Automate·Advanced·60 min·Updated Sep 30, 2026

Deploy a Tier-1 IT triage agent

Stand up a Copilot Studio agent that opens and categorizes IT tickets, runs first-line diagnostics, and resets passwords through Entra without a technician.

Download PDF

Microsoft 365

Works With

Prerequisites

Admin access to configure Entra ID self-service actionsA documented library of common fixes for the top recurring ticket types

Business Outcome

Fewer routine tickets reaching Tier-1 technicians, freeing them for issues that actually need a person.

Handle with care

Identity/credential actions

This agent can reset a user's password through Entra — a real identity action, not just information retrieval. Make sure its identity-verification step is solid before granting this capability; a password reset triggered by a successfully-impersonated request is a real account-takeover path.

Workflow Overview

The apps run in this order.

Teams
SharePoint
Copilot Studio

Step 1: Scope the agent to your top ticket categoriesSharePoint

Export your last quarter of ticket data into Excel and pivot by category to rank them by volume, then separately flag which of the top categories are genuinely low-risk to automate (password resets, standard access requests) versus ones that only look routine but carry real consequences if mishandled.

Launch with just that low-risk, high-volume intersection — not every ticket type at once.

Step 2: Build the triage and diagnostics logicCopilot Studio

In Copilot Studio, build the agent with your KB articles as grounding sources, and configure it to ask clarifying questions before acting — device name, error message, last known working state — rather than guessing at a fix.

Step 3: Connect the Entra ID self-service actionCopilot Studio

Wire up the password-reset connector so the agent can trigger it directly for verified users, with multi-factor verification enforced before any reset executes.

Prompt idea:

A user reports they can't sign in to Outlook and get an "account locked" error. Walk them through verifying their identity, then reset their password through the standard self-service flow and confirm the reset succeeded.

Step 4: Set the escalation boundaryTeams

Define exactly what gets escalated to a human technician — anything outside the scoped categories, any failed verification, and any diagnostic that doesn't match a known fix — and route those to your existing ticket queue with full context attached.

Check the work

  • Review the agent's action log weekly for any reset or fix performed on an unverified or ambiguous identity.
  • Sample resolved tickets and confirm the issue was actually fixed, not just marked closed.
  • Track the escalation rate — a rate that's too low is a red flag the agent is closing tickets it shouldn't.

Source: EPC Group, "Microsoft Copilot Agents 2026: 9 Patterns That Actually Work in Production" (2026)

Expected Outcome

A live agent in Teams that resolves or correctly categorizes a defined set of common ticket types, with an audit log of every action it took.

✓

AI is the right call here

Password resets already have a non-AI self-service flow in Entra. What the agent adds is the conversational triage before that — asking the right clarifying questions and matching symptoms to a known fix instead of a dead-end FAQ.

Non-AI alternative: Entra's existing self-service password reset already handles that one ticket type without any agent; the agent's real contribution is the diagnosis and categorization upstream of it.

Related Workflows

WORK WITH LIMINALS

Ready to roll this out beyond one person?

Workflows like this tend to raise real governance and licensing questions once more than one person is using them — that's exactly what we help with.