# Chase Bitwarden two-factor gaps and unaccepted invites

> Every Monday, find the people who never turned on two-factor or never accepted their invite, message them in Slack, and track both numbers.

- Workflow type: code
- Services: Bitwarden, Slack Bot, Google Sheets
- Categories: Operations
- Published: 2026-08-04

## What it does

- Pulls your full Bitwarden member list every Monday morning and sorts it into two groups: people who still have two-factor turned off, and people who were invited but never accepted.
- Sends each person a short, friendly Slack direct message. Anyone who falls into both groups gets a single message instead of two.
- Posts one summary to your IT channel with the week's counts, including anyone who has no matching Slack account so they can be chased another way.
- Adds one dated row to a Google Sheet each week so you can watch both numbers trend down over time.

## What you'll need

- A Bitwarden Teams or Enterprise organization, plus owner access to create an organization API key.
- A Slack workspace where the bot is allowed to see member email addresses and send direct messages.
- A Google Sheets file to use as the tracker, with a header row for the date and the weekly counts.
- The name of the Slack channel your IT or security team actually watches.

## Prompt

On a cron trigger every Monday at 9am, run a Bitwarden compliance check on my organization and nudge the people who are keeping us out of compliance.

Start with the Bitwarden List Members operation to pull the full organization roster. Each member record already carries everything I need, so no per-member lookups are required. Split the roster into two cohorts: members whose two-factor authentication flag is false, and members whose status is 0, which is the Invited state, meaning they were sent an invitation but never accepted it. Member status is an integer enum, so filter on the number 0 and not on a string like "Invited".

Next, resolve each person to a Slack account using the slackbot List Users operation. Pull the workspace roster once and build an email to Slack user ID map, then match Bitwarden member emails against it case-insensitively. Do not call a lookup once per person; one roster pull and a local match is cheaper and avoids rate limits.

Send the direct messages with the Send a Message operation on the slackbot service, not the slack service. Use two templates: one that reminds people to turn on two-factor authentication, and a separate one that asks people with an unaccepted invitation to accept it. Important: a member can appear in both cohorts. Send exactly one direct message per person. If someone is in both cohorts, send a single message that covers both asks rather than two separate messages.

Keep the direct message copy friendly, short, and low pressure, since this fires every single week and should not read like an escalation.

If a Bitwarden member has no matching Slack account, skip that person instead of failing the run. Collect them in a list of unmatched people and keep going.

Once the direct messages are out, post a single count summary to our IT channel using Send a Message. One message only, containing how many members still have two-factor disabled, how many invitations are still unaccepted, how many direct messages were sent, and the names and emails of anyone who could not be matched to a Slack account, so nobody silently escapes the nudge.

Finally, append one dated row to a Google Sheets tracker using the Append Values operation. The row is a fixed shape: run date, count of members with two-factor disabled, count of unaccepted invitations, number of direct messages sent, and number of unmatched people. One row per run, appended below the existing rows, so we can watch both numbers trend down week over week.

## How to customize

- Change the day and time. Monday at 9am is a starting point, but some teams prefer Friday afternoons or the first of the month.
- Rewrite the two message templates in your own tone, or add a deadline for when two-factor becomes mandatory.
- Point the summary at a different channel, or drop the spreadsheet step if the Slack recap is enough on its own.

## FAQ

### Will someone get two messages if they have both problems?

No. Anyone who has two-factor turned off and an unaccepted invite receives a single direct message covering both, so nobody feels spammed.

### What happens if a Bitwarden member is not in our Slack workspace?

They are skipped instead of breaking the run, and their name shows up in the IT channel summary so you can follow up with them by email.

### Does this work on the free Bitwarden plan?

No. Reading your member list requires a Teams or Enterprise organization, because that is where the organization API key lives.

### Can I run it more or less often than weekly?

Yes, the schedule is just a setting. Weekly tends to be enough pressure to move people without turning into background noise.

### Will it change anything in my Bitwarden organization?

No. It only reads the member list. It never removes people, resends invitations, or edits settings, so it is safe to run on a live organization.

Use this prompt in General Input: https://www.generalinput.com/prompts/chase-bitwarden-two-factor-gaps-and-unaccepted-invites