IT and helpdesk automation in a mid-sized company: tickets, passwords, access, laptops and licences

In many mid-sized companies, requests reach the IT person by email, by phone, via Teams and in the corridor. Nobody knows how many there are, which ones come back every week and how much time they take. Without this knowledge, it is easy to automate something that happens twice a year.

So the first step is simple and cheap. For three months, record every request with a category and an approximate handling time. Typical categories in a company of 100–200 people look like those in the table below, but the proportions in your company may be completely different.

A ticketing system is a register in which every request to IT has a number, an owner, a status and a deadline. Employees can see what is happening with their request, and you can see how many requests are waiting and for how long. This is the foundation for any further automation.

It does not have to be an expensive system. The choice depends on how many IT staff you have and whether IT support is provided by an external company. We compare the most common options in the table below.

A forgotten password is one of the most common requests, and also the easiest to hand over to employees. Microsoft Entra ID, the service that manages accounts and sign-in in Microsoft 365, lets you set up self-service password reset. The employee confirms their identity with a phone or an app and sets a new password without contacting IT.

For accounts that exist only in the cloud, this feature is included in Microsoft 365 Business Standard and higher plans. If accounts are synchronised with a server in the office, the new password has to be written back to that server. This requires Business Premium or an Entra ID P1 licence.

Work out what this gives you using your own data. Assume 20 resets a month at 10 minutes each – that is about 40 hours of IT time a year. That is not much, but it also removes the wait for an employee who cannot work without a password.

While you are at it, it is worth sorting out two-step sign-in, i.e. confirming sign-in with a phone. The default security settings in Entra ID enforce it for everyone without an additional licence. Conditional access – for example, blocking sign-in to the finance system from personal computers – does require Entra ID P1.

A request for access to a folder or application usually arrives by email, without the line manager’s approval. The IT person then has to chase up who agrees, or grants access on trust. After a few years, nobody knows who has access to what and why.

It works better when the employee chooses the resource from a list in a form, and Power Automate asks the resource owner or line manager for approval. Once approved, access is granted automatically by adding the person to a group, and the decision is kept on record. The same history comes in handy during a security audit.

For new starters and leavers, granting access by department works best. We describe this in detail in a separate guide on automating employee onboarding. Once a quarter, it is also worth sending managers a list of people with access to their resources for confirmation.

Setting up a laptop by hand can take the IT person several hours, and after a failure it has to be done again. Intune, Microsoft’s service for managing company devices, together with Windows Autopilot changes this. A new computer straight from the supplier installs the company’s apps and settings on its own after the first sign-in.

Intune also keeps track of system updates and disk encryption. It shows devices that do not meet company rules, and a lost laptop can be wiped remotely. Employees can install approved programs themselves from the company catalogue, without raising a ticket with IT.

Intune Plan 1 is included in Microsoft 365 Business Premium, E3 and E5, and on its own costs USD 8 per user per month. If your company has Business Premium, it is often just a matter of configuring it.

Licences continue to be paid for after an employee leaves if nobody releases them. On top of that come applications bought by individual departments that IT does not know about. Microsoft 365 has activity reports in its admin centre that show who has not used email, Teams or OneDrive for a long time.

It is enough for the IT person or the CFO to receive a list of accounts inactive for 60 days once a month – prepared manually from the report or automatically in Power Automate. Add to this a summary of licences purchased and assigned. For each item, someone decides whether to release it, reassign it or keep it.

Do the maths on your own data: number of unused licences × monthly price from the invoice × 12. Do the same for other applications paid per user, such as your CRM system, design tools or monday.com.

In many companies, the IT person checks every morning whether the servers are running and whether the overnight backup has completed. If something stops working at night, the company finds out from the first employee who cannot sign in the next morning.

A monitoring system checks this continuously and sends a notification to a Teams channel when something crosses a set threshold. Examples include disk space running out, a failed backup or a website that is down. There are many tools, from free to commercial ones; Azure Monitor works best mainly for servers in the Microsoft cloud.

One rule matters more than the choice of tool: an alert must go to a specific person who knows what to do. Too many notifications quickly mean nobody reads them. So start with a few of the most important signals – above all, backup checks.

An AI assistant can answer employees’ questions such as “how do I connect the printer” or “how do I share a file with a customer”. In Microsoft 365 you can build one in Copilot Studio, which is billed by usage (in Copilot credits), and Jira Service Management has built-in AI features for this.

There is one condition: the assistant answers only on the basis of instructions that someone has written and keeps up to date. If the company has no written instructions, the assistant will have nothing to work with. First collect the most common questions from the ticket register and write short answers to them.

AI should not grant permissions or change system configuration on its own. During security incidents it can help review events, but a person makes the decision.

Since 3 April 2026, the amended Polish National Cybersecurity System Act (KSC Act), which implements the NIS2 directive, has been in force. If your company is an essential or important entity, it must report serious incidents within strict deadlines. An early warning must be sent within 24 hours, a notification within 72 hours and a final report within a month.

Meeting these deadlines is difficult if an incident was reported to the IT person by phone and nobody wrote it down. A well-run ticketing system with a separate category for security incidents gives you the date, time and course of events. Even if the act does not apply to your company, such a register is useful when talking to an insurer or an auditor.

The best order for a mid-sized company usually looks like the steps below. Each one delivers results on its own, so you can stop at any stage.

Automation makes no sense where there are a few requests a week and one IT person knows everyone by name. In that case, a shared ticket list and self-service password reset are enough. If your IT is run by an external company, first ask which items on this list are already part of its service.