# Password resets and account unlocks agent

Agent blueprint, validated with 6 team members · Task: Password resets and account unlocks · IT Service Desk · readiness 79/100 (Ready for an agent)

Takes each case from ServiceNow through Active Directory Users and Computers and records the result, with a person approving changes.

**Trigger:** A new account locked arrives in ServiceNow

**Inputs:** Record number; Fields: New password, Resolution notes, State

**Done when:** User confirms they can sign in; ticket resolved with the standard note.

## Steps

1. Read the account locked details (ServiceNow, connector)
2. Look up the record in Active Directory Users and Computers (Active Directory Users and Computers, connector)
3. Send the proposed changes to a person to approve (Teams, person)
4. Set New password (Active Directory Users and Computers, connector)
5. Look up the record in ServiceNow (ServiceNow, connector)
6. Set Resolution notes (ServiceNow, connector)
7. Set State (ServiceNow, connector)

## Approvals

- A person approves every change to accounts, access or records (company policy).

## Prerequisites

- A service account with the needed rights in ServiceNow
- A service account with the needed rights in Active Directory Users and Computers

## Risks

- ServiceNow → Active Directory Users and Computers: values retyped 28% of the time today
- Edge cases not seen in the observed week

## Measure after launch

- Team hours on this task (now 29 h a week)
- Typical work per case (now 6.1 min)
- Share of cases finished without a person beyond the approval

## Decisions

| Decide | Rule | Source |
| --- | --- | --- |
| New password | Not known yet: ask the team | unknown |
| Resolution notes | Write: Standard note: verified identity, reset, user confirmed. | team |
| State | Not known yet: ask the team | unknown |

## Still to answer before building

- New password: how is it decided?
- State: how is it decided?

## Exceptions

- When New phone means MFA re-registration as well. (Sometimes (under 1 in 10)): Hand to a person with what the agent found
- When Executives go to the senior tech. (Sometimes (under 1 in 10)): Hand to a person with what the agent found
- When the case needs How to unlock an account | IT Knowledge Base | Confluence (17% of cases): Hand to a person with what the agent found so far
- When the case waits for someone (5% of cases, about 1.6 h): Send a reminder after 2 hours and post the status on the ticket
- When the case waits for an approval (100% of waits, per the team): Track it and remind after 2 hours

## Build with

- Microsoft 365 Copilot: Drafts and summaries for the person approving
- Copilot Studio: Agent logic, approvals and the person's view in Teams
- Power Automate: Runs the steps and connects the systems

## Effort and return

- Size S, about 1-2 weeks (Microsoft 365 Copilot, Copilot Studio)
- Team time on this task now: 29 h/week; expected back: 11-17 h/week

## Evidence

- 72% of cases follow the same steps
- 29 team hours a week
- data is moved by hand from ServiceNow to Active Directory Users and Computers (28% retyped)
- 15% of cases redo steps
- 17% of cases need an extra lookup (an exception the agent must handle)