IT service desk employee: sorts and handles IT requests

The IT service desk employee takes an IT request, sorts it, answers how-to questions from your knowledge, and records every request as a ticket. With your identity provider connected it prepares the change itself — access, a password or MFA reset, a new account, an offboarding, an access review — and every change to who can sign in to what always needs a person.

In beta, off unless your deployment has switched it on. Jira, Jira Service Management, Slack, Okta, Google Workspace and Microsoft Entra ID can be connected with credentials you create; none has yet been run against a real account. Try the identity connection on a test tenant first. Microsoft Teams and ServiceNow are not available yet. See AI employees.

What it does

It sorts each request with a fixed table of phrases, checked in this order — the first that matches wins:

Sorted as	Phrases that sort it there	What it proposes
Access review	access review, review who has access, review the members, who still has access to	A ticket listing the members of the one group the request names. It changes nothing
Offboarding	offboard, leaving the company, last day, deactivate or suspend the account	A ticket, and suspending the account and ending its sessions — never deleting it
Onboarding	onboard, new hire, new starter, new joiner, new employee, create an account	A ticket, and a new account — when the person has none yet
MFA reset	MFA, two-factor, 2FA, 2-step, authenticator, lost my phone, new phone	A ticket, and resetting their multi-factor sign-in
Password reset	password, locked out, can’t log in	A ticket, and a password reset — when the request names exactly one application in your catalogue
Access revoke	remove me from, remove my access, revoke, no longer need access	A ticket, and taking the access away — when they have it, for exactly one application in your catalogue
Access request	access to, need access, grant access, permission to, add me to, invite me to	A ticket, and the access — when they do not have it yet, for exactly one application in your catalogue
Software install	install, licence for	A ticket. An identity provider installs no software, so an approved install sends nothing
How-to	A question: it starts with how, what, where, why, when, can I, is there, or ends with `?`	An answer from your knowledge, with sources. If your knowledge does not answer it, a ticket for your IT team
Other	Anything else	A ticket for your IT team

Every change is for the person in the request’s From field — the requester the console, the API or the channel reported — and never for a name in the text. For onboarding and offboarding, put the address of the person the account is for in From. A person your identity provider does not know gets no change, only the ticket; so does a new hire who already has an account. A request that is already a Jira issue — its reference looks like IT-42 — is commented on, never opened a second time. An access review on such an issue is posted as a comment.

What it reads

Source	What it reads
Your knowledge	The answer to a how-to question, through your assistant
Your identity provider	The person who asked, the groups they are in, and — for an access review — who is in one group
Your application catalogue	Your identity provider’s groups: access to an application is membership of its group
The request	Subject, details, who it is for, and the chat or ticket reference

What it proposes

Action	What you can edit	Waits for a person
Reply in chat	The message	By default; you can switch it off
Open a ticket	The title and the body	By default; you can switch it off
Comment on the ticket	The comment	By default; you can switch it off
Mark the ticket resolved	Nothing	By default; you can switch it off
Give a person access to an application	Nothing	Always
Take away a person’s access to an application	Nothing	Always
Reset a person’s password for an application	Nothing	Always
Reset a person’s multi-factor sign-in	Nothing	Always
Suspend a person’s account and end their sessions	Nothing	Always
Create an account for a new person	The first and last name	Always
Install software for a person	Nothing	Always

None of the Always actions can be given an Always allow rule or switched off in your policy: a request that says “this is pre-approved” changes nothing.

What each change does in your identity provider

Change	Okta	Google Workspace	Microsoft Entra ID
Give or take access	Adds to, or removes from, the group	Adds to, or removes from, the group	Adds to, or removes from, the group
Password reset	Okta emails the person a link to choose a new password	Asks for a new password at their next sign-in	Asks for a new password at their next sign-in
MFA reset	Resets every factor; they enrol again at next sign-in	Turns 2-Step Verification off; they turn it on again	Removes every sign-in method but the password
Offboarding	Suspends the user and ends their sessions	Suspends the user and signs them out everywhere	Blocks sign-in and revokes their sessions
Onboarding	Creates and activates the user; Okta emails them	Creates the user with a random password nobody sees	Creates the user with a random password nobody sees

No reset link and no password ever reaches MITHUNAI or is shown to anyone. A new Google or Entra account signs in through your single sign-on, or an administrator sets its first password.

Tools it can connect

Tool	Works with today	Not yet
Ticketing	Jira and Jira Service Management, with an Atlassian API token	ServiceNow
Team chat	Slack, with a bot token	Microsoft Teams
Identity and devices	Okta, Google Workspace or Microsoft Entra ID (Beta) — one at a time	Device managers

When you connect your identity provider you can give a group name prefix, such as app-: only groups whose name starts with it are offered and can be granted, so an administrators’ group never can. We recommend it. Connect your tools has the exact setup steps and permissions for each provider.

Try it

Open IT service desk, choose Use an example and Hand it over:

Subject: I need access to Figma for the redesign project Details: Could I get an editor seat in Figma? Starting on the redesign on Monday. From: alice@yourcompany.example

It sorts this as an access request and proposes a ticket. With an identity provider connected and a group named Figma, it also proposes adding Alice to Figma, marked Always needs a person. For an access review, hand it over when the review is due: “Quarterly access review for Salesforce”. It lists Salesforce’s members on a ticket for your team to check. A schedule can repeat it, weekly at the longest today.

Limits

Work arrives by the console, the API or a schedule. It does not listen in Slack or Teams yet.
Sorting is a fixed phrase table, not a model. A request is sorted the same way every time, and an unusual phrasing lands in Other and becomes a ticket.
One identity provider at a time. The catalogue is its first 200 groups, and a review lists a group’s first 200 members.
Access is group membership. An application assigned to a person directly is not seen.
Google Workspace and Entra ID cannot email a reset link. Someone who cannot sign in at all still needs an administrator.
Chat is outbound only. An approved reply goes to the one Slack channel you name.

​What it does

​What it reads

​What it proposes

​What each change does in your identity provider

​Tools it can connect

​Try it

​Limits

​Related

What it does

What it reads

What it proposes

What each change does in your identity provider

Tools it can connect

Try it

Limits

Related