IT Service Desk · Agent blueprint · validated with 6 team members

Password reset and unlock assistant

An agent reads the locked-account ticket, checks the caller's employee ID and manager name against the directory, and prepares the reset or unlock. After the analyst approves, it applies the change and drafts the standard resolution note. It removes the hand-copied username and the knowledge-base lookups.

78readiness · Ready for an agent

10–16 hback per week, of 29 h now

$29K–45Ka year

3–5 wkto build · size M

Trigger

A ServiceNow ticket reporting a locked account, or an analyst starting the flow from a call.

Done when: The user confirms they can sign in, and the ticket is resolved with the standard resolution note.

Needs: ServiceNow ticket: username exactly as entered, requester, ticket number; Employee ID and manager name given by the caller; Employee ID, manager and role or seniority from the directory; Whether the user has a new phone; MFA re-registration steps from the Confluence page 'How to unlock an account'; Standard resolution note wording

What the agent does

1
Read the ticket and capture the username exactly as written · ServiceNowapi
Removes the manual copy to the directory, which is retyped in 28% of cases and mismatches in about 2%.
2
Find the user account using the exact username from the ticket · Microsoft Entra admin centerconnector
If no exact match, stop and hand to the analyst with what was found.
3
Check the requester's role and route executives to the senior tech · Microsoft Entra admin centerconnector
Executive cases go to the senior tech. How an executive is identified is an open question.
4
Ask the caller for employee ID and manager name · ServiceNowperson
The analyst collects the answers from the caller.
5
Compare the answers with directory records and show the match result · Microsoft Entra admin centerconnector
Required before any reset. If it fails, no change is prepared.
6
Ask whether the user has a new phone · ServiceNowperson
7
Fetch the MFA re-registration steps when the user has a new phone · Confluenceapi
Replaces the manual knowledge-base lookup, which happens in about 18% of cases.
8
Prepare the reset or unlock and show the analyst a summary · Microsoft Entra admin centerai
Summary shows user, action, verification result and any MFA step.
9
Approve the reset or unlock · ServiceNowperson
Policy: no unattended changes, so the analyst approves every change.
10
Apply the password reset or account unlock · Microsoft Entra admin centerconnector
11
Give the user the temporary password and confirm they can sign in · Outlookperson
The delivery channel is not yet defined. Any message to the user needs the analyst's sign-off.
12
Draft the standard resolution note · ServiceNowai
States that identity was verified, the reset was done and the user confirmed.
13
Approve the note and the closing of the ticket · ServiceNowperson
Only after the user confirms they can sign in.
14
Write the resolution note and set the State to resolved · ServiceNowapi

Decisions the agent makes

Decide	Rule	Source
Handle the case or pass it to the senior tech	If the requester is an executive, hand it to the senior tech. Otherwise the analyst handles it directly. Most respondents agreed. What makes someone an executive and any other trigger for the senior tech are not defined.	The team
Whether MFA re-registration is needed	If the user has a new phone, also do MFA re-registration following the steps on the Confluence page on unlocking accounts, in addition to the reset or unlock. Most respondents agreed. The share of cases with a new phone is not stated.	The team
How to verify the requester's identity	Always verify the employee ID and the manager's name before any reset. Any further method (security questions, verification code or authenticator app, ticket or channel recognition) is split across respondents and not agreed.	The team
Whether to approve the reset or unlock	The analyst approves every change, because policy forbids unattended actions. Which cases need an additional approval, and from whom, is not known yet: ask the team.	Not known yet
How to deliver the temporary password	Not known yet: ask the team	Not known yet

Where a person signs off

Analyst approves each reset or unlock before it is applied.
Analyst signs off any message that carries the temporary password to the user.
Analyst approves the resolution note and closing the ticket, after the user confirms they can sign in.

Exceptions

When	What the agent does
Requester is an executive (mostly under 1 in 10 cases)	The agent does not proceed. It hands the case to the senior tech with the ticket and the directory lookup.
User has a new phone (about 18% of cases open the knowledge-base page)	The agent shows the MFA re-registration steps from Confluence. The analyst performs them in addition to the reset or unlock.
Caller fails the employee ID and manager name check	No reset is prepared. The agent hands to the analyst with the mismatch details, and the ticket stays open.
Username in the ticket does not match one directory account (about 2% of transfers mismatch)	The agent stops, shows the closest candidates and asks the analyst to confirm with the caller.
Steps are redone (about 10% of cases): temporary password not received, or the account locks again from an old phone	The agent reopens the case with the earlier actions logged and hands to the analyst. The analyst repeats the approval step.
Case pauses after the State is set (about 5% of cases, median 1.6 hours, reason given as 'an approval')	The agent keeps the ticket open with the pending reason noted and reminds the analyst. Who approves is an open question.

Build with

Copilot Studio: Guides the analyst through verification questions, the new-phone question and the approvals.
Power Automate: Runs the ServiceNow, Entra, Confluence and Outlook connector and API calls.
ServiceNow: Source of the ticket and place for the resolution note and State.
Microsoft Entra admin center: Looks up users and performs password resets and unlocks.
Confluence: Provides the MFA re-registration steps.

Skills: Copilot Studio, Power Automate, ServiceNow API, Entra ID / AD administration

Before building

Service account for Power Automate with rights to reset passwords and unlock accounts in Entra ID/AD, and a ServiceNow API account that can update tickets
Confirmation that the employee ID and manager attributes are in the directory and accurate
Confirmation of how Entra ID connects to on-premises Active Directory (for example password writeback), since analysts currently use Active Directory Users and Computers
Copilot Studio and Power Automate licenses covering the connectors used
Written standard resolution note template
A defined way to identify executives (a group or title list)

Risks

The agent could reset the wrong account if the username is wrong, so it must use the exact ticket value and stop on a mismatch.
Identity verification beyond employee ID and manager name is not agreed, which leaves room for inconsistent checks.
A temporary password sent through an unsuitable channel creates a security exposure.
Repeated lockouts from an old phone may not be fixed by the reset alone.
Analysts may skip the approval step out of habit, which would reduce the safeguard.

How we'll know it worked

Median work time per case (baseline 6.1 min) and team hours per week (baseline 28.7 h at 251 cases)
Share of cases where the username is retyped (28%) and mismatches (about 2%)
Share of cases that redo steps (about 10%; 5% pause for a median of 1.6 h)
Share of cases that need a manual knowledge-base lookup (baseline 18%)

Still to answer before building

Who gives the approval that causes a pause, and which cases need one? Is it tied to executive handling or something else?
Which identity checks apply in which situations, and is there a written policy?
What triggers the senior tech besides executives, and how is the handoff done?
How is the temporary password delivered, and what happens if the user does not receive it?
How is a repeat lockout from an old phone prevented?
Can the agent read the requester's role and employee ID from the directory, and how are executives identified?
Are accounts managed on-premises in Active Directory only, or synced with Entra ID so the Entra connector can reset them?

Where the team disagrees

Settle these first: an agent needs one rule, and new hires get mixed answers today.

Methods of confirming the requester's identity beyond the employee ID and manager name vary: other methods, ticket or channel recognition, security questions, and verification code or authenticator app each got a share.
Estimates of how often unusual cases come up differ: most said sometimes, one said often, one said almost never.

Evidence

72% of cases follow the same steps
29 team hours a week
data is moved by hand from ServiceNow to Active Directory Users and Computers (28% retyped)
15% of cases redo steps
18% of cases need an extra lookup (an exception the agent must handle)

Observed main path (72% of cases): Account locked (ServiceNow) → Active Directory Users and Computers → Edit New password → Account locked (ServiceNow) → Edit Resolution notes → Edit State

Handover spec for the builder (text) →

Designed by AI from how the team did this work (2026-10-19 to 2026-10-23), the company's tools and its rules. A starting point for the builder: confirm system access and approvals before building.