Example Co. · IT Service Desk · 2026-10-19 to 2026-10-24
How the work actually flows
Each task below is built from every case the team handled: the steps people actually take, how many follow the main path, where work is redone, and how long cases sit waiting. Password resets and account unlocks takes the most time (29 of 111 tracked hours a week). The biggest wait: 26% of provision software and access requests cases pause about 2.7 hours.
Password resets and account unlocks
251 cases a week · 6 people · typical case: 6 min of work
Of all the time cases are open, 49% is someone working and 51% is waiting.
Main path · followed by 72% of cases · 6 min
Account locked (ServiceNow)1 min
→Active Directory Users and Computers2 min
→Edit New password
→Account locked (ServiceNow)1 min
→Edit Resolution notes
→Edit State10 s
| Path | Cases | Work | Start to finish |
|---|
| Main path | 72% | 6 min | 6 min |
| Adds “How to unlock an account · IT Knowledge Base (Confluence)” | 15% | 7 min | 7 min |
| Repeats “Edit Resolution notes”, “Edit New password” | 4% | 13 min | 1.0 h |
| Other paths (each used by fewer than 5 people, pooled) | 10% | | |
Where time leaks
- 17% of cases add “How to unlock an account · IT Knowledge Base (Confluence)”, adding about 2 min each time.
- 5% of cases are picked up again after a pause and steps are redone (usually “Edit New password”, “Edit Resolution notes”).
- 5% of cases wait after “Edit State”, typically 1.6 hours.
- Data is moved by hand from ServiceNow to Active Directory Users and Computers in most cases; 28% of the time it's retyped rather than pasted, and 2% of moved values didn't match the source.
Training guide for this task →
Status update emails to users
310 cases a week · 6 people · typical case: 4 min of work
Of all the time cases are open, 16% is someone working and 84% is waiting.
Main path · followed by 82% of cases · 4 min
Microsoft Outlook4 min
→Edit Message body10 s
| Path | Cases | Work | Start to finish |
|---|
| Main path | 82% | 4 min | 4 min |
| Pauses after “Edit Message body”, then picks up again; repeats “Edit Message body” | 14% | 8 min | 2.3 h |
| Other paths (each used by fewer than 5 people, pooled) | 4% | | |
Where time leaks
- 16% of cases are picked up again after a pause and steps are redone (usually “Edit Message body”).
- 16% of cases wait after “Edit Message body”, typically 2.1 hours.
Training guide for this task →
Triage and route incoming tickets
323 cases a week · 6 people · typical case: 3 min of work
Of all the time cases are open, 28% is someone working and 72% is waiting.
Main path · followed by 87% of cases · 3 min
Incident (ServiceNow)3 min
→Edit Category
→Edit Priority
→Edit Assignment group10 s
| Path | Cases | Work | Start to finish |
|---|
| Main path | 87% | 3 min | 3 min |
| Pauses after “Edit Assignment group”, then picks up again; repeats “Edit Assignment group” | 6% | 4 min | 1.2 h |
| Repeats “Edit Message body”; adds “Microsoft Outlook”, “Edit Message body”; skips “Incident (ServiceNow)”, “Edit Category” | 4% | 3 min | 3 min |
| Other paths (each used by fewer than 5 people, pooled) | 2% | | |
Where time leaks
- 6% of cases are picked up again after a pause and steps are redone (usually “Edit Assignment group”).
- 7% of cases wait after “Edit Assignment group”, typically 1.1 hours.
How choices are made (from recorded dropdowns)
- When Category is Access, Assignment group is Service Desk (90% of 125 cases)
- When Category is Software, Assignment group is App Support (94% of 72 cases)
- When Category is Hardware, Assignment group is Desktop Support (93% of 70 cases)
- When Category is Network, Assignment group is Network Ops (98% of 43 cases)
Training guide for this task →
Remote troubleshooting sessions
69 cases a week · 6 people · typical case: 18 min of work
Main path · followed by 74% of cases · 21 min
Quick Assist5 min
→Event Viewer7 min
→Device Manager5 min
→Incident (ServiceNow)3 min
→Edit Work notes10 s
| Path | Cases | Work | Start to finish |
|---|
| Main path | 74% | 21 min | 21 min |
| Skips “Quick Assist”, “Event Viewer” | 19% | 3 min | 3 min |
| Other paths (each used by fewer than 5 people, pooled) | 7% | | |
Training guide for this task →
Provision software and access requests
114 cases a week · 6 people · typical case: 9 min of work
Of all the time cases are open, 18% is someone working and 82% is waiting.
Main path · followed by 40% of cases · 9 min
Requested Item (ServiceNow)2 min
→Groups (Microsoft Entra admin center)3 min
→Edit Add members
→Licenses (Microsoft admin center)2 min
→Edit Assign license
→Requested Item (ServiceNow)2 min
→Edit Work notes
→Edit State10 s
| Path | Cases | Work | Start to finish |
|---|
| Main path | 40% | 9 min | 9 min |
| Pauses after “Requested Item (ServiceNow)”, then picks up again | 15% | 11 min | 2.6 h |
| Skips “Edit Assign license” | 14% | 8 min | 8 min |
| Pauses after “Requested Item (ServiceNow)”, then picks up again; skips “Edit Assign license” | 8% | 9 min | 3.1 h |
| Other paths (each used by fewer than 5 people, pooled) | 23% | | |
Where time leaks
- 7% of cases do the same steps in a different order: a sign the procedure isn't written down.
- 26% of cases wait after “Requested Item (ServiceNow)”, typically 2.7 hours.
- Data is moved by hand from ServiceNow to Microsoft Entra admin center in most cases; 42% of the time it's retyped rather than pasted, and 1% of moved values didn't match the source.
- Data is moved by hand from ServiceNow to Microsoft 365 admin center in most cases.
How choices are made (from recorded dropdowns)
- When Add members is SG-Visio-Users, Assign license is Visio Plan 2 (100% of 35 cases)
- When Add members is SG-Project-Users, Assign license is Project Plan 3 (100% of 22 cases)
- When Add members is SG-Adobe-Users, Assign license is Adobe Acrobat Pro (100% of 18 cases)
Training guide for this task →
How this was built
Steps are linked into cases by record numbers (kept only as one-way codes) and timing. Paths are compared, never people: a path is only shown when at least 5 people followed it. “Waiting” is any pause of 30 minutes or more on an open case; cases handed between colleagues can't be followed yet, so waits between people are not counted.