IT Service Desk · Agent blueprint · validated with 6 team members

Access Request Fulfilment Agent

A Power Automate flow with a Copilot Studio agent for unclear cases prepares each approved ServiceNow access request: it picks the Entra group and license, checks approvals and license stock, then shows the analyst one change to approve. After approval it applies the change, writes the work note and sets the state.

81readiness · Ready for an agent

6–10 hback per week, of 18 h now

$18K–28Ka year

3–5 wkto build · size M

Trigger

A requested item (RITM) arrives in the ServiceNow access queue with the manager's approval recorded. Items without approval are held and re-checked.

Done when: The user is in the group, the license is assigned (if the app is paid), a work note is written, and the item is set to Closed Complete (or Pending with a purchase request if no licenses are left).

Needs: RITM number, catalog item name and requester email (ServiceNow); Manager approval record on the RITM (ServiceNow); Requester type (employee or contractor) and sponsor approval if contractor; Catalog item to security group (and license) mapping table, maintained from the KB article group list (Confluence); Licenses remaining per SKU (Microsoft admin center); Cost center, only when the team says it is needed (not yet defined)

What the agent does

1
Read the RITM, catalog item and requester details · ServiceNowapi
Triggered from the access queue; copies email and item name directly, so nothing is retyped (42% retyped by hand today).
2
Confirm the manager's approval is recorded on the RITM · ServiceNowapi
If there is no approval, do nothing and re-check later; the work cannot start without it.
3
Check whether the requester is a contractor with sponsor approval · ServiceNowapi
Contractors need the sponsor's approval as well as the usual one.
4
Map the catalog item to its security group · ServiceNowai
Use the mapping table (e.g. Visio to SG-Visio-Users). If the item isn't in the table, look in the KB list or hand over.
5
Look up the group list when the item is unclear · Confluenceapi
Reads the KB article group list; the agent never guesses a group.
6
Flag privileged (admin or finance) groups for security review · Entra IDai
Hand to a person; no change is prepared until security sign-off is recorded.
7
Decide if the item is a paid app and check licenses remaining · Microsoft admin centerconnector
Read-only check. Free apps and VPN need only the group.
8
Prepare change summary: user, group, license, draft work note, new state · ServiceNowai
Drafted for the analyst to review in one view.
9
Approve the prepared change before anything is applied · ServiceNowperson
Required because unattended actions are not allowed. Covers the group, license, work note and state.
10
Add the user to the security group · Microsoft Entra admin centerconnector
11
Assign the matching license for paid apps · Microsoft admin centerconnector
Visio Plan 2, Project Plan 3 or Adobe Acrobat Pro, following the group.
12
Write the work note and set State to Closed Complete · ServiceNowapi
Set Pending instead if licenses ran out. A resolution note is always written before closing.

Decisions the agent makes

Decide	Rule	Source
Which security group to add the user to	Follows the catalog item requested: each item has its own group (Visio to SG-Visio-Users, Project to SG-Project-Users, Adobe to SG-Adobe-Users, VPN to SG-VPN-Users). If unsure, check the group list in the KB article. Most respondents agreed.	The team
Whether to assign a license, and which	Only when the item is a paid app; free apps and VPN need only the group. Check licenses remaining first. SG-Visio-Users gets Visio Plan 2 (35 of 35 cases), SG-Project-Users gets Project Plan 3 (22 of 22), SG-Adobe-Users gets Adobe Acrobat Pro (18 of 18).	Team, confirmed by data
Which State to set	Closed Complete once the group and license are done and the work note is written. Pending if waiting on licenses (none left).	The team
Whether work can start	Only when the manager's approval is recorded on the RITM. Contractors also need the sponsor's approval.	The team
Whether the request needs security review	Privileged (admin or finance) groups need security sign-off before access is granted. How privileged groups are identified is not stated.	The team
What to do when no licenses are left	Raise a purchase request and set the item to Pending.	The team
What the work note says	Record that the group was added and the license assigned (if applicable). No standard wording was given.	The team
Whether the cost center is also needed	Not known yet: ask the team. They said it is sometimes moved with email and item name.	Not known yet
Whether step order matters	The team says 'it depends' without saying on what; data shows only 7% of cases vary. The agent follows the typical order: group, license, work note, state.	Team, confirmed by data

Where a person signs off

Analyst approves the prepared change (group, license, work note, state) before the flow applies it.
Security review sign-off before access to a privileged (admin or finance) group.
Sponsor's approval in addition to the manager's for contractors.
Analyst approves the Pending state and purchase request when no licenses are left.

Exceptions

When	What the agent does
No manager approval is recorded yet (about 26% of cases pause around 2.7 h; the team says approvals are the most common wait)	The flow holds the item and re-checks on a schedule. After an agreed time it is shown to an analyst with the approval status.
Request is for a privileged admin or finance group (unusual; the team's estimates range from almost never to under 1 in 10)	Stop and hand to an analyst, noting that security sign-off is needed. Nothing is applied until it is recorded.
Requester is a contractor	Check for the sponsor's approval as well. If missing, hold and hand to an analyst.
Paid app but no licenses left	Prepare a purchase request and a Pending state for analyst approval. Do not assign a license.
Catalog item is not in the mapping table or isn't a group or license (e.g. an install)	Hand to an analyst with the item name and any KB match found.
Waiting on a reply from the requester or a system sync (17% of waits each)	Leave the item open and re-check. Hand to an analyst if it is still blocked after the agreed time.

Build with

Power Automate: Main flow: trigger, ServiceNow and Entra/Microsoft 365 steps, approval request, retries and waits.
Copilot Studio: Agent for unclear items: reads the KB group list, explains its mapping and prepares the change summary.
ServiceNow (API): Reads RITMs and approvals; writes work notes and state.
Microsoft Entra and Microsoft admin center connectors: Add group members and read or assign licenses.

Skills: Power Automate, Copilot Studio, ServiceNow API, Entra ID and licensing admin

Before building

Service account for Power Automate with ServiceNow API access to the access queue (read RITM and approvals, update work notes and state)
Service account with the minimum rights to add group members in Entra and assign licenses (read license counts)
Premium Power Automate and Copilot Studio licenses for the flow and agent
A maintained mapping table of catalog item to group, paid or free, and license SKU, built from the KB group list
A way to tell privileged groups and contractors apart (e.g. group tag or requester attribute)
Where the purchase request is raised for missing licenses (system not given)

Risks

Wrong group chosen for a new or renamed catalog item; reduce by using the mapping table and handing over unknown items.
Mapping table goes out of date when groups or SKUs change; give it an owner.
Analyst approves without looking, which weakens the control; show a short, clear summary.
Privileged or contractor cases are missed if they are not flagged in the data.
License counts change between the check and the assignment; re-check just before applying.

How we'll know it worked

Median hands-on time per request (baseline 8.9 min; 17.9 team hours a week across 113 cases)
Elapsed time for requests that paused (baseline: 26.5% of cases, median wait 2.7 h)
Share of details retyped from ServiceNow into Entra (baseline 42%) and mismatch rate (baseline 1.1%)
Share of requests closed without hand-off to an analyst, other than the approval click

Still to answer before building

Which approvals do the approval waits involve (manager, security, sponsor), and how long does each take?
What exact wording is expected in work notes?
When is the cost center needed besides email and item name?
How is the license count checked today, and what happens after the purchase request is fulfilled?
How should privileged groups and contractors be identified in ServiceNow or Entra?
What decides when order matters, given everyone answered 'it depends'?
How often do exceptions really occur? Estimates range from 1 in 10 to 1 in 3.
Where are policies written down beyond the KB group list?

Where the team disagrees

Settle these first: an agent needs one rule, and new hires get mixed answers today.

Whether the order of steps matters: everyone answered 'it depends' without saying on what.
How often exceptions occur: answers range from almost never to often (1 in 10 to 1 in 3).

Evidence

62% of cases follow the same steps (some in a different order, some skip a step)
18 team hours a week
data is moved by hand from ServiceNow to Microsoft Entra admin center (42% retyped)

Observed main path (41% of cases): Requested Item (ServiceNow) → Groups (Microsoft Entra admin center) → Edit Add members → Licenses (Microsoft admin center) → Edit Assign license → Requested Item (ServiceNow) → Edit Work notes → Edit State

Handover spec for the builder (text) →

Designed by AI from how the team did this work (2026-10-19 to 2026-10-23), the company's tools and its rules. A starting point for the builder: confirm system access and approvals before building.