Automating Password Resets - and the 10 Other Tickets to Automate First

There is no ticket type IT leaders complain about more, and none they should feel less sentimental about losing. Gartner analysts have estimated that between 20% and 50% of all help desk calls are password resets, and Forrester Research has put the average help desk labor cost of a single reset at around $70. Neither figure is new - which is the uncomfortable part. The password reset has been the best-documented waste in IT operations for over a decade, and in most organizations a human being still handles it.

The cost is not only in the queue. A Yubico-sponsored study found the average employee loses roughly 11 hours a year to password resets, which the report priced at about $5.2 million in annual productivity for a 15,000-person organization. Multiply a trivial task by everyone, and it stops being trivial.

This article covers two things: how automated password resets actually work when done securely - because the naïve version is a social-engineering gift - and, since no one should stop at resets, a prioritized list of the next ten ticket types to automate, framed by effort and impact.

Why Password Resets Are the Canonical First Automation

Password resets have every property you want in a first automation target:

• Massive, steady volume. They arrive every day, spike on Monday mornings and after long weekends, and never stop.
• Zero judgment required. The workflow is identical every time: verify identity, reset credential, confirm. There is no edge case an agent "handles better."
• Painful urgency. A locked-out employee can do nothing. Every minute in a queue is a minute of fully stopped work, which is why resets generate both high volume and high frustration.
• A solved technical problem. Directory APIs (Entra ID, Okta, Active Directory) expose reset and unlock operations; the hard part is verification, and MFA infrastructure has made that tractable too.

If your service desk still handles resets manually, you are paying senior-skill wages for a workflow a machine executes better, faster, and - done properly - more securely.

How Secure Automated Password Resets Work

The entire security of an automated reset rests on one question: is the person requesting the reset actually the account owner? Attackers know this. Help desk impersonation - calling support, pretending to be an employee, and talking an agent into a reset or MFA change - has featured in several of the most damaging breaches of recent years. That is worth stating plainly: the human-operated reset process is itself an attack surface, because humans can be charmed, rushed, and pressured. A well-designed automated flow cannot.

A secure automated reset flow looks like this:

1. Authenticated intake. The request starts from an authenticated context wherever possible - the employee's Slack or Teams account, which is itself protected by SSO and device policy. That alone establishes a strong signal that a phone call never provides.

2. Step-up verification with existing MFA factors. Before anything resets, the system challenges the user with factors already enrolled: an authenticator push or TOTP code, a passkey or hardware key touch, or a one-time code to a verified device. Policies can require two factors for sensitive accounts. Critically, the automation applies this policy every single time - it never gets sweet-talked into skipping a step because the caller sounds stressed and mentions the CFO.

3. Risk-aware escalation. Verification failures, impossible-travel signals, requests for privileged accounts, or repeated attempts route to a human security workflow - with the full context attached - instead of completing. Automation should narrow the human role to exactly the cases that deserve suspicion.

4. Execution and confirmation. The reset or account unlock executes via the directory API (Entra ID, Okta, AD), sessions are optionally revoked, and the employee gets confirmation plus a notification through a second channel so a hijacked reset never goes unnoticed.

5. Logging. Every request, verification result, and reset lands in an audit log, giving security a dataset that manual phone resets never produced.

Two notes on scope. First, "self-service password reset" portals (Entra SSPR, Okta's reset flows) already exist - the gap is adoption. Employees forget the portal exists, fail enrollment, or hit edge cases like expired on-prem AD passwords, and each failure becomes a call. Meeting employees in chat, with an agent that handles enrollment gaps and edge cases conversationally, is what finally moves the adoption needle. Second, the strategic endgame is fewer passwords: SSO consolidation and passkeys shrink the reset problem at the root. Automate the resets you have while you reduce the passwords you need.

The 10 Tickets to Automate Next

Password resets are the entry point, not the destination. A platform that resolves the reset should be judged on what else it resolves - which is the difference between a point tool and AI-native service management. Here is the queue-clearing order that works in practice, ranked by the ratio of impact to implementation effort.

1. App access requests. In Fixify's 2026 help desk benchmark, an employee requesting application access accounted for more than one in four tickets - the single biggest category. Policy-based approvals, provisioning through your IdP, and time-bound grants automate most of it end to end; we cover the full architecture in our guide to automating access requests.

2. Account unlocks and MFA resets. The password reset's siblings, sharing the same verification machinery you just built. MFA resets deserve the strictest verification policy you have - they are the attacker's favorite request.

3. Software installs and license requests. "Can I get Adobe?" becomes: check eligibility and license pool, get approval if the seat costs money, assign via your MDM or license admin API. Bonus: automated license reclamation from inactive users often pays for the automation platform by itself.

4. Distribution list and group membership changes. Low drama, surprising volume, and trivially automatable against Google Workspace or Microsoft 365 APIs with owner approval. A perfect early win.

5. How-do-I questions. VPN setup, expense tool confusion, "where do I find X" - pure knowledge retrieval that an agent grounded in your actual docs answers instantly in Slack. This is also where automation stops being an IT-only story, since the same capability answers HR and finance questions on one platform - the core of enterprise service management.

6. Onboarding provisioning. Higher effort because it spans HR, IT, and facilities, but the payoff is a new hire who is productive at 9 a.m. on day one instead of day four. Role-based access bundles do most of the work. See our playbook on automating onboarding and offboarding.

7. Offboarding and deprovisioning. The mirror image, and the one with security stakes: orphaned accounts and lingering access are standing risk. Automation triggered from the HRIS makes revocation same-hour instead of someday. Verizon's 2025 DBIR found credential abuse remains the most common way breaches begin - dormant accounts are exactly that exposure.

8. Shared drive and folder permissions. Same pattern as app access - request, owner approval, grant, expiry - applied to Google Drive, SharePoint, and file shares.

9. Triage and routing. Even tickets that need humans benefit: an agent that categorizes, prioritizes, gathers the diagnostic details agents always have to ask for, and routes to the right team cuts resolution time on everything else in the queue.

10. Hardware requests and refreshes. Eligibility checks against refresh policy, catalog selection in chat, approval, and a purchase or shipping workflow. Lower volume, but high visibility with executives and new hires.

Work the list roughly in order, but let your own ticket data override it - the right sequence is your volume ranking filtered by feasibility. And if you are evaluating platforms to execute this roadmap, our comparison of the best IT automation tools for 2026 breaks down the field.

The Compounding Effect

Each item on the list shares infrastructure with the others: the identity verification built for resets secures MFA changes; the approval engine built for app access handles software licenses and folder permissions; the knowledge retrieval that answers how-do-I questions deflects tickets in every category. This is why the platform choice matters more than any single automation. Organizations running agentic platforms like Harmony reach roughly 90% automatic resolution not by building ninety separate automations, but because intake, verification, policy, approvals, integrations, and audit are one system that every new use case reuses - starting the way most teams start, with the humble password reset.

FAQ

How much does a manual password reset actually cost?

Forrester Research has estimated the average help desk labor cost at roughly $70 per reset. The larger cost is often employee downtime: a Yubico-sponsored study found employees lose about 11 hours per year to password resets.

Are automated password resets secure?

More secure than manual ones, when built on step-up verification. Automation enforces MFA-based identity checks identically every time and cannot be socially engineered the way help desk staff can - a technique used in several high-profile breaches. High-risk requests escalate to humans with full context.

We already have self-service password reset. Why do resets still hit our queue?

Adoption and edge cases. Employees forget the portal, never enrolled, or hit scenarios like expired on-prem AD passwords. A conversational agent in Slack or Teams catches those failures where employees already are and walks them through enrollment instead of taking a ticket.

What should we automate after password resets?

App access requests first - they are the largest ticket category in current benchmark data - then account unlocks and MFA resets, software installs, distribution list changes, and knowledge questions, before tackling onboarding and offboarding workflows.

How long does it take to automate password resets?

With an agentic platform connected to your IdP (Okta or Entra ID) and existing MFA factors, the reset flow itself is typically live in days. The rollout work is policy decisions - which factors, which accounts get stricter rules, what escalates - not engineering.

Retire Your Most Expensive Boring Ticket

Harmony resolves password resets, unlocks, access requests, and the rest of this list automatically - around 90% of routine requests, natively in Slack and Microsoft Teams, with MFA-verified security and a complete audit trail. Book a demo at harmony.io and watch your queue's biggest line item disappear.