Help desk automation is the set of rules that does a queue's repeat work without a technician: opening scheduled tickets, turning email into tickets, assigning owners, and sending reminders. On a small team, automate the work that repeats on a fixed pattern first. Keep the judgment calls with a person.
Below: what to automate first, what to keep manual, a rule card you can copy, and how to test a rule and when to switch it off. It comes from the team behind SherpaDesk, a helpdesk and PSA (professional services automation) tool a small IT team can run alone.
Key takeaways
It's a set of rules your helpdesk tool runs for you. TechTarget describes service desk automation as "system integrations, rules-based workflows and increasing AI capabilities" across ticket intake, classification, routing, resolution, and escalation. For a small team the two terms are close enough; "service desk" is the IT service management (ITSM) word.
Definition
Automation rule: a trigger, a condition, and an action. When this happens, to these tickets, do that.
On a team of one to ten technicians, almost every rule is one of five kinds:
| Kind | Trigger | Example | What goes wrong |
|---|---|---|---|
| Scheduled ticket | A date and a recurrence | A backup restore test opens on the 1st of each month | Tickets pile up when nobody owns them |
| Email to ticket | A message reaches the support address | A client's email becomes a ticket with a number | Auto-replies and newsletters become tickets too |
| Assignment rule | A new ticket matches a condition | Network tickets go to the network admin | The ticket waits for someone who's on leave |
| Reminder | Time passes with no update | The owner and a backup hear about a ticket untouched for four hours | Noise that technicians learn to ignore |
| Status message | A ticket changes state | A receipt on create; a closing note with a survey link | Mail that tells the user nothing |
Every repeat chore costs minutes, and they grow with every client, device, and building. Google's site reliability engineers call this kind of work toil: "manual, repetitive, automatable, tactical, devoid of enduring value," and work that "scales linearly as a service grows."
On a helpdesk, toil is copying an email into a ticket, or remembering that a client's restore test is due. None of it needs judgment, and all of it gets skipped in a busy week.
Count the time, not the tickets. As one r/CIO member put it, "You should care more about total time spent on requests than just volume." Enter only the minutes the rule removes. A scheduled ticket saves the remembering and the setup; the restore test itself still takes a person.
What one rule saves
minutes removed × times per month ÷ 60. Your numbers stay in the browser.
Then ask the question the r/CIO poster ended with: "Did it actually free up your team, or did you just end up managing the automations instead?" A rule you babysit for two hours a month must save more than two.
Automate a task when it passes four tests:
One r/ITManagers member drew the same line: "Any time you can map a process logically, handling all outcomes, automate it. Any time there is nuance, variation or you want oversight, bring a human in".
| Task | Decision | Why |
|---|---|---|
| Opening recurring maintenance tickets | Automate | Fixed calendar, same checklist each time |
| Turning support email into tickets | Automate | Same step every time; the log shows it ran |
| Assigning by class or client | Automate; a person covers absences | A wrong owner is cheap to fix |
| Reminders on untouched tickets | Automate | Elapsed time needs no judgment |
| Receipt and closing emails | Automate | Same message; the closing note can carry a survey link |
| Setting priority | Keep manual | Impact needs a person; users mark everything urgent |
| Password or MFA reset done by a technician | Keep the identity check manual | Attackers call helpdesks pretending to be staff |
| Purchases and privileged access | Keep the approval with a person | Mistakes are expensive and hard to undo |
| Outage updates to users | Keep manual | The facts change by the hour |
Resets are the trap. TechTarget calls automated resets low-risk; the self-service portals some companies use "have multifactor authentication in place to verify user identity." A reset a technician does by phone or email is different.
CISA's advisory on the Scattered Spider group describes attackers who "Posed as employees to convince IT and/or helpdesk staff" to act for them. The goal: reset a password and "transfer the employee's MFA to a device they control." No rule should skip that identity check. Our helpdesk best practices cover how to verify the caller.
Approvals stay human. Activities "involving production changes, privileged access or infrastructure often require human approval". Automate the reminder to the approver, not the yes or no.
TechTarget warns that "Automating legacy or inconsistent processes often fails to deliver the expected improvements". An r/CIO member put it shorter: "you can't automate what isn't documented or known."
Have five things in place first:
Roll out one change at a time, in this order. Move on when the rule has run one full cycle with a checked result.
List every chore that repeats on a calendar, and make each one a scheduled ticket that opens with its checklist. NIST's Cybersecurity Framework 2.0 lists as outcomes that backups are "created, protected, maintained, and tested," and software "maintained, replaced, and removed commensurate with risk." A closed ticket with the steps ticked is your record that the test happened.
Example: one r/msp member said that for manual maintenance, "we would use recurring tickets that people tracked time against/included a checklist."
Common mistake: letting maintenance bury user tickets. Another r/msp member advised setting priorities and queues "so your techs don't get overwhelmed with the recurring tickets piling on top of the user tickets."
Every request that arrives by email should become a ticket with an owner. Forwarding, auto-reply loops, and which senders may open tickets are covered step by step in our email ticketing guide.
Example: support@ feeds the queue; backup and monitoring alerts go to a separate address with its own rule.
Common mistake: pointing newsletters and alerts at the support address, then closing them by hand every morning.
If your tool takes email commands, a technician on site can close a ticket or log time by replying to the ticket email, so Friday's timesheet isn't rebuilt from memory.
Example: a tech logs a 15-minute printer fix from the client's parking lot.
Common mistake: turning the feature on and never teaching it. Put the three commands your team uses most on one card.
Send each class to an owner. Then make cover a process, not a rule: one named person checks the unassigned queue and reassigns an absent owner's tickets at fixed times. A solo technician agrees cover in advance with an outside tech or partner MSP: what they may access, and what waits until you're back. The full method is in our ticket triage guide.
Example: at the 8:00 a.m. sweep, the lead tech moves tickets from anyone out today to the backup on the coverage list.
Common mistake: assuming the rule handles vacations. The ticket waits two weeks for a technician who's away.
Set a time-based reminder for tickets with no update, sent to the owner and the named backup. TechTarget warns that "high volumes of redundant or low-priority alerts" cause alert fatigue.
Example: a high-priority ticket with no update for four hours alerts the owner and the backup tech.
Common mistake: copying the whole team on every reminder, so nobody acts.
Write every rule on a card before you build it.
Automation rule cardAutomation rule card
Name: [what it does, in plain words]
Kind: [scheduled ticket / email to ticket / assignment / reminder / status message]
Trigger: [date and recurrence, or the event that fires it]
Due: [when the work must be done]
Applies to: [which accounts, classes, or senders]
Action: [what it creates, changes, or sends]
Owner: [person who keeps the rule working]
Cover person: [who takes the work when the owner is out]
Checklist: [steps the ticket opens with, if any]
Done when: [what the technician records before closing]
Tested: [date] by [name]; paths tried: [list]
Next review: [date]
Retire when: [the condition that ends the rule]
Example
Name: Monthly backup restore test, Harbor Dental
Kind: Scheduled ticket
Trigger: 1st of each month, 9:00 a.m.
Due: 5th of each month
Applies to: Harbor Dental account only
Action: Opens a ticket in the Backup class with the checklist below
Owner: Dana, backup lead
Cover person: Sam, senior tech, takes them at the 10:00 a.m. sweep
Checklist: 1. Restore one file from last night's backup
2. Open it and confirm it reads
3. Delete the test copy
Done when: file name, backup date, and restore time are in the ticket
Tested: [date] by [name]; paths tried: owner in, owner out (taken at 10:00),
other accounts (no ticket opens)
Next review: first week of next quarter
Retire when: Harbor Dental leaves, or its backup service runs
and reports its own restore tests
A starting calendar for three common settings:
| Chore | Setting | Recurrence | Checklist starts with |
|---|---|---|---|
| Backup restore test | MSP, one ticket per client | Monthly | Restore one file, record the time |
| Patch report review | MSP and internal IT | Weekly | Failed patches, pending reboots, one ticket per failure |
| License and domain renewals | MSP and internal IT | Monthly, for anything due in 60 days | List, owner, renewal decision |
| Leaver account review | Internal IT | Monthly | Compare the HR leaver list with active accounts |
| Chromebook cart check | School, one ticket per building | Weekly | Count, charge, and log damaged devices |
One r/msp poster feared "100s of reoccurring ticket tasks and a big mess to manage." The cards prevent that: every scheduled ticket has an owner, a review date, and a reason to end.
A rule that runs isn't the same as a rule that works. One r/ITManagers poster described the risk: "The script runs. The log says done. The ticket closes. Then a week later someone finds out the account, permission, report, or alert never actually changed."
Test what the rule should do, and what it should leave alone:
Then watch one full cycle with a person checking the result: a week for a weekly rule, a month for a monthly one. It starts on what one r/msp member called "knowing the automation is actually working"; quarterly reviews do the rest.
Subscribe to the SherpaDesk Blog.
Get Tips for Running IT With a Small Team.
Loading form…
The form couldn’t load. Please try again.
Or start your free trial →SHERPADESK · FREE TRIAL
Resolve tickets.
Turn time into revenue.
Bring support tickets, billable time, and invoicing into one place. Built for small IT teams and MSPs.
After your trial, keep your first agent free forever.
SHERPADESK · LIVE DEMO
See tickets, time,
and billing work together.
Walk through ticketing, time tracking, and billing with a product specialist. See how SherpaDesk fits the way your team works.
A live walkthrough tailored to your team.
Read five numbers monthly.
| Measure | How to read it | What a bad month points to |
|---|---|---|
| Scheduled tickets closed by their due date | Share per rule | No owner, or a checklist that's too long |
| Rule-made junk and duplicates | Count per rule; a check that found nothing wrong doesn't count | The rule fires too widely; a retire candidate |
| Reassigned because the first owner was wrong | Share per rule; planned cover doesn't count | The condition or the owner is wrong |
| Reminders per technician per day | Average, and the top name | Thresholds too tight; people stop reading them |
| Time saved vs time spent on upkeep | Calculator hours saved per month minus monthly upkeep hours | The rule costs more than the chore did |
Review on a calendar, too. Quarterly suits most rules. One r/ITManagers member audits new ones monthly: "It all needs audited each month to check that it's working."
Retire a rule when any of these is true:
When another tool takes over a chore, retire its rule and keep one check on the new tool.
How this works in SherpaDesk
You set recurring work under Tickets > Scheduled, with days, time, and recurrence type, and attach a To Do template so each ticket opens with its checklist. The API can create scheduled tickets too.
Once support@ forwards to a dropbox address, incoming emails become tickets. Technicians can log time and close a ticket in one email reply, with commands such as "cmd time" and "cmd close". Routing rules send chosen classes to a technician, and time-based notification rules can target the assigned and alternate techs. It runs for your own staff or for clients you support.
A helpdesk and PSA a small IT team can run alone. No contract. No implementation project. No dedicated admin.
Base Camp is $45 per agent per month ($40 billed annually). The first agent is free, forever, and the trial is 14 days free with no card.
Ticket Management In SherpaDesk →
Who this isn't for
This guide covers rules a small team writes and owns. A large service desk with approval chains and a workflow engine needs a different guide. Patching itself belongs in your RMM. We don't build RMM. We integrate with yours, and the stack stays yours.
Work that repeats on a pattern with the same steps: scheduled maintenance tickets, email intake, assignment by class, reminders, and receipt and closing emails. Priority, identity checks before a reset, approvals, and outage updates stay with a person. The four tests sort the rest.
Parts of it are. In the r/CIO thread on the question, commenters named password resets, access requests, and onboarding as the candidates. A small team gets more from calendar and email rules first, measured one at a time. Add the next rule only when the last one runs cleanly.
Mostly vocabulary. Service desk automation is the ITSM term and often reaches into provisioning and monitoring systems. On a small helpdesk it means a handful of rules: scheduled tickets, email intake, assignment, reminders, and status messages. The four tests and the rule card apply to both.
Self-service resets can be, when the portal verifies the user with multifactor authentication. A reset a technician does by phone or email should keep a manual identity check. CISA reports attackers posing as employees to get helpdesk staff to reset passwords and move MFA to their own devices.
Check a new rule after its first full cycle, then give it a review date; quarterly suits most rules. In between, read the monthly numbers in the measures table, and retire a rule whose tickets are junk or duplicates three months running. Hand a rule to a new owner the day its owner leaves.
No. The RMM deploys patches and reports the results. A scheduled ticket covers the person's part: reading the weekly patch report, opening a ticket for each failure, and recording the review. NIST's framework lists as an outcome that software is "maintained, replaced, and removed commensurate with risk," and the closed ticket is your record.
Patrick co-founded SherpaDesk and has led it as CEO since 2013. He has worked with IT service providers since 1998, first on network projects for schools and government offices, then on the helpdesk software their technicians use every day.