PowerShell · REST APIs · Passbolt · mTLS
EMS Mailbox Provisioning Automation
A colleague was creating EMS mailboxes one at a time and then manually saving each account's credentials in Passbolt. On high-volume days, a 30-account request could take roughly 150 minutes. I automated the end-to-end workflow so the same batch could be completed in about 2 minutes.
The bottleneck: repetitive work scaled badly
The original process had two manual steps for every account: create the mailbox in EMS, then save its credentials in Passbolt. Creating and recording one account took roughly five minutes. When the request reached 30 accounts, that translated to about 150 minutes of repetitive provisioning work.
The issue was not that either step was technically difficult. The problem was the amount of repeated input and context switching required when the volume increased.
meant approximately 150 minutes of manual work for a high-volume request.
The decision: automate both systems, not just mailbox creation
Automating EMS alone would still leave someone copying each generated credential into Passbolt. I treated mailbox creation and credential storage as one operational workflow so the automation would remove the repetitive handoff between the two systems.
The workflow: create, capture, store, summarize
The PowerShell script accepts either a single request or a batch count. It calls the EMS REST API to create each mailbox, captures the generated account details, and stores the credential through Passbolt CLI over the mTLS-protected connection.
Safety around bulk execution
Once the script supported batches, speed was not the only concern. A mistaken count could create many unwanted accounts quickly, so I added an explicit confirmation before bulk creation and a final execution summary showing what the run attempted and completed.
- Single-account and batch modes use the same provisioning path.
- Bulk runs require confirmation before account creation begins.
- The operator receives a summary after execution instead of checking each account individually.
The result: roughly 150 minutes became about 2
For the 30-account scenario, the manual process took approximately 150 minutes based on roughly five minutes per account. With the automated workflow, the batch could be completed in about two minutes, including mailbox creation and credential storage.
for a 30-account provisioning batch, while keeping Passbolt storage inside the same workflow.
The project is a practical example of how I approach internal automation: identify the repeated operational steps, automate the entire path rather than one isolated action, and add safeguards where faster execution increases the cost of a mistake.