How to reduce Tier 1 IT tickets with AI, without sacrificing the employee experience

The AI tools that do the most to reduce Tier 1 IT tickets are agents that fix requests where employees already ask for help: in Slack or Microsoft Teams. Chatbots that link to articles, and tools that route tickets faster, mostly move the work around. They don't take it off your team's plate.

The difference comes down to context. An agent that knows who is asking (their role, devices, apps and access) can actually take care of the request: reset a password, unlock MFA or grant access, within the rules your team sets. When a request needs a person, it hands off with everything already filled in.

For an enterprise, the agent also needs the controls you'd expect from any system that touches access: permission-aware answers, approvals and a full audit trail. STLabs is built this way.

This guide is for IT leaders and CIOs supporting thousands of employees. It covers why context matters so much, how the main types of AI tools compare, what to require before rolling one out, and how to estimate the impact from your own ticket data.

Where Tier 1 volume actually comes from

Tier 1 work is rarely hard. What makes it expensive is scale. The same few requests come in thousands of times a month, and the right fix often depends on who's asking. In most enterprises, the volume lands in five places.

• Sign-in problems. Forgotten passwords, lockouts and MFA resets, which tend to spike after a password policy change, a device refresh or a new authenticator rollout. HDI research published in 2011 found that roughly three in ten support tickets are password resets.
• Access requests. A Salesforce license for a new sales hire, a finance shared drive, a Microsoft 365 group. Volume climbs with every hiring wave and reorg, and the right answer depends on role, team, region and employment type.
• How-to questions. VPN setup, hardware requests, finding the right policy. Everyone asks the same questions, but the right answer changes with the person's device and setup.
• Device and app issues with a standard fix. A stuck Intune update, a full mailbox, an expired certificate.
• Outage reports. One failing service becomes hundreds of tickets in an hour, each described differently.

In every group, the fix is already known. What isn't known when the request comes in is which fix applies to this person, and whether they're allowed to have it. Working that out is where most Tier 1 time goes. It's also what an AI agent has to get right before it can resolve anything.

Why context decides whether AI resolves or just responds

Any AI model can write a confident answer to an IT question. Without context, though, it can't know whether that answer is right for the person asking, and it can't safely act for them. That's the difference between an agent that closes tickets and a chatbot that sits in front of the same queue.

Three kinds of context do most of the work:

• Identity and organization. Role, team, manager, office, employment type. This lives in your HR system and identity provider, and it decides what someone is allowed to have and who approves exceptions.
• Devices and applications. Which laptop, which operating system, whether it is managed by Jamf or Intune, which apps and licenses are assigned. This determines which fix applies.
• Access and live state. Current group memberships and entitlements, plus what is happening right now: an open incident, a pending approval, a change rolled out this morning.

Without that context, an agent falls back on what made Tier 1 slow to begin with: back-and-forth questions, generic articles and tickets passed to a person to sort out. With it, the agent can go straight to the right fix, check it against policy and do it. When it does need to hand off, whoever picks it up already has the full picture.

Most enterprises already have this information. It's just spread across the identity provider, HR system, device management and ITSM tool. A CMDB was supposed to bring it together, but few teams can keep one up to date by hand. STLabs builds this picture, which we call Axiom, from the systems you already run and keeps it current automatically.

A useful test when evaluating any vendor: ask what the agent knows about an employee before they send their first message, and where each piece of that knowledge comes from.

Which AI tools reduce Tier 1 tickets?

Most AI tools for IT support fall into one of three types. The type decides how much Tier 1 work it can ever take off your queue.

A tool that only answers questions can only ever take on the questions. Sign-in problems and access requests, usually your two biggest groups, need an agent that can make changes in your identity, HR and device systems, and that knows enough about the person to make the right ones. See what kinds of requests STLabs resolves automatically.

What enterprise IT should require from an AI agent

An agent that resets passwords and changes access is working inside your production systems. It should pass the same security review as anything else with that level of access. Before rolling one out company-wide, check for:

• Permission-aware answers. Employees only see information they're already allowed to see. See how STLabs enforces permissions.
• Policies and approvals your team owns. IT defines which requests auto-approve, which route to a manager or system owner, and when temporary access expires.
• A complete audit trail. Every AI decision, workflow run and configuration change is logged and searchable, so you can answer an auditor or reconstruct a mistake. See how STLabs supports audit and compliance.
• Versioned, reviewable automation. Workflow changes go through review and can be rolled back, like any other change to production.
• Identity and data controls. SSO via SAML 2.0, SCIM provisioning, encryption in transit and at rest, and a choice of data region. See STLabs security and data residency.
• Integration with the stack you already run. Your identity provider, HR system, device management and ITSM platform, which is also where the agent's context comes from. See STLabs integrations.

Resolution, not deflection: sizing a realistic target

The number to hold AI tools to is resolution rate: how often the problem actually got fixed. Many vendors quote deflection rate instead, which counts any request that never became a ticket. That includes the employee who gave up and asked a coworker, or came back the next day with the same problem. Turning someone away isn't the same as helping them, and a business case built on deflection won't hold up with your CFO.

One rule keeps the number honest: if the same person returns about the same issue within 48 hours, the first contact does not count as resolved.

Your realistic rate depends on your ticket mix, and you can estimate it before talking to any vendor:

1. Export the last 90 days of tickets from your ITSM platform.
2. Group them by request type, using the five groups above or your own taxonomy.
3. For each group, estimate how much could be answered from your documentation, how much could be fixed by an action your policies already allow (a reset, an unlock, a standard access grant), and how much needs a person's judgment.
4. The first two shares combined are your ceiling for resolution without IT involvement.
5. Multiply the resolvable volume by your current handling time for each group. That is the analyst capacity available to redirect, and the core of the business case.

Here is how that works for an illustrative 12,000-ticket quarter:

In this example, about two thirds of Tier 1 tickets could be resolved without an analyst. That frees up around 1,500 hours a quarter, or three to four full-time analysts' worth of time over a year, for projects, security and escalations. These figures are illustrative; your own mix is what counts.

Most teams find more of their tickets fall into that middle bucket than they expected, because so much Tier 1 work is the same few actions on repeat. Expect the rate to rise over the first few months as more systems are connected and more repeated fixes become approved workflows.

Eight ways to reduce Tier 1 tickets with AI

1. Resolve requests in Slack and Microsoft Teams

Employees already message IT in Slack or Teams, and most portal rollouts are an attempt to get them to stop. It's easier to meet them there: let them ask in plain language and fix the request in the same conversation. Most requests never become tickets, and the ones that do are still tracked in your ITSM platform. See Employee Self-Service.

2. Start with password resets and MFA unlocks

Sign-in problems are usually the biggest Tier 1 group. They have a standard fix and it's easy to tell whether the fix worked, so they're the right place to start. The agent confirms who the employee is, runs the approved reset or unlock, and asks them to sign in again, all in one conversation.

3. Answer with the employee's context, not a generic article

"How do I set up VPN?" has one answer on a Jamf-managed MacBook, another on an Intune-managed Windows laptop, and a third for a contractor rather than a full-time engineer. An answer that already accounts for role, device and apps fixes the problem; a link to a generic article starts a back-and-forth. Axiom supplies that context for STLabs from your existing systems.

4. Let policy approve routine access requests

Most access decisions already follow unwritten rules: everyone in sales gets a Sales Cloud license; engineers get staging access for a working day. Write them down once, based on title, team and office in your HR system, and matching requests get approved in seconds. Requests outside a rule go to the right approver with the context attached. See STLabs policies and approvals.

5. Group duplicate outage reports by cause

When a shared service fails, employees describe it as different problems: "Workday won't load," "Outlook won't sign in," "the VPN keeps dropping." Grouping those reports by their cause turns hundreds of tickets into one incident your team fixes once and closes together. See how related tickets are grouped.

6. Prioritize by impact so P1s surface first

Once routine requests are handled, the tickets left in the queue should be sorted by how much they matter. Because Axiom knows who and what each issue touches, a ticket arrives with its impact already clear: the systems involved, the owner and how many people are affected. A failing payroll export that affects 3,200 employees is flagged and routed ahead of a single laptop request, with its SLA and owner set before anyone logs in. See STLabs automated triage.

7. Turn repeated fixes into governed workflows

If your team has fixed the same issue dozens of times with the same steps, it should be able to fix itself. Turn those fixes into approved, versioned workflows that run when a matching request comes in, with the same review and rollback you'd expect for any production change. See STLabs workflow automation.

8. Route judgment calls to people, with full context

Some requests should go to a person: policy exceptions, sensitive access, suspected security issues, and hardware that needs hands-on attention. The goal isn't to automate these. It's to make the handoff painless. The agent should pass along who's asking, their device, their current access and everything already tried, so the analyst can start on the problem instead of asking the same questions again. See what happens when the agent can't resolve a request.

How to roll it out across a large organization

You don't need to replace your service desk to start. STLabs can run alongside your current platform and take on more as each request type proves itself. Rollouts that work at enterprise scale usually look like this:

1. Connect identity, HR and device systems first. These supply the agent's context. Discovery begins as soon as the first integration is live, and the agent can start resolving requests within the first week. See how long setup takes.
2. Pilot one request type with one population. Password resets for a single office or business unit gives you a clean comparison against the rest of the company.
3. Measure against your 90-day baseline, then expand to the next request type and the next population.
4. Move approvals out of inboxes and into policy as each request type shows it can be handled reliably.

How to reduce tickets without hurting the employee experience

Cutting tickets backfires if employees feel stuck. It shows up as shadow IT, complaints to managers and less trust in the service desk. Four rules keep automation on the employee's side:

• A person is always one step away. No one should have to argue with an agent to reach a human.
• Every response ends in a fix or a clear next step. "I've reset your MFA, try signing in now," or "This needs your manager's approval; I've asked them and will update you here."
• The request stays in one place. An employee who asked in Teams gets the resolution and every update in Teams.
• Every automated action is visible to IT. When a fix goes wrong, your team can see exactly what happened and why.

How to measure Tier 1 ticket reduction

Whatever tooling you use, report these monthly against your 90-day baseline:

These numbers are only believable if they come from the system that did the work. In STLabs, Analytics reports what the agent resolved and what it passed to a person using the same data the product runs on, so the numbers your CIO sees match what really happened. Volume spikes come back explained by the cluster behind them, such as a wave of VPN reconnects. You can ask questions in plain language, like "What's driving ticket volume this month?" or "Who has been waiting longest?", and get answers from live data. Every action, approval and resolution is recorded, so the results stand up to finance, security and audit.

Frequently asked questions

What is the difference between Tier 1 and Tier 2 support?

Tier 1 (or Level 1) support handles requests with a known fix: password resets, standard access, how-to questions. Tier 2 handles issues that require investigation or specialist knowledge, usually escalated from Tier 1.

Which Tier 1 tickets should you automate first?

Start with the largest group that has a standard fix and a clear policy. For most organizations that is password resets and MFA unlocks, followed by access requests. Both are high-volume, low-risk to automate with approvals in place, and easy to measure.

How do you stop an AI agent from granting access it shouldn't?

The agent should only act within policies your team defines, check every request against the requester's identity and current entitlements, and route anything outside a rule to a named approver. Every decision should be logged so it can be reviewed, and every workflow versioned so it can be rolled back.

What's the difference between ticket deflection and resolution?

Deflection counts requests that never became a ticket, including employees who gave up. Resolution counts requests where the problem was actually fixed. Resolution is the more honest measure, especially when paired with a 48-hour re-contact check.

Can an AI agent work alongside our existing ITSM platform?

Yes. STLabs connects to ITSM platforms including ServiceNow, Jira Service Management and Freshservice, and can run alongside your current platform before taking on more.