IT Service Desk · Agent blueprint · validated with 6 team members
Remote Session Assistant (analyst copilot)
The company asked to keep remote troubleshooting with people, so this is an assistant, not an autonomous agent. It prepares likely causes and past fixes before the Quick Assist session and drafts the Work notes afterwards. The analyst runs the session and approves everything saved to the ticket.
92readiness · AI assist (a person acts)
2–4 hback per week, of 20 h now
$5K–11Ka year
2–4 wkto build · size M
Trigger
An analyst opens or picks up a ServiceNow incident from the queue and asks the assistant for a briefing (Copilot Studio chat or Microsoft 365 Copilot prompt).
Done when: The requester is satisfied, the analyst has approved and saved the resolution note and Work notes on the ServiceNow incident, and the analyst has closed the ticket (four of six respondents gave this answer).
Needs: ServiceNow incident: short description, description, requester, category, priority, prior work notes; Similar resolved ServiceNow incidents; Confluence knowledge base articles on remote sessions and common fixes; Intune device record for the requester's laptop: enrolled, last check-in, OS version; Analyst's short outcome input after the session (a few words or bullets)
What the agent does
- 1
Pick up the incident from the queue · ServiceNowpersonAnalyst starts the assistant on the chosen incident. Nothing runs unattended.
- 2
Read incident details and prior notes · ServiceNowapiRead-only call using a service account.
- 3
Check whether the laptop is enrolled and recently online · IntuneconnectorRead-only. Flags offline or unenrolled devices before the analyst starts a session.
- 4
Find similar past incidents and matching knowledge articles · ConfluenceapiSearches Confluence and past ServiceNow tickets for the symptoms in the incident.
- 5
Draft likely causes, suggested checks and past fixes with links · Microsoft 365 CopilotaiSuggestions only. The analyst decides which tools to open (Event Viewer, Device Manager).
- 6
Run the Quick Assist session and diagnose the problem · Quick AssistpersonStays manual. Quick Assist, Event Viewer and Device Manager are local tools and are not automated.
- 7
Enter a few words on what was done and the result · Microsoft 365 Copilotperson
- 8
Draft Work notes and resolution note from the analyst's input · Microsoft 365 CopilotaiUses symptoms, steps taken, result and follow-up. No fixed template exists yet.
- 9
Review, edit and approve the note before it is saved · ServiceNowpersonRequired because saving changes a ticket record and policy forbids unattended actions.
- 10
Save approved note to the incident Work notes · ServiceNowconnectorPower Automate flow runs only after the analyst's approval click.
- 11
If unsolved, draft a hand-over summary for the analyst to review · Microsoft 365 CopilotaiCovers what was tried, device state and findings. The analyst picks the target team and does the reassignment.
Decisions the agent makes
| Decide | Rule | Source |
|---|
| How urgent leadership requests are handled (queue order, process, documentation) | Team says leadership requests are treated differently but did not say how, for example whether they jump the queue. Not known yet: ask the team. | Not known yet |
| Which team gets the case when the remote session does not solve it, and what inf | All six respondents said they are not sure who gets the case or what is sent. The assistant only drafts a summary and the analyst chooses. | Not known yet |
| Which diagnostic tools to open (Quick Assist, Event Viewer, Device Manager) | Team gave no criteria. Observed: Quick Assist in about 65% of cases, Event Viewer and Device Manager in about 71% each. The assistant only suggests, and the analyst decides. | Not known yet |
| What the Work notes contain | Team: a short statement of what was done and the outcome, with no fixed template. The draft follows that and keeps it short until a template is agreed. | The team |
| Whether a ticket may be closed | Team: the requester is satisfied and the ticket is closed. Company rule: every ticket gets a resolution note before closing. The analyst closes it. | The team |
Where a person signs off
- Analyst approves the Work notes or resolution note before it is written to ServiceNow
- Analyst approves any reassignment or escalation of the ticket and chooses the target team
- Analyst closes the ticket. The assistant never closes tickets or contacts the requester on its own.
Exceptions
| When | What the agent does |
|---|
| About 19% of cases are only an incident open plus a Work notes edit (about 3 min), with no remote session | Skip the Intune check and diagnostics suggestions. Offer only the note draft. |
| Device is offline or not enrolled in Intune (team says about 20% of stopped sessions) | Show the device status in the briefing so the analyst can contact the requester or route the case. The assistant takes no action. |
| Problem needs another team (team says about 40% of stopped sessions) | Draft a hand-over summary of findings. The analyst picks the team, because the team could not say who receives these cases. |
| Missing permissions or approval, or the employee is unavailable (about 20% each of stopped sessions) | Note the blocker in the draft. For access issues remind the analyst that the manager's approval must be recorded on the request first. The analyst decides next steps. |
| Urgent request from leadership (often, 1 in 10 to 1 in 3 cases according to most respondents) | Flag the requester and urgency in the briefing only. Do not change priority or queue order until the team defines the rule. |
| Incident involves a password reset or access change | Remind the analyst that identity must be verified (password resets) or manager approval recorded (access requests) before acting. The assistant does not perform these actions. |
Build with
- Microsoft 365 Copilot: Gives analysts suggestions and drafts notes inside their daily tools
- Copilot Studio: Hosts the assistant that takes an incident number and returns the briefing and the draft note
- Power Automate: Calls ServiceNow, Confluence and Intune, and writes the approved note back to ServiceNow
- ServiceNow: Source of incidents and past tickets, and the place the approved Work notes are saved
- Confluence: Knowledge base for fixes and the remote-session rules
Skills: Copilot Studio, Power Automate, ServiceNow API basics, Knowledge base prompt tuning
Before building
- Microsoft 365 Copilot licenses for the analysts, and Copilot Studio and Power Automate available to the builder
- ServiceNow service account: read on incidents, write limited to Work notes
- Confluence API access with read rights to the knowledge base and the remote-session articles
- Read-only Intune connector permissions for device status
- Confirmation from security that ticket content may be processed by Copilot
- The knowledge base remote-session rules (consent, identity checks, approvals, access limits) written down so the assistant can quote them
Risks
- Time saved may be small (estimated 8-20%) because the median Work notes edit is already about 10 seconds, so most time goes to the live session
- Suggestions may be wrong or outdated if Confluence articles are stale. Analysts must treat them as hints.
- Notes drafted by AI may be accepted without careful reading, so approval must show the full text
- Remote-session rules are not documented in the answers, so the assistant could miss consent or identity steps
- The company asked for no agent on this task. Keep the design to analyst assistance and do not automate the session.
How we'll know it worked
- Median work minutes per case: baseline 16.6 min (20.7 min for the full session path)
- Time spent on the ServiceNow incident step: baseline median 184 s
- Team hours per week on remote support: baseline 20 hours across 79 cases
- First-contact resolution and requester satisfaction, compared with before the pilot
Still to answer before building
- What do the knowledge base rules say about user consent, identity verification, approvals and access limits during remote sessions?
- Who receives the case when a remote session fails, and what information must be sent with it?
- How are urgent leadership requests handled differently (priority, process, documentation)?
- What counts as resolved beyond requester satisfaction and ticket closure (confirmation method, required fields)?
- What criteria decide which diagnostic tools to use?
- Is there a standard Work notes template (symptoms, steps, result, follow-up)?
- Is Copilot allowed to read ServiceNow ticket content, which may include personal data?
Where the team disagrees
Settle these first: an agent needs one rule, and new hires get mixed answers today.
- Frequency of unusual cases: most say they come up often, but some say sometimes or almost never.
Evidence
- the client asked for no agent on this task; AI can still help the person doing it
- 84% of cases follow the same steps (some skip a step)
- 20 team hours a week
Observed main path (63% of cases): Quick Assist → Event Viewer → Device Manager → Incident (ServiceNow) → Edit Work notes
Handover spec for the builder (text) →
Designed by AI from how the team did this work (2026-10-19 to 2026-10-23), the company's tools and its rules. A starting point for the builder: confirm system access and approvals before building.