Which IT requests can an outsourced first line handle?
- Password resets and multi-factor authentication re-enrolment, following your identity checks
- Access requests that follow an approval workflow (shared drives, SaaS tools, distribution lists)
- New-starter and leaver tasks from a checklist: accounts, licences, equipment shipping and returns
- Common software issues: email, VPN client, collaboration tools, printers
- Device triage: collecting details, remote checks, and arranging repair or replacement
- Logging, categorising and routing everything else to the right resolver group
How should priorities and response targets be set?
Agree a priority matrix based on impact and urgency. The targets below are examples of the kind you might set, not standard figures:
| Priority | Example | Example first response | Who resolves |
|---|---|---|---|
| P1 Critical | Company-wide outage, suspected security breach | Immediately, by phone | Your engineers; first line coordinates communication |
| P2 High | A team cannot work, a key system is down for one site | Within 30 minutes | Your L2, with first-line support |
| P3 Normal | One user blocked, workaround possible | Within a few hours | First line where a runbook exists |
| P4 Low | Requests and questions | Within one business day | First line |
What documentation does the team need?
- Runbooks for the 20–30 most common requests, with screenshots and expected outcomes
- Identity verification steps for resets and access changes
- An escalation map: resolver groups, on-call contacts and when to wake someone up
- A list of what the first line must never do, such as changing firewall rules or approving its own access
- Templates for user communication during incidents
Continue reading
How do you keep outsourced IT access safe?
Give each agent a named account with only the permissions their runbooks require, protected by multi-factor authentication. Use your privileged access management tool for anything sensitive, log every administrative action, and review access rights monthly. When someone leaves the team, their access is removed the same day.
Which metrics show the service is working?
- First contact resolution for requests covered by a runbook
- Mean time to resolve by priority
- Ticket backlog and age of the oldest open tickets
- Share of tickets escalated, and how many escalations were avoidable
- User satisfaction after ticket closure
Is this the right model for an MSP?
Managed service providers often use an outsourced first line to answer their clients' users under the MSP's brand and tools, while their engineers handle projects and complex incidents. The same principles apply: a runbook per client, clear permissions per client environment, and an escalation path the MSP controls.