What problem does it solve?
Most organizations run an IT service desk, and much of its volume is the same few requests: forgotten passwords, locked accounts, MFA devices, VPN trouble, a new laptop, access to an application. Each one is quick for an analyst, but they arrive in bursts (Monday mornings, after a password policy change, during an outage) and employees wait in a queue for something a system could have done in seconds. The first line desk spends its day reading and routing tickets instead of fixing the harder problems.
The first wave of IT chatbots answered with a knowledge article. The employee still had to follow the steps or raise a ticket anyway. The step change is an agent that is connected to the identity provider and the ITSM tool, can reset, unlock, provision and route within strict limits, and logs every action like a human analyst would. In a bank the same agent also has to respect entitlement rules and access reviews, because access changes are a control, not just a service.
How does it work?
- Understand the request. The employee writes in their own words in Teams, Slack or the portal ("my VPN keeps dropping", "I need Visio"). The agent classifies the intent and extracts the details it needs.
- Verify the person proportionally. The chat session is already signed in through single sign on. Sensitive actions such as a password or MFA reset need a step up check, because the service desk is a known target for social engineering.
- Act through approved tools. For a small allow list of requests the agent calls the identity provider or ITSM APIs directly: reset, unlock, add to a group, start a software request that runs the normal approval, and confirms the result.
- Answer from the IT knowledge base. How to questions are answered by retrieval over current, owned IT articles, with a link to the source.
- Route what it cannot finish. Everything else becomes a ticket with a summary, category and the right assignment group, so no analyst has to read and reroute it.
- Log everything. Every action is written to the ITSM record with the requester, the action and the result, so audit and access reviews see the same trail as for a human.
- Audience
- Employee facing
- Autonomy
- Supervised agent
- Adoption
- Mainstream
- Channels
- Microsoft Teams, Internal tools, Web chat
What is it worth?
Benchmarks are computed from the public deployments below: one data point per organization per KPI, with who made each claim.
| KPI | Median | Reported range | Data points | Claimed by |
|---|---|---|---|---|
| Employee adoption | Too few to pool | 90% to 94% | 2 | 1 organization, 1 vendor |
| Productivity gain | Too few to pool | 40% to 50% | 2 | 2 vendor |
| Accuracy | Too few to pool | 96% | 1 | 1 vendor |
| Automation rate | Too few to pool | at least 74% | 1 | 1 vendor |
| Contact deflection | Too few to pool | at least 50% | 1 | 1 organization |
| Containment rate | Too few to pool | at least 75% | 1 | 1 organization |
| Users served | Not pooled | at least 133,000 | 1 | 1 organization |
Value drivers: Lower cost to serve, Employee productivity, Speed and cycle time.
Indicative value
An organization with 20,000 employees
USD 540,000 to USD 3 million
Analyst handled contact cost avoided per year
How this is calculated
Formula: employees * ticketsPerEmployee * resolvedShare * costPerTicket. The low scenario uses every low input, the high scenario every high input.
| Input | Low | High | Basis |
|---|---|---|---|
| Employees served by the service desk employees, employees | 20,000 | 20,000 | The reference organization. |
| IT support contacts per employee per year ticketsPerEmployee, contacts per employee per year | 6 | 10 | Editorial assumption, replace with your own ticket and call volume. |
| Share of contacts the agent resolves without an analyst resolvedShare, fraction of contacts | 0.3 | 0.6 | Conservative against the evidence on this page (IBM reports over 75% of AskIT queries resolved by an assistant that mainly answers from IT support content; Moveworks reports over 74% of issues at Mercari US handled autonomously), because early waves cover fewer intents. |
| Fully loaded cost of an analyst handled contact costPerTicket, USD per contact | 15 | 25 | Editorial assumption for a blended first line desk. Replace with your own cost per ticket. |
What it leaves out: Gross avoided handling cost only. It leaves out the cost of the platform and integrations, the productivity of employees who get unblocked faster, and any reduction in outsourced desk contracts, which usually only happens at renewal.
Who already uses it?
6 public deployments, strongest evidence first. Grades: A regulator or audit, B the organization itself, C vendor case study, D anonymous or estimate.
IBM
United States · Technology and software · 2023
IBM's CIO organization receives around 785,000 IT support tickets a year covering device setup, password resets, VPN problems and replacements. It launched AskIT, built on watsonx Assistant after an analysis of over 300,000 support tickets and trained on the 80% of IT issues the company faces most often. It covers more than 200 support topics in more than 40 languages for over 280,000 employees. In its first four months more than 133,000 employees used it.
- Containment rate: at least 75%, first four months after release
"Of the queries that were submitted, over 75% were resolved by the new assistant itself."
Claimed by: organization - Users served: at least 133,000, first four months after release
"In the four months since AskIT’s release, over 133,000 IBM employees used the tool at least once."
Claimed by: organization
Bank of America
United States · Banking · 2020
Bank of America launched Erica for Employees in 2020, building on its customer facing assistant, to give staff technology support such as mobile device password resets and device activation. In 2023 it was extended to HR topics such as where to review health benefits and how to find payroll and tax forms. The bank reports that most employees use it and that it has more than halved calls into the IT service desk.
- Employee adoption: at least 90%, as of April 2025
"Today, over 90% of employees use Erica for Employees, with the virtual assistant having reduced calls into the IT service desk by more than 50%."
Claimed by: organization - Contact deflection: at least 50%, calls into the IT service desk, as of April 2025
"Today, over 90% of employees use Erica for Employees, with the virtual assistant having reduced calls into the IT service desk by more than 50%."
Claimed by: organization
7-Eleven Vietnam
Vietnam · Retail and ecommerce · 2025
7-Eleven Vietnam, with 140 stores, built an internal IT support chatbot on Vertex AI Agent Builder and Gemini so employees can resolve technical issues on their own. Google Cloud reports that it halved the time spent fixing IT issues and lightened the IT team's workload.
- Productivity gain: 50%
"The chatbot reduced time spent fixing IT issues by 50%, lightening the workload for the IT team."
Claimed by: vendor
Mercari US
United States · Retail and ecommerce · 2021
Mercari US, the US arm of the online marketplace, deployed a Moveworks AI assistant in Slack in July 2021. It resolves IT issues such as password resets, email group changes, device troubleshooting and software provisioning. Moveworks reports that the assistant resolves most issues without the service desk and that most employees now go to the assistant first rather than messaging the IT team.
- Automation rate: at least 74%, as reported in the undated case study
"Today, the agentic AI Assistant handles over 74% of issues completely autonomously."
Claimed by: vendor - Employee adoption: 94%, employees who go to the assistant first, as reported in the undated case study
"As a result, the vast majority of employees — 94% — reach out to the Assistant first when they have questions instead of Slacking the IT team directly."
Claimed by: vendor
Vituity
United States · Healthcare · 2020
Vituity, a healthcare organization owned and led by a partnership of nearly 5,000 physicians, deployed a Moveworks AI assistant called Otto in Microsoft Teams in April 2020, connected to ServiceNow, Okta and internal knowledge. It started with IT workflows such as password resets, account provisioning and software access, then expanded into HR questions and other operational domains. The vendor reports that the average time to close issues fell by one full business day and that first line help desk capacity was freed.
- Productivity gain: 40%, level 1 help desk capacity
"It now absorbs a significant share of routine IT and HR requests — including password resets, software access, HR questions, and account provisioning— freeing up 40% of level 1 help-desk capacity."
Claimed by: vendor
Equinix
United States · Technology and software · 2019
Equinix launched a Moveworks assistant, known internally as E-Bot, in April 2019. It resolves IT support issues end to end in Microsoft Teams and, for tickets it cannot finish, assigns them to the right one of thousands of IT assignment groups within 30 seconds. Moveworks contrasts this with the five hours a first line desk takes on average to read and route a ticket, and reports that E-Bot routes 82% of Equinix tickets automatically, which cut the average lifespan of all tickets by almost a third.
- Accuracy: 96%, routing of tickets the assistant cannot resolve, about ten months after launch
"Instead of high-touch tickets requiring time-consuming agent attention, the Moveworks Triage Skill allows E-Bot to assign the tickets it can’t finish resolving to the correct subject matter experts — with the same 96% accuracy rate achieved by help desk agents."
Claimed by: vendor
How do you implement it?
A model agnostic playbook: what to prepare, the order to build in, and what goes wrong.
Data you need
- Ticket history with categories and resolutions, to pick the first intents by volume
- Current IT knowledge articles with an owner and review date
- A clean list of assignment groups and what each one handles
- Entitlement rules for what can be granted without approval
Systems to integrate
- Identity provider (password reset, unlock, MFA, group membership)
- ITSM platform such as ServiceNow, Jira Service Management or Freshservice
- Collaboration channel (Microsoft Teams, Slack) and the intranet
- Device and software management for provisioning requests
- HR system for joiner, mover and leaver context
Complexity: Medium
Answering IT questions is easy. The work is in the integrations with the identity provider and the ITSM tool, in safe verification before resets, and in keeping the knowledge base current. Organizations with messy assignment groups need to clean them up before routing works well.
- 1
Pick intents from the ticket data
Export a year of tickets and calls, group them by resolution, and choose the ten to twenty intents that are both frequent and safe to automate. Password, unlock and access requests are usually the top of the list.
- 2
Write the action allow list
For each action, record the API, the verification it needs, the limits (which groups, which software, which approvals) and what the agent says when it cannot proceed.
- 3
Harden the reset flows
Treat password and MFA resets as the highest risk actions. Require step up verification tied to something the attacker does not have, and alert on unusual reset patterns.
- 4
Clean and connect the knowledge base
Retire stale articles, give every article an owner, and make the agent refuse and route when retrieval finds nothing rather than improvising steps.
- 5
Route with context
For requests the agent cannot finish, create the ticket with a summary, category and assignment group. Measure how often analysts reassign it and tune from there.
- 6
Launch where people already ask for help
Put the agent in the chat tool employees already use, announce it with a few concrete examples, and track adoption and repeat contacts per intent.
Guardrails
- Actions only through an allow list of API calls, each with its own verification level and limits
- Step up verification before any password, MFA or privileged access change
- Access requests follow the same approval and least privilege rules as a human request
- Answers only from owned, current IT articles, with refusal and routing when nothing matches
- Every action written to the ITSM record and an immutable audit log
KPIs to instrument
- Share of contacts resolved by the agent per intent, counting a repeat contact within seven days as not resolved
- Automated routing accuracy, measured by reassignment rate
- Employee adoption (share of employees who used the agent in the last 30 days)
- Median time to resolution for automated versus analyst handled tickets
- Reset volume and anomalies, reviewed by security
Human in the loop
Analysts own everything outside the allow list, all privileged access, and any request that fails verification. Approvers stay in the loop for software and access that needs approval, and the desk reviews a weekly sample of resolved conversations and reset logs.
Common failure modes
- The help desk becomes the attack path
- Social engineering against resets works on bots as well as people. Tie resets to strong verification, rate limit them and alert security on unusual patterns.
- Deflection instead of resolution
- The agent sends an article, the employee gives up and phones the desk. Measure repeat contacts, not just conversations closed.
- Access creep
- Convenient self service grants access without the approvals that access reviews assume. Keep approvals and least privilege identical to the manual path.
- Stale knowledge
- Articles describe old tools and old screens. Give each article an owner and a review date and retire what is not maintained.
What are the risks and rules?
EU AI Act
Limited risk (transparency)
Article 50(1) requires an assistant that talks with people to make clear they are interacting with AI, unless that is obvious from the context. It is not listed in Annex III. The agent does allocate work, but it routes tickets to resolver and assignment groups based on the content of the request, not to individual workers based on their behaviour or personal traits or characteristics, so Annex III point 4(b) does not apply. It also does not decide on recruitment, promotion, credit or access to essential services. Any use that assigns work to individual analysts, or monitors and evaluates them from their behaviour or performance (including through the agent's logs), would need its own assessment.
Rules that apply
Guidance
- Article 50, transparency obligations for providers and deployers of certain AI systems (European Union, Europe). People must be informed that they are interacting with an AI system unless this is obvious from the context.
- Guidelines on Risk Management Practices, Technology Risk (Monetary Authority of Singapore, Asia Pacific). Example of regional expectations on access management, privileged access and logging that an automated service desk has to meet at a financial institution.
- OWASP Top 10 for LLM Applications (OWASP Gen AI Security Project, Global). Covers prompt injection and excessive agency, the two main risks when an agent can change accounts and access.
- Scattered Spider, cybersecurity advisory AA23-320A (CISA and FBI, North America). Describes a criminal group that phones IT help desks to get passwords and MFA tokens reset, the attack path that automated resets must be designed against.
Controls to put in place
- Inventory entry with an accountable owner and a documented action allow list
- Same entitlement and approval rules for automated and manual access changes
- Immutable log of every automated action, reviewed in periodic access reviews
- Security monitoring on reset and unlock volumes
- Change control and regression tests for every new intent or action
Frequently asked questions
- What share of IT requests can an AI agent resolve?
- Published figures are high, for assistants that act and for those that mainly answer. Moveworks reports that Mercari US's assistant, which resets passwords, edits email groups and provisions software, handles over 74% of issues autonomously. IBM reports that over 75% of queries submitted to AskIT in its first four months were resolved by the assistant, which mainly surfaces answers from IT support content. Start lower: early waves cover fewer intents.
- Does it reduce calls to the service desk?
- Bank of America says Erica for Employees, used by over 90% of its employees, has reduced calls into the IT service desk by more than half. Measure it as calls and tickets per employee before and after, not as chatbot conversations.
- Is it safe to let an AI reset passwords?
- Only with strong verification. CISA and the FBI have warned that criminal groups phone IT help desks to get passwords and MFA tokens reset, so a reset should need the same or stronger proof of identity than a human analyst would ask for, with rate limits and security alerts on unusual patterns.
How to cite this page
Blits.ai AI Use Case Library, "AI agent for IT service desk resolution", last verified 27 September 2026, https://www.blits.ai/ai-use-cases/it-service-desk-resolution-agent. Licensed under CC BY 4.0. Method: how we verify use cases.
Changelog
- 27 September 2026: First published