Service desk automation

Service Desk Automation Starts With Access Requests

Access requests are one of the largest, most repetitive categories in the IT ticket queue: add this person to that group, give them the right shared mailbox, grant the application role for their new team. Every joiner, mover, and leaver produces a wave of them, and each one waits in line for a service desk agent to action it by hand. ServiceChanger automates this class of work out of the queue entirely. Instead of routing access requests to a human, ServiceChanger assigns and revokes group and role membership in Microsoft Entra ID and on-prem Active Directory based on who the person is. The ticket never needs to be raised. This is where service desk automation pays off fastest: a high-volume, predictable workload that does not need judgement, just consistent execution.

One Attribute Value Maps to a Set of Groups

The core of ServiceChanger is a simple model: one attribute value maps to a whole set of groups and roles. You define the mappings once. A department of "Finance" maps to the finance shared drives, the finance distribution lists, the accounting application role, and the VPN profile. A job title of "Field Engineer" maps to the mobile device policy, the field app, and the regional security group. When someone's attributes match, ServiceChanger assigns every group in that set. You do not maintain group-by-group membership lists; you maintain the mapping that says what a Finance person in Amsterdam should have. This turns dozens of individual access decisions into one definition you can read, review, and audit.

Worked Example: New Hire in Finance Amsterdam

A new hire starts in Finance at the Amsterdam office. Their account is created with department "Finance" and location "Amsterdam". That is all the input ServiceChanger needs. The matching attribute values resolve to a set of six groups: the finance shared drive, the finance distribution list, the accounting application role, the Amsterdam-office Wi-Fi and print group, the VPN profile, and the standard staff baseline. All six are assigned automatically, no ticket, no agent. Three months later the same person moves to the Rotterdam office. Location changes to "Rotterdam", and ServiceChanger swaps the Amsterdam group set for the Rotterdam one in the same step: the Amsterdam Wi-Fi and print group comes off, Rotterdam goes on, finance access stays. When they leave the company, their attributes no longer match any active mapping and every assigned group is revoked. Joiner, mover, and leaver access all run off the same attribute mappings.

How It Works: Entra ID, Active Directory, and a PowerShell Runbook

ServiceChanger works with the directory you already run. Where Entra ID dynamic groups can express a mapping, it uses them directly: a group whose membership is defined by an attribute query so the right people are always in it. For sets that span on-prem Active Directory or need logic beyond a single dynamic-group query, a PowerShell runbook on a hybrid worker applies the changes, and Entra Connect keeps Entra ID and on-prem AD in sync so a change made once shows up in both. There is no agent on the endpoint and no screen-scraping; this is directory automation, not RPA. ServiceChanger reads attributes, resolves the model, and writes group and role membership. The licensing module only tracks usage of assigned applications; it does not provision them and is not part of the access logic.

Rolling It Out and Keeping Access Correct

Rollout is about defining mappings, not deploying robots. First, define your attribute-to-group mappings: pick the attributes you trust to drive access (department, job title, location) and write down which set of groups each value should grant. Second, validate a new mapping against a small test group of real accounts before it applies broadly, so you can confirm the resulting membership is exactly what you expect. Third, let the mappings run. From then on, access stays correct on its own: when an attribute changes, the assigned set changes with it, with no follow-up ticket. Because access is derived from current attributes rather than a one-time grant, drift between what someone has and what their role calls for stops accumulating. Note: ServiceChanger automates access fulfilment for internal IT and employees. If you are looking to classify, triage, or answer support tickets with AI agents, that is a separate product, ITSM Autopilot at itsmautopilot.com. ServiceChanger does not do AI ticket resolution, chatbots, or NLP.

FAQs on Service Desk Automation With ServiceChanger