It wouldn’t be automated, but you could also have a console dashboard that could be used to trigger deployments if the right conditions are met with dynamic content but it would have the advantage of using a user’s existing console session, no need to embed creds anywhere.
You can tell if a computer is new based upon minima of subscribe times of sites and tag systems after they have completed initial provisioning.