You mention vfilers and vservers together. Do you mean 7-mode or Clustered-mode?
For both 7 and Clustered modes you can use the vFiler0 or Storage Controller's credentials to manage a vFiler/Vserver.
When you create a workflow, use the Repeat loop (hover mouse over the left side of a row and you get a drop down with Repeat Row in it). Within the repeat row, use a Finder that searches for every vFiler or Vserver (depending on mode) to run the command on.
Depending on what you want to do, create a local user? update local user? the customer would need to create a command to perform the action itself, as there are no built-in user modification commands. Use the Powershell SDK help for information on calling the commands, and if there are problems or the commands don't work with vfilers as some don't, you can use "Invoke-NaSSH" or "Invoke-NcSSH" to run a command as if it were typed in. ie. "vfiler run myvfiler useradmin user add xxx -g yyy" etc.
Take a look a in-built commands to get an idea on how to create them.
For users you should be able to do something like this:
<<declare parameters for $array, $VfilerName, $user, $password, $group here>>
Invoke-NaSSH 'vfiler run ' + $VfilerName + " useradmin user modify " + $user + " -g " + $group
Note that the New-NaUser cannot set groups within Vfilers, only vfiler0, so in the above setting the group is split out, and New-NaUser is used to set the users password. It does not require vfiler credentials to connect.
Hope that's useful!
Re: workflow to traverse all vservers in a cdot environment