Before
An analyst searched for the caller in the identity directory, opened the account and factor information, and interpreted the evidence. They then copied the relevant findings into the incident and worked out the likely classification and routing.
How it works
- Retrieve the caller’s identity profile and enrolled authentication factors when the incident is created.
- Analyze the ticket and identity evidence to classify the issue and recommend a priority, assignment group, and resolution.
- Write the identity context and triage recommendation into the service desk incident for analyst review.
Workflow details
- Incident intake: The workflow starts when a new service desk identity incident is created with the caller’s login, ticket title, description, account evidence, and any previously suggested classification.
- Identity enrichment: It retrieves the caller’s account status and profile details, including department and manager information, then reads the caller’s enrolled authentication factors and their statuses.
- Evidence-based triage: An IAM analyst agent reviews only the supplied ticket and identity evidence, classifies the incident as an MFA reset, account lock, access issue, access request, or other issue, and recommends a priority, assignment group, and one-sentence resolution.
- Service desk handoff: The workflow updates the incident with the access category and records the classification result alongside the Okta account, organizational, manager, and factor context in the ticket’s work notes.
What changed
The ticket is enriched automatically immediately after creation, so the assigned analyst receives the relevant identity evidence and a standardized triage recommendation in the incident instead of gathering it across separate views.
Work removed
Searching for the caller’s profile, opening separate factor information, reviewing account and factor details, determining the initial classification and routing suggestion, and copying the findings into the incident.
Expected outcome
At least three recurring manual actions per identity ticket can be removed—profile lookup, factor review, and copying findings—while the analyst retains responsibility for acting on the recommendation.
