# Password reset and unlock assistant

Agent blueprint, validated with 6 team members · Task: Password resets and account unlocks · IT Service Desk · readiness 78/100 · Ready for an agent

An agent reads the locked-account ticket, checks the caller's employee ID and manager name against the directory, and prepares the reset or unlock. After the analyst approves, it applies the change and drafts the standard resolution note. It removes the hand-copied username and the knowledge-base lookups.

**Trigger:** A ServiceNow ticket reporting a locked account, or an analyst starting the flow from a call.

**Inputs:** ServiceNow ticket: username exactly as entered, requester, ticket number; Employee ID and manager name given by the caller; Employee ID, manager and role or seniority from the directory; Whether the user has a new phone; MFA re-registration steps from the Confluence page 'How to unlock an account'; Standard resolution note wording

**Done when:** The user confirms they can sign in, and the ticket is resolved with the standard resolution note.

## Steps

1. Read the ticket and capture the username exactly as written (ServiceNow, api): Removes the manual copy to the directory, which is retyped in 28% of cases and mismatches in about 2%.
2. Find the user account using the exact username from the ticket (Microsoft Entra admin center, connector): If no exact match, stop and hand to the analyst with what was found.
3. Check the requester's role and route executives to the senior tech (Microsoft Entra admin center, connector): Executive cases go to the senior tech. How an executive is identified is an open question.
4. Ask the caller for employee ID and manager name (ServiceNow, person): The analyst collects the answers from the caller.
5. Compare the answers with directory records and show the match result (Microsoft Entra admin center, connector): Required before any reset. If it fails, no change is prepared.
6. Ask whether the user has a new phone (ServiceNow, person)
7. Fetch the MFA re-registration steps when the user has a new phone (Confluence, api): Replaces the manual knowledge-base lookup, which happens in about 18% of cases.
8. Prepare the reset or unlock and show the analyst a summary (Microsoft Entra admin center, ai): Summary shows user, action, verification result and any MFA step.
9. Approve the reset or unlock (ServiceNow, person): Policy: no unattended changes, so the analyst approves every change.
10. Apply the password reset or account unlock (Microsoft Entra admin center, connector)
11. Give the user the temporary password and confirm they can sign in (Outlook, person): The delivery channel is not yet defined. Any message to the user needs the analyst's sign-off.
12. Draft the standard resolution note (ServiceNow, ai): States that identity was verified, the reset was done and the user confirmed.
13. Approve the note and the closing of the ticket (ServiceNow, person): Only after the user confirms they can sign in.
14. Write the resolution note and set the State to resolved (ServiceNow, api)

## Approvals

- Analyst approves each reset or unlock before it is applied.
- Analyst signs off any message that carries the temporary password to the user.
- Analyst approves the resolution note and closing the ticket, after the user confirms they can sign in.

## Prerequisites

- Service account for Power Automate with rights to reset passwords and unlock accounts in Entra ID/AD, and a ServiceNow API account that can update tickets
- Confirmation that the employee ID and manager attributes are in the directory and accurate
- Confirmation of how Entra ID connects to on-premises Active Directory (for example password writeback), since analysts currently use Active Directory Users and Computers
- Copilot Studio and Power Automate licenses covering the connectors used
- Written standard resolution note template
- A defined way to identify executives (a group or title list)

## Risks

- The agent could reset the wrong account if the username is wrong, so it must use the exact ticket value and stop on a mismatch.
- Identity verification beyond employee ID and manager name is not agreed, which leaves room for inconsistent checks.
- A temporary password sent through an unsuitable channel creates a security exposure.
- Repeated lockouts from an old phone may not be fixed by the reset alone.
- Analysts may skip the approval step out of habit, which would reduce the safeguard.

## Measure after launch

- Median work time per case (baseline 6.1 min) and team hours per week (baseline 28.7 h at 251 cases)
- Share of cases where the username is retyped (28%) and mismatches (about 2%)
- Share of cases that redo steps (about 10%; 5% pause for a median of 1.6 h)
- Share of cases that need a manual knowledge-base lookup (baseline 18%)

## Decisions

| Decide | Rule | Source |
| --- | --- | --- |
| Handle the case or pass it to the senior tech | If the requester is an executive, hand it to the senior tech. Otherwise the analyst handles it directly. Most respondents agreed. What makes someone an executive and any other trigger for the senior tech are not defined. | team |
| Whether MFA re-registration is needed | If the user has a new phone, also do MFA re-registration following the steps on the Confluence page on unlocking accounts, in addition to the reset or unlock. Most respondents agreed. The share of cases with a new phone is not stated. | team |
| How to verify the requester's identity | Always verify the employee ID and the manager's name before any reset. Any further method (security questions, verification code or authenticator app, ticket or channel recognition) is split across respondents and not agreed. | team |
| Whether to approve the reset or unlock | The analyst approves every change, because policy forbids unattended actions. Which cases need an additional approval, and from whom, is not known yet: ask the team. | unknown |
| How to deliver the temporary password | Not known yet: ask the team | unknown |

## Still to answer before building

- Who gives the approval that causes a pause, and which cases need one? Is it tied to executive handling or something else?
- Which identity checks apply in which situations, and is there a written policy?
- What triggers the senior tech besides executives, and how is the handoff done?
- How is the temporary password delivered, and what happens if the user does not receive it?
- How is a repeat lockout from an old phone prevented?
- Can the agent read the requester's role and employee ID from the directory, and how are executives identified?
- Are accounts managed on-premises in Active Directory only, or synced with Entra ID so the Entra connector can reset them?

## Exceptions

- When Requester is an executive (mostly under 1 in 10 cases): The agent does not proceed. It hands the case to the senior tech with the ticket and the directory lookup.
- When User has a new phone (about 18% of cases open the knowledge-base page): The agent shows the MFA re-registration steps from Confluence. The analyst performs them in addition to the reset or unlock.
- When Caller fails the employee ID and manager name check: No reset is prepared. The agent hands to the analyst with the mismatch details, and the ticket stays open.
- When Username in the ticket does not match one directory account (about 2% of transfers mismatch): The agent stops, shows the closest candidates and asks the analyst to confirm with the caller.
- When Steps are redone (about 10% of cases): temporary password not received, or the account locks again from an old phone: The agent reopens the case with the earlier actions logged and hands to the analyst. The analyst repeats the approval step.
- When Case pauses after the State is set (about 5% of cases, median 1.6 hours, reason given as 'an approval'): The agent keeps the ticket open with the pending reason noted and reminds the analyst. Who approves is an open question.

## Build with

- Copilot Studio: Guides the analyst through verification questions, the new-phone question and the approvals.
- Power Automate: Runs the ServiceNow, Entra, Confluence and Outlook connector and API calls.
- ServiceNow: Source of the ticket and place for the resolution note and State.
- Microsoft Entra admin center: Looks up users and performs password resets and unlocks.
- Confluence: Provides the MFA re-registration steps.

## Effort and return

- Size M, about 3-5 weeks (Copilot Studio, Power Automate, ServiceNow API, Entra ID / AD administration)
- Team time on this task now: 29 h/week; expected back: 10-16 h/week

## Evidence

- 72% of cases follow the same steps
- 29 team hours a week
- data is moved by hand from ServiceNow to Active Directory Users and Computers (28% retyped)
- 15% of cases redo steps
- 18% of cases need an extra lookup (an exception the agent must handle)