8-20% of fleet
After
Under 2%
Reconciliation cycle time
Before
1-2 weeks per quarter
After
Under 1 hour (already reconciled)
Audit findings on asset controls
Before
3-8 per audit
After
Zero at steady state
Related

Playbooks that pair with this one.

IT

License Reclamation

Reclaimed licences from ghost devices feed the license-recovery flow.

IT

Proactive Device Health

Health telemetry is a signal within the inventory reconciliation.

HR

Employee Offboarding

Assets assigned to offboarding employees route to retrieval on cascade.

Frequently asked

Answers about this playbook.

What if we have devices not enrolled in any MDM (BYOD, contractor)?

Unenrolled devices are policy-flagged for enrollment or exclusion. The registry tracks the exclusion reason and the ownership. Full visibility requires enrolment; the registry never claims coverage of what it can't see.

How does it handle physical asset tags (barcode / RFID)?

Physical-tag scan events feed the registry. A scanned tag with no digital-presence match flags for manual reconciliation — usually a device that lost MDM enrollment or was decommissioned without asset removal.

What about lab / test / seasonal devices?

Registry supports device-class tags (lab, seasonal, kiosk). Class-specific rules govern discrepancy handling; a lab device without a user assignment isn't a ghost.

How is decommissioning handled?

Formal decommission event: MDM unenrol, identity removal, finance write-off, physical disposal record with attesting party. Registry tracks each step; audit-trail complete before the record is archived.

Can we use this for non-device assets (monitors, hardware peripherals)?

Yes — asset-class extensible. Monitors, docks, keyboards can be tracked via physical tags and issued-to records. Same reconciliation across procurement + finance + physical-tag scan.

See it run on your data.

Free plan, no credit card. Connect the systems this playbook needs and run it against a past event first.

Book a demoMore IT playbooks