How to automate IT helpdesk requests

What this automation does

Employees ask for IT help where they already work, and most requests are answered, actioned or turned into a complete ticket in under a minute.

1. Request. An employee posts in a #it-help channel, messages the IT bot in Slack or Teams, or emails the helpdesk address.
2. Classify and extract. A model labels the request (how-to, access request, hardware, outage, account lockout, purchase) and extracts the app or device, error message, location and urgency.
3. Answer what it can. For how-to questions, the bot searches the IT knowledge base and replies with the steps and a link. If the employee says it worked, the request closes as a deflection.
4. Run approved actions. For access requests on an approved list, such as adding someone to a shared mailbox or a software group, the bot asks the employee’s manager to approve in chat, then makes the change through the identity provider’s or mail system’s admin API and confirms.
5. Ticket the rest. Everything else becomes a ticket with the category, extracted fields, conversation transcript and the employee’s device and department already filled in.
6. Spot patterns. If several people report the same error within minutes, the bot links their requests to one incident and alerts the on-call technician.

When it is worth building

It pays off when your IT team spends a large part of each day on repeat questions and access requests, and when tickets arrive without the details needed to act. Two signs: technicians reply “can you send a screenshot?” on most tickets, and the same five how-to questions appear every week.

For very small teams with a handful of requests a day, a shared Slack channel and a well-organized knowledge base may be enough. If you are a managed service provider, the same build can serve several clients, but scope tenant separation carefully. For the account lifecycle side, joiners and leavers, see automating user provisioning.

Architecture

How to build it

1. Mine your ticket history. Export three months of tickets and group them by type. Pick the top request types by volume and decide for each whether to answer, act or route.
2. Clean the top knowledge articles. The bot is only as good as the articles for those top types. Rewrite them as short numbered steps with screenshots where helpful.
3. Define the action allowlist. List each action, the system it touches, who must approve it, and how it is undone. Start with group membership and shared resource access. Leave admin roles, MFA changes and password resets out.
4. Build classification and extraction. Give the model the fixed category list and ask for structured fields. When confidence is low, ask the employee one clarifying question rather than guessing.
5. Connect the identity provider. Register an app with the narrowest Graph or Admin SDK permissions needed for the allowlisted actions, and restrict which groups it can modify.
6. Build manager approval. Look up the employee’s manager from the directory, send an approve or deny card, and time out to a ticket if nobody responds.
7. Create good tickets. Map extracted fields to ticket fields, attach the transcript, and set priority from the category and urgency rules, not from the model’s opinion.

The downloadable starter template below covers Slack intake, AI classification, knowledge base reply and ticket creation.

What breaks in production

• Social engineering through the bot. Someone asks the bot to add them to the finance group “because my manager said so”. The approval must go to the manager on record in the directory, never to a name the requester supplies.
• Over-broad app permissions. The Graph app was granted directory-wide write to make testing easy. Scope it to specific groups or administrative units before launch.
• Knowledge base answers for the wrong platform. Mac steps sent to a Windows user. Pass the employee’s device platform from your device management system into the search filter.
• Outage floods. When email goes down, 80 people message at once. Detect clusters and post one status update instead of creating 80 tickets.
• Silent ticket creation failures. The ticketing API rejects a request because a required field changed, and the employee thinks IT has it. Alert on every failed create and tell the employee if it did not go through.

Timeline and cost

A Slack or Teams bot with classification, knowledge answers, two or three approved actions and ticket creation usually takes two to four weeks. Lumeor builds IT helpdesk automation in the range of $6,000 to $12,000, depending on the number of actions, the ticketing system and how much knowledge base cleanup is needed. Model costs at internal helpdesk volumes are typically small next to the hosting and ticketing licenses you already pay for. See what workflow automation costs for how the pricing is built.

How to measure success

• Share of requests resolved without a technician (deflection), split by category
• Share of tickets that arrive with all required fields filled
• Median time to first response and to resolution, before and after
• Approved actions completed per month, and any that had to be reversed
• Employee satisfaction on a one-question survey after each bot interaction