What happens when the agent can't resolve a ticket — does it just dump it on a technician?

When the agent escalates, it provides the technician with a structured handoff: full message thread with timestamps, classification reasoning, attempted resolution paths and why each failed, relevant configuration items from ConnectWise, recent ticket history for the same user or device, related tickets across the client (so the tech can see if this is a one-off or part of a broader issue), and a suggested first action with rationale. Technicians reviewed 30 days of agent escalations and rated the handoff context useful or excellent in 88% of cases — meaningfully better than the historical context they got from a coworker in a manual handoff. The agent's job is to solve what it can solve and to make the human's job easier on what it cannot. Tier-2 and Tier-3 technician satisfaction with the system was higher than Tier-1, because they receive better-prepared work.

How does the proactive client communication workflow improve NPS?

MSP NPS surveys consistently show that client perception of service quality is driven by communication frequency more than by raw resolution time. Clients tolerate a 4-hour ticket if they receive 3 status updates and feel attended to; clients give negative NPS scores on 30-minute tickets where they got no acknowledgment until the resolution. The proactive communication workflow generates an automatic acknowledgment within 90 seconds of ticket submission ('We've received your ticket and assigned it to [tech]; expected first response by [time]'), interim updates at 30 minutes and 2 hours for any open ticket ('Working on your issue — current status: [status]; expected resolution by [time]'), proactive communication on RMM-detected issues before clients notice ('We're aware of [issue] affecting [system]; resolving now, no action needed'), and post-resolution check-in. Communication volume tripled while technician time on communication dropped 64%. NPS climbed from 38 to 71 — the structural shift was in perception of attentiveness, not change in technical quality.

Is this the kind of agentic AI Gartner has been writing about — or just a workflow with a chatbot?

The implementation in this case includes both deterministic workflow automation (predictable, scripted paths for common ticket types) and agent-based components (GPT-4 reasoning over ticket content, configuration data, and historical resolutions to choose actions). The agentic portion handles classification, resolution path selection, and tool invocation (calling Graph API, querying ConnectWise, triggering RMM actions) within bounded guardrails — the agent cannot take destructive actions, cannot bypass approval workflows for changes outside its scope, and cannot escalate privilege beyond what its service principal is authorized for. Gartner's 2024–2025 research on agentic AI flagged that production-grade agent deployments require strong guardrails, observability, and human-in-the-loop for material decisions; this implementation reflects those design principles. The MSP's CTO requested every agent action log to MS Sentinel for security review during the first 60 days, and zero anomalies were flagged.

MSP / IT Services

May 10, 2026·9 min read·Swift Headway AI

14-Tech MSP Cuts Tier-1 Ticket Time 79% and Lifts NPS From 38 to 71 With Agentic AI Triage and Password Auto-Resolution

Q: Does this work with ConnectWise, Autotask, HaloPSA, Kaseya BMS, or SuperOps?

ConnectWise PSA exposes a documented REST API covering tickets, contacts, agreements, time entries, and configurations. Autotask PSA (Datto) provides comparable API access. HaloPSA is API-first with strong webhook support. Kaseya BMS offers REST API integration. SuperOps (newer cloud-native PSA) has full API and webhook support. The reference implementation in this case used ConnectWise PSA with Microsoft Graph API for identity-related auto-resolution. Architecture is platform-agnostic: any PSA with documented API works as the system of record. RMM integration (NinjaOne, Datto RMM, ConnectWise Automate, Atera, N-able) is layered separately for endpoint-level remediation.

Q: How does agentic AI safely handle password resets without bypassing security controls?

Password reset auto-resolution is gated by the same identity verification controls a Tier-1 technician would use, not bypassed. The agent verifies caller identity through the client's existing MFA (Microsoft Entra ID via Graph API), validates the request is from a registered employee with active status (Entra ID + the client's HR data feed where available), checks the caller is in the population eligible for self-service reset (executive accounts and privileged accounts are excluded by default), and then triggers the reset through Entra's official self-service password reset flow — the same flow IT would invoke. The AI does not generate passwords, store credentials, or store any credential material. For accounts not eligible for auto-resolution (privileged accounts, accounts with anomalous sign-in patterns, accounts flagged by the SIEM), the agent escalates to Tier-2 with full context. Auto-resolution rate for password reset tickets reached 73%; the remaining 27% appropriately required human handling. The MSP's vCISO reviewed and approved every gating rule before deployment.

A 14-technician managed service provider in Atlanta, GA — serving 84 SMB clients across professional services, healthcare, and light manufacturing — was drowning in 1,400 tickets per month against a technician roster that had grown only 17% in the same window. Average resolution time had drifted from 2.6 hours to 5.2 hours, NPS had collapsed from 52 to 38, and gross margin had compressed by 7 points as labor costs absorbed the gap. Agentic AI built on ConnectWise PSA, Microsoft Graph API, n8n, and GPT-4 cut Tier-1 ticket handle time 79%, lifted NPS to 71, restored technician utilization to 78%, and recovered $94k of compressed margin inside 90 days — with full payback in 28 days.

Key Results

79%

Tier-1 handle time cut

across automated and AI-assisted tickets

Net Promoter Score

up from 38 — 33-point lift

1.1 hrs

Avg resolution time

down from 5.2 hrs — 79% faster

$94k

Margin recovered

compressed margin recovered in 90 days

The Client

A 14-technician managed service provider — anonymized at client request — headquartered in Atlanta, GA, serving 84 SMB clients across the metro area. Client mix: professional services (38%), healthcare practices (24%), light manufacturing (18%), nonprofits and education (12%), and retail/hospitality (8%). Total seats under management: approximately 2,940 endpoints. Annual MRR: approximately $310k. Technician roster: 4 Tier-1, 5 Tier-2, 3 Tier-3, 1 vCIO, and 1 dispatch coordinator, plus owner/operator and CTO.

The MSP had been in business for 12 years and held the Microsoft Solutions Partner designation plus several vendor specialty certifications. The challenge was that ticket volume was growing faster than the team could scale: client cybersecurity needs had expanded the per-seat workload, and Microsoft 365 admin tasks and Entra ID identity work had both grown materially as clients moved deeper into cloud-first operations. The team was working hard, working long hours, and falling behind anyway.

The Problem: Ticket Volume Growth Outpacing Headcount

The math was unambiguous. 1,400 tickets per month against 14 technicians averaging 32 productive hours per week per tech (after meetings, vacation, sick, training) produced approximately 1,792 technician hours per month. Average ticket required 1.4 hours of technician time end-to-end (work plus communication plus documentation). 1,400 tickets × 1.4 hours = 1,960 hours of demand against 1,792 hours of supply. The deficit had been absorbed by overtime, deferred non-billable work (documentation, vCIO planning, internal automation), and escalation-skipping (Tier-1 punting tickets up to Tier-2 to clear queue rather than handling them).

Pre-Automation Service Delivery Pressure

Monthly ticket volume

1,400 tickets

Up 27% YoY; client base up 19%, but per-seat ticket volume up 8% from cybersecurity and identity workload

Average resolution time

5.2 hours

Up from 2.6 hours 18 months prior; clients comparing notes complaining of slower response

Technician utilization

62%

Down from 74% — backlog meant techs were context-switching and starting tickets they couldn't finish

Tier-1 vs Tier-2 mix

62% / 38%

Healthy MSPs run 75/20/5 across tiers; this MSP was escalating too often because Tier-1 was overloaded

Net Promoter Score

Down from 52 in prior 18 months; below the MSP industry median of 47 (Service Leadership 2024 benchmark)

Gross margin compression

−7 pts

Margin down from 64% to 57% as labor cost absorbed the volume-headcount gap

The owner had analyzed ticket categories with a vCIO consultant and found that 51% of tickets were in three categories that were unambiguously automatable: password reset and account lockout (22%), MFA-related issues (14%), and standard onboarding/offboarding requests (15%). The remaining 49% required real technician judgment — but the 51% automatable bucket was consuming more than half of Tier-1 capacity and crowding out the work that actually required expertise.

The Solution: Agentic AI for the Automatable Half

Tech Stack

ConnectWise PSA

System of record — tickets, contacts, agreements, time entries, configurations; all workflow triggers and outcomes pull from and write to ConnectWise via REST API

Microsoft Graph API

Identity and M365 administrative actions — Entra ID password reset, MFA reset, group membership, license assignment, mailbox and Teams provisioning, conditional access policy queries

n8n (self-hosted)

Agentic orchestration layer — ticket classification routing, eligibility checks before action invocation, escalation paths, audit logging to MS Sentinel

GPT-4 via API

Ticket classification, resolution path selection, technician handoff context generation, client communication drafting, knowledge base retrieval reasoning

NinjaOne RMM

Endpoint-level monitoring and remediation — automated patch deployment, drive cleanup, service restart, software install/uninstall via approved scripts

MS Sentinel

Security audit log destination — every agent action recorded with full context for vCISO and compliance review

Implementation: 5 Weeks With Phased Rollout

Ticket Classification and Triage Agent (Week 1–2)

Inbound ticket from email-to-PSA, client portal, or RMM alert → ConnectWise → n8n agent. GPT-4 classifies by category (password reset, MFA, M365, hardware, network, application, security incident, other), priority (urgent/high/medium/low based on agreement SLA and ticket content), and complexity (auto-resolvable, auto-assisted, human-only). Auto-resolvable tickets route to the relevant action agent. Auto-assisted tickets pre-populate the technician's first response with classification, suggested action, relevant KB articles, recent ticket history for the same user, and configuration item context. Human-only tickets route to dispatch with the same context bundle. Average classification time: 4 seconds. Misclassification rate: 2.1% over 90 days.

Password Reset and MFA Auto-Resolution (Week 2)

Eligibility-gated agentic action. For password reset tickets: agent verifies caller identity via Entra ID MFA challenge, validates active employment status from Entra and HR feed where available, checks the account is in the self-service-eligible population (privileged accounts excluded), then triggers Entra's official self-service password reset flow. For MFA reset tickets: agent verifies caller identity through alternate MFA method, validates the MFA reset is permitted by client policy, then resets the MFA enrollment via Graph API. Auto-resolution rate: 73% of password reset tickets, 64% of MFA tickets. Remaining cases properly escalate to a tech with full context. Every action logged to MS Sentinel for vCISO review.

Onboarding/Offboarding Standard-Run Automation (Week 2–3)

New-hire request from client HR contact → agent confirms request authority, applies the client-specific onboarding template (M365 license, Entra group memberships, Teams channels, mailbox setup, MFA enrollment instructions, equipment provisioning checklist for dispatch), executes Graph API actions, generates a credential delivery package via secure portal, and notifies the client HR contact and the new hire. Offboarding mirror: agent applies the offboarding template (license suspension, mailbox conversion, group removal, app revocation, OAuth token revocation, archive policy, equipment recovery checklist), executes, and confirms. Onboarding TAT dropped from 6.4 hours to 32 minutes; offboarding from 4.1 hours to 18 minutes.

Proactive Client Communication on All Open Tickets (Week 3)

Every ticket gets automatic 90-second acknowledgment with assigned technician name and expected first-response window per SLA. Open ticket interim updates at 30 minutes and 2 hours: 'Working on your issue — current status: [status]; expected resolution by [time]'. RMM-detected issues get pre-emptive client communication before the client notices ('We're aware of [issue] affecting [system]; remediating now, no action needed'). Resolution close gets a satisfaction check question. Communication volume to clients tripled while technician time spent on communication dropped 64%. Clients moved from 'we never hear from them until it's broken' to 'we always know where things stand'.

Knowledge Base Capture and Continuous Improvement (Week 4–5)

Agent's structured handoff context generated for every escalated ticket includes attempted resolution paths and why each failed. Resolved tickets feed back into the KB: GPT-4 generates a draft KB article from successful resolution patterns and submits it to the lead Tier-3 tech for review. Approved KB entries become reference data for future ticket classification and resolution suggestions. Over 90 days, 124 new KB articles approved — the MSP's previously thin KB became a structured asset that further improved agent and technician performance compounding over time.

Results at 30 and 90 Days

−79%

Tier-1 handle time

Across automated and AI-assisted tickets. Auto-resolved tickets close in seconds; AI-assisted close in 0.4 hours vs. 1.4 baseline

1.1 hrs

Average resolution time

Down from 5.2 hrs. Includes both auto-resolved and human-handled tickets

Net Promoter Score

Up from 38 — 33-point lift. Top-quartile MSP territory (Service Leadership benchmark)

78%

Technician utilization

Up from 62%. Technicians focused on the 49% of tickets that require expertise; the rest handled by agents

76% / 19% / 5%

Tier mix

Healthy mix restored. Tier-1 properly handling routine; Tier-2 for complex; Tier-3 for architecture and projects

$94k

Margin recovered

Compressed margin recovered in 90 days. Annualized run-rate: approximately $376k. Path back to 64% gross margin

Why MSP Margin Recovery Now Comes Through Agents, Not Headcount

The 2025–2026 MSP market is structurally squeezed. Service Leadership 2024 benchmark data showed median MSP gross margin compressing 4.8 points across the 2022–2024 window as labor costs grew faster than per-seat MRR. The traditional response — hire more technicians — has become difficult: skilled MSP technicians are scarce, salaries have risen materially, and adding headcount to a service queue does not always reduce per-ticket time because of communication and coordination overhead.

Agentic AI changes the cost model for the automatable portion of MSP work. Password reset, MFA, standard onboarding, and similar routine tickets had been Tier-1 work for two decades because no other approach was viable. The combination of GPT-4-class reasoning, Graph API access, and PSA integration finally makes those tickets agent-resolvable — not by replacing humans, but by handling the predictable cases inside guardrails so humans focus on judgment-required cases. The 51% of tickets that fall in the automatable bucket no longer need to consume Tier-1 hours.

The NPS lift is the more strategic outcome than the margin lift. MSPs compete with each other on service quality, and NPS is a leading indicator of churn and referral. An MSP at 71 NPS keeps clients longer, gets more referrals, and earns the right to charge premium per-seat rates. The agent-driven communication frequency improvement is what moved NPS — not faster resolution time, although faster resolution time helped. Clients want to feel attended to. Agents that send a 90-second acknowledgment and a 30-minute status update make that feeling continuous.

Frequently Asked Questions

Does this work with ConnectWise, Autotask, HaloPSA, Kaseya BMS, or SuperOps?

ConnectWise PSA, Autotask, HaloPSA, Kaseya BMS, and SuperOps all expose API access. Reference implementation used ConnectWise PSA with Microsoft Graph API for identity actions. Architecture is platform-agnostic. RMM integration (NinjaOne, Datto, Atera, N-able) layered separately for endpoint remediation.

How does agentic AI safely handle password resets without bypassing security?

Same identity verification controls a Tier-1 tech would use, not bypassed. Agent verifies via Entra MFA, validates active employment, checks self-service eligibility (privileged accounts excluded), triggers Entra's official self-service password reset flow. AI does not generate passwords or store credentials. vCISO reviewed and approved every gating rule before deployment.

What happens when the agent can't resolve — does it dump tickets on technicians?

Agent provides structured handoff: full context, classification reasoning, attempted paths, configuration items, recent ticket history, related cross-client tickets, suggested first action with rationale. Technicians rated handoff context useful or excellent in 88% of cases — better than typical manual handoff context.

How does proactive communication improve NPS?

Client perception of service quality is driven more by communication frequency than raw resolution time. 90-second auto-acknowledgment, 30-minute and 2-hour interim updates, RMM-detected issue pre-emptive comms, and post-resolution check-in tripled communication volume while reducing tech time on communication 64%. NPS climbed 33 points.

Is this real agentic AI per Gartner, or just a workflow with a chatbot?

Both deterministic workflow automation and agent-based components — GPT-4 reasoning over ticket content, configuration data, and history to choose actions inside bounded guardrails. Cannot take destructive actions, cannot bypass approvals, cannot escalate privilege. Every agent action logged to MS Sentinel for security review.

AI Agents: Production-Grade Agentic Systems for SMBs

AI Employees: When Software Becomes a Teammate

Agentic AI for Business: What Production Looks Like in 2026

Gartner's Agentic AI Failure Rate — and How to Avoid It

Case Study: SaaS Sales Team Cuts CRM Admin 84%

Case Study: 45-Person Tech Company Cuts Onboarding 79%

AI Workflow Automation for IT Operations

AI Customer Support: Tier-1 Automation Without Breaking Trust

BCG: The $200B Agentic AI Services Gap

See All Case Studies →

Swift Headway AI Team

Engineers and automation specialists building production agentic AI for MSPs, IT services, SaaS sales teams, and operations-heavy SMBs. This case study reflects a real client engagement; MSP details anonymized at client request.

Your MSP

See What Agentic AI Looks Like for Your Service Desk

Book a free Operations Audit. We analyze your ticket category mix, technician utilization, NPS trend, and PSA/RMM stack — and design what an agentic ticket flow would deliver for your MSP.

Get Free Operations Audit →

← Back to Case Studies