> ## Documentation Index > Fetch the complete documentation index at: https://docs.mithunai.com/llms.txt > Use this file to discover all available pages before exploring further. # IT service desk employee: sorts and handles IT requests > The IT service desk AI employee answers IT questions and prepares access, password, MFA and onboarding changes in Okta, Google Workspace or Entra ID. The **IT service desk** employee takes an IT request, sorts it, answers how-to questions from your knowledge, and records every request as a ticket. With your identity provider connected it prepares the change itself -- access, a password or MFA reset, a new account, an offboarding, an access review -- and **every change to who can sign in to what always needs a person**. > [!WARNING] > > In **beta**, off unless your deployment has switched it on. Jira, Jira Service Management, Slack, > Okta, Google Workspace and Microsoft Entra ID can be connected with credentials you create; **none > has yet been run against a real account**. Try the identity connection on a test tenant first. > Microsoft Teams and ServiceNow are not available yet. See [AI employees](https://docs.mithunai.com/team/overview.md). ## What it does It sorts each request with a fixed table of phrases, checked in this order -- the first that matches wins: | Sorted as | Phrases that sort it there | What it proposes | | - | - | - | | **Access review** | access review, review who has access, review the members, who still has access to | A ticket listing the members of the one group the request names. It changes nothing | | **Offboarding** | offboard, leaving the company, last day, deactivate or suspend the account | A ticket, and suspending the account and ending its sessions -- never deleting it | | **Onboarding** | onboard, new hire, new starter, new joiner, new employee, create an account | A ticket, and a new account -- when the person has none yet | | **MFA reset** | MFA, two-factor, 2FA, 2-step, authenticator, lost my phone, new phone | A ticket, and resetting their multi-factor sign-in | | **Password reset** | password, locked out, can't log in | A ticket, and a password reset -- when the request names exactly one application in your catalogue | | **Access revoke** | remove me from, remove my access, revoke, no longer need access | A ticket, and taking the access away -- when they have it, for exactly one application in your catalogue | | **Access request** | access to, need access, grant access, permission to, add me to, invite me to | A ticket, and the access -- when they do not have it yet, for exactly one application in your catalogue | | **Software install** | install, licence for | A ticket. An identity provider installs no software, so an approved install sends nothing | | **How-to** | A question: it starts with how, what, where, why, when, can I, is there, or ends with `?` | An answer from your knowledge, with sources. If your knowledge does not answer it, a ticket for your IT team | | **Other** | Anything else | A ticket for your IT team | **Every change is for the person in the request's *From* field** -- the requester the console, the API or the channel reported -- and never for a name in the text. For onboarding and offboarding, put the address of the person the account is for in *From*. A person your identity provider does not know gets no change, only the ticket; so does a new hire who already has an account. **A request that is already a Jira issue** -- its reference looks like `IT-42` -- is commented on, never opened a second time. An access review on such an issue is posted as a comment. ## What it reads | Source | What it reads | | - | - | | Your knowledge | The answer to a how-to question, through your assistant | | Your identity provider | The person who asked, the groups they are in, and -- for an access review -- who is in one group | | Your application catalogue | Your identity provider's groups: access to an application is membership of its group | | The request | Subject, details, who it is for, and the chat or ticket reference | ## What it proposes | Action | What you can edit | Waits for a person | | - | - | - | | **Reply in chat** | The message | By default; you can switch it off | | **Open a ticket** | The title and the body | By default; you can switch it off | | **Comment on the ticket** | The comment | By default; you can switch it off | | **Mark the ticket resolved** | Nothing | By default; you can switch it off | | **Give a person access to an application** | Nothing | **Always** | | **Take away a person's access to an application** | Nothing | **Always** | | **Reset a person's password for an application** | Nothing | **Always** | | **Reset a person's multi-factor sign-in** | Nothing | **Always** | | **Suspend a person's account and end their sessions** | Nothing | **Always** | | **Create an account for a new person** | The first and last name | **Always** | | **Install software for a person** | Nothing | **Always** | None of the **Always** actions can be given an *Always allow* rule or switched off in your policy: a request that says "this is pre-approved" changes nothing. ### What each change does in your identity provider | Change | Okta | Google Workspace | Microsoft Entra ID | | - | - | - | - | | Give or take access | Adds to, or removes from, the group | Adds to, or removes from, the group | Adds to, or removes from, the group | | Password reset | Okta emails the person a link to choose a new password | Asks for a new password at their next sign-in | Asks for a new password at their next sign-in | | MFA reset | Resets every factor; they enrol again at next sign-in | Turns 2-Step Verification off; they turn it on again | Removes every sign-in method but the password | | Offboarding | Suspends the user and ends their sessions | Suspends the user and signs them out everywhere | Blocks sign-in and revokes their sessions | | Onboarding | Creates and activates the user; Okta emails them | Creates the user with a random password nobody sees | Creates the user with a random password nobody sees | No reset link and no password ever reaches MITHUNAI or is shown to anyone. A new Google or Entra account signs in through your single sign-on, or an administrator sets its first password. ## Tools it can connect | Tool | Works with today | Not yet | | - | - | - | | Ticketing | **Jira** and **Jira Service Management**, with an Atlassian API token | ServiceNow | | Team chat | **Slack**, with a bot token | Microsoft Teams | | Identity and devices | **Okta**, **Google Workspace** or **Microsoft Entra ID** (Beta) -- one at a time | Device managers | When you connect your identity provider you can give a **group name prefix**, such as `app-`: only groups whose name starts with it are offered and can be granted, so an administrators' group never can. We recommend it. [Connect your tools](https://docs.mithunai.com/team/connect-your-tools.md#okta-it-service-desk) has the exact setup steps and permissions for each provider. ## Try it Open **IT service desk**, choose **Use an example** and **Hand it over**: > **Subject:** I need access to Figma for the redesign project > > **Details:** Could I get an editor seat in Figma? Starting on the redesign on Monday. > > **From:** [alice@yourcompany.example](mailto:alice@yourcompany.example) It sorts this as an access request and proposes a ticket. With an identity provider connected and a group named Figma, it also proposes adding Alice to Figma, marked **Always needs a person**. For an access review, hand it over when the review is due: *"Quarterly access review for Salesforce"*. It lists Salesforce's members on a ticket for your team to check. A schedule can repeat it, weekly at the longest today. ## Limits * **Work arrives by the console, the API or a schedule.** It does not listen in Slack or Teams yet. * **Sorting is a fixed phrase table, not a model.** A request is sorted the same way every time, and an unusual phrasing lands in **Other** and becomes a ticket. * **One identity provider at a time.** The catalogue is its first 200 groups, and a review lists a group's first 200 members. * **Access is group membership.** An application assigned to a person directly is not seen. * **Google Workspace and Entra ID cannot email a reset link.** Someone who cannot sign in at all still needs an administrator. * **Chat is outbound only.** An approved reply goes to the one Slack channel you name. ## Related * [Approvals](https://docs.mithunai.com/team/approvals.md) * [Approval policy](https://docs.mithunai.com/team/approval-policy.md) * [Connect your tools](https://docs.mithunai.com/team/connect-your-tools.md) * [Schedules and the daily summary](https://docs.mithunai.com/team/schedules-and-daily-summary.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.