IT Helpdesk Automation Workflow: Resolve L1, Route the Rest
Level-1 IT is repetitive by definition: password resets, access to a shared drive, a licence for a tool, 'how do I connect to the VPN'. The workflow handles those through a Slack or Teams bot and the ticket system — answering from your IT knowledge base, executing approved self-service actions through the identity provider and MDM with the right approvals, and creating well-formed tickets for everything else. IT staff handle problems, not requests.
Written by Max Zeshut
Founder at Agentmelt · Last updated Sep 11, 2026
The problem
IT tickets are dominated by requests that have a known procedure but still need a person to execute them. Response time for a password reset is measured in hours, access requests bounce between manager and IT, and the same how-to question is answered fifty times a month.
What changes when it runs
Most L1 requests are resolved in the conversation where they were asked, in minutes, with the approval and the audit trail the security team requires. Tickets that reach IT are complete — category, device, user context, what was already tried — and the knowledge base improves from every unresolved question.
Trigger, then 8 steps
Trigger
Slack / Teams bot message + help desk webhook
Messages to the IT bot or #it-help channel, and new tickets in Jira Service Management, Freshservice or ServiceNow.
Receive the request
WebhookMessage text, requester identity (verified through the chat platform's SSO), device and location from the MDM where available.
Classify the request
Text ClassifierPassword/MFA, access request, software/licence, hardware, how-to, outage report, other — with urgency. Outage reports skip to incident handling.
Answer from the knowledge base
AI AgentHow-to questions are answered from the IT knowledge base with the steps and a link; the agent asks a clarifying question when the request is ambiguous.
Self-service actions with approval
SwitchPassword reset → identity-provider API after MFA verification. Access to a group or app → manager approval request in Slack, then the identity-provider call. Software → licence check, then MDM deployment or a purchase request. Hardware → ticket with the asset details.
Execute through the systems
HTTP RequestOkta/Entra ID/Google Workspace for identity actions, Jamf/Intune for software deployment, the licence platform for seat assignment — each call logged with requester, approver and timestamp.
Create or update the ticket
JiraEvery request, resolved or not, becomes a ticket with the classification, the actions taken and the conversation, so metrics and audits are complete.
Route unresolved requests
SlackAnything the bot cannot resolve is assigned to the right IT queue with the context and a summary; the requester is told who has it and the expected time.
Improve the knowledge base
Schedule TriggerWeekly: questions the agent could not answer, grouped by topic, become draft KB articles for IT to approve; resolved-by-bot rate and time-to-resolve reported per category.
Data it touches
- Slack / Teams (identity-verified requests)
- IT knowledge base (Confluence, Notion, help centre)
- Identity provider (Okta, Entra ID, Google Workspace)
- MDM and licence platforms (Jamf, Intune, licence manager)
- Help desk (Jira SM, Freshservice, ServiceNow)
Guardrails
- Identity is taken from the chat platform's SSO, never from the message; sensitive actions require a fresh MFA step.
- Access grants always require manager (or app owner) approval recorded in the ticket; privileged groups are excluded from self-service.
- Every automated action is logged with requester, approver and timestamp for audit.
- Outage reports and security concerns bypass the bot and go straight to the on-call engineer.
Self-service that security will sign off
IT self-service fails when it is either too permissive or so locked down that it resolves nothing. The workflow's design has three controls security teams accept: identity comes from SSO and sensitive actions re-verify with MFA; access grants always go through the owner's approval, which is recorded; and privileged groups are simply excluded from the bot. Within those rules, resets, standard access and software installs can be fully automated, and those are the bulk of L1 volume.
Every request becomes a ticket, even the resolved ones
Chat-based resolution is convenient and invisible. The workflow writes every interaction to the help desk as a ticket with its outcome, so IT management sees the true request volume, the resolved-by-bot rate and the categories that still need people. That data is what justifies the automation and what points at the next process to fix.
The knowledge base writes itself, almost
Questions the agent could not answer are the KB's gaps. The weekly run groups them by topic and drafts an article for each from the resolutions IT staff provided in the tickets. IT approves or edits; the next week the bot answers those questions. Most teams find their KB coverage doubles in the first quarter without anyone sitting down to write documentation.
Tools in the stack
| Tool | Role in this workflow |
|---|---|
| n8n | Bot logic, approvals, system calls, ticketing |
| Claude | Classification, KB answers, clarifying questions |
| Okta / Entra ID / Google Workspace | Identity actions |
| Jamf / Intune | Software deployment |
| Jira Service Management / Freshservice | Tickets and metrics |
Want this running without building it?
Automation workflow
$297/month
We set up, host and maintain this workflow on n8n and connect it to your tools. Setup included, cancel monthly, you keep the JSON.
Custom build
$5,000–9,000 one-time
Your systems, your rules, your edge cases. A one-off build on Claude and n8n, delivered with documentation and a walkthrough.
Covers up to 1,500 requests a month with one identity provider, one MDM and one help desk. ServiceNow integration, hardware provisioning workflows or custom approval matrices are a custom build.
Frequently asked questions
Can it reset passwords without IT involvement?
Yes, after MFA verification through the identity provider, and it is logged. Accounts in privileged groups are excluded and always go to a person.
Which help desks and identity providers are supported?
Jira Service Management, Freshservice, Zendesk and ServiceNow (custom); Okta, Microsoft Entra ID, Google Workspace and JumpCloud for identity; Jamf and Intune for devices.
What happens during an outage?
Outage reports are recognised and routed to the on-call engineer and the incident channel immediately, and the bot switches to a status-message mode so requesters get the current incident update instead of a KB answer.
The pillar
AI Operations & IT Agent
Automate internal IT tickets, employee onboarding, and system monitoring.