Help Desk SOP: How To Write One, With Templates You Can Copy

SOP: [The job, as a technician says it]
Summary: [The critical steps in one or two lines]
Starts when: [The trigger, usually a ticket class]
Done by: [Who runs it, and the access they need]
Steps:
1. [One action per step, verb first, in order]
2. [If X, do Y. Mark every branch]
Escalate when: [Condition] -> [to whom]
Done when: [What the closed ticket shows]
Records: [What gets logged, and where]
SOP owner: [Role] · Next review: [date]

SOP: Ticket intake
Summary: Every request becomes a ticket before work starts.
Starts when: A request arrives by email, portal, phone, chat
Done by: Technician on intake
Steps:
1. Create or find the ticket. No ticket, no work.
2. Confirm the user, company, and callback number.
3. Write the problem in the user's words.
4. Set the class. Link duplicates to one parent ticket.
5. Reply to the user with the ticket number.
Escalate when: Many users report the same outage
  -> Major incident SOP
Done when: User, class, description, and reply are on it
Records: Channel and first reply on the ticket
SOP owner: [Lead technician] · Next review: [date]

SOP: Triage and priority
Summary: Priority comes from impact and urgency.
Starts when: A new ticket lands in the queue
Done by: Technician on intake
Steps:
1. Suspected security event (odd sign-in, phishing
   click, ransom note)? -> Major incident SOP, security
   branch, now. Skip the grid.
2. Impact: one user, a team, or the whole company?
3. Urgency: is work stopped, or is there a workaround?
4. Set priority from both answers:
   P1 Company stopped -> Major incident SOP
   P2 Team stopped, or one user with no workaround
   P3 One user stopped, workaround exists
   P4 Nobody stopped
5. Apply the targets for that priority.
   Example targets; replace with client-agreed targets:
   Priority  First reply  Updates   Resolve
   P1        15 min       30 min    4 hours
   P2        1 hour       4 hours   1 business day
   P3        4 hours      Daily     3 business days
   P4        1 bus. day   On change 5 business days
6. Assign to the queue for the class.
Escalate when: A target will be missed -> lead
  technician, before it lapses
Done when: Priority, class, assignee, and target set
Records: One-line priority reason on the ticket
SOP owner: [Lead technician] · Next review: [date]

SOP: Escalation
Summary: Escalate with notes, never instead of trying.
Starts when: [30] minutes without progress, or the fix
  needs access or skills you don't have
Done by: Assigned technician
Steps:
1. Write what you tried and what happened, in order.
2. Attach logs, screenshots, and error text.
3. Name the reason: skill, access, approval, or vendor.
4. Assign to [Tier 2 technician] or open a case with
   [vendor]. Tell the user who has it now.
Escalate when: P1 -> [owner], by phone, now
Done when: Next tier accepted, notes attached, user told
Records: Escalation reason and receiver on the ticket
SOP owner: [Lead technician] · Next review: [date]

SOP: Diagnosis, resolution, and closure
Summary: Reproduce, fix, confirm with the user, close.
Starts when: A technician picks up an assigned ticket
Done by: Assigned technician
Steps:
1. Reproduce the problem, or watch the user hit it.
2. Search the knowledge base and closed tickets.
3. Collect screenshots, error text, logs, device name.
4. Decide: fix now, workaround, or Escalation SOP.
5. Apply the fix. Note what you changed and where.
6. Ask the user to test while you're still on it.
7. No reply: remind after [2] business days, and again
   after [2] more. [2] days after the second reminder,
   close as "no reply"; a reply reopens it.
8. Close with the cause and fix in one line each.
9. Seen this fix twice? Draft a knowledge base article.
Escalate when: The fix fails twice -> Escalation SOP
Done when: User confirms, or closed as "no reply"
  after two reminders
Records: Cause, fix, and time spent on the ticket
SOP owner: [Lead technician] · Next review: [date]

SOP: Password and MFA reset
Summary: Verify identity twice, fix what is broken,
  notify the user.
Starts when: Ticket class "Account access", ordinary
  user accounts only (admin accounts -> [client admin])
Done by: Technician with the Entra Authentication
  Administrator role
Steps:
1. Never reset on the inbound call alone.
2. Call back on the number in the client's contact
   list, not one the caller gives.
3. Second check, as agreed in writing with each client:
   the office manager confirms by email.
Only after both checks pass, in Entra admin center >
Users > [user] > Authentication methods:
4. Forgotten or locked password -> Reset password. The
   temporary password must be changed at next sign-in.
5. Phone lost or replaced, or MFA prompts fail:
   a. Note methods that step b doesn't delete
      (passkey, Windows Hello). Phones and Authenticator
      are deleted.
   b. Require re-register MFA, then Revoke sessions.
   c. A step-a method works -> the user signs in and
      adds the new phone in Security info, on the call.
   d. No method left -> issue a Temporary Access Pass
      if the TAP policy covers the user; if not,
      escalate to [client admin].
6. Both problems -> do 4, then 5.
7. Email the address on file: "Your sign-in was reset
   at [time]. Reply if this wasn't you."
Escalate when: A check fails or the caller pushes for
  speed -> stop, call the office manager
Done when: Identity verified, user signed in, notice
  sent
Records: Checks used and branch taken, in a
  technician-only note
SOP owner: Lead technician · Next review: Jan 15, 2027

SOP: Onboarding and offboarding
Summary: Named approver in; every account and device out.
Starts when: [The client contact] names a starter or
  leaver, with a date
Done by: [Lead technician]
Onboarding:
1. Get written approval from [role], with start date.
2. Create accounts from the role list. Turn on MFA.
3. Assign and record the device. Test sign-in.
Offboarding:
1. Disable sign-in within [4 hours] of the end time.
2. Revoke sessions, MFA, and VPN access.
3. Change shared passwords the person knew.
4. Hand mailbox and files to [named manager].
5. Recover the laptop, phone, and badge.
Escalate when: No written approval, or a device is
  missing -> client contact
Done when: Every line on the role list is ticked
Records: Approval and the ticked role list on the ticket
SOP owner: [Lead technician] · Next review: [date]

SOP: Major incident
Summary: One owner, one parent ticket, updates on a clock.
Starts when: [5+ users or a whole site] can't work, or a
  security event is suspected
Done by: Incident owner ([lead technician on call])
Steps:
1. Declare it. Open one parent ticket; link the rest.
2. Name one incident owner. Everyone reports to them.
3. Pick the branch:
   Outage, no sign of compromise -> restore service
   first, find the root cause after.
   Suspected security event -> call [security contact]
   and follow your incident response plan. Keep logs.
   No restore, reimage, or wipe until they agree.
4. Tell the client contact within [15 minutes]: what's
   down, who's on it, next update time.
5. Update every [30 minutes], even "no change".
6. Close the parent and its linked tickets together.
7. Review within [5 business days]; fix the SOPs it hit.
Escalate when: An outage shows signs of compromise ->
  switch to the security branch
Done when: Service restored, users told, review held
Records: Timeline and every update on the parent ticket
SOP owner: [Owner] · Next review: after every incident