Before
Technicians inspected account status, sign-in events, risk indicators, and authentication methods before deciding how to recover access. They then assembled the recovery checklist, coordinated with SecOps when needed, communicated the decision, and updated the support ticket across separate steps.
How it works
- Start from a verified support request and evaluate the account, risk, sign-in, and authentication evidence against fixed diagnostic rules.
- Validate the diagnosis and decide whether the recovery plan can proceed directly, needs SecOps approval, or must be escalated because an attack or unresolved condition is suspected.
- Apply the approved or eligible recovery plan, communicate the result, assign unresolved cases, and record the diagnosis and evidence in the support ticket.
Workflow details
- Verified intake: The workflow begins with a support request whose user identity has already been verified, along with the account identifier, ticket details, and stated issue.
- Evidence-based diagnosis: The diagnostic stage evaluates account status, directory risk, recent sign-ins, error patterns, locations, and—when relevant—Authenticator methods. Fixed rules classify the issue as a disabled account, identity risk, lost MFA, smart lockout, password issue, conditional-access block, or another unresolved cause.
- Safety validation: A guard checks that the diagnosed account matches the requested user and that supporting evidence exists. It also treats unfamiliar locations or missing sign-in evidence for self-service cases as reasons to suspect an attack and avoid automatic unlocking.
- Controlled decisioning: The workflow builds an action plan such as revoking sessions, issuing a temporary access code, removing a lost authentication method, re-enabling an account, or escalating to the appropriate team. Cases requiring security judgment are sent to SecOps in Teams for approval, rejection, or escalation.
- Execution and recordkeeping: Approved or directly eligible plans are handed to the account-recovery workflow, while rejected or escalated cases receive no automatic unlock. The diagnosis, evidence, plan, customer message, assignment, and outcome are written back to the ServiceNow ticket; the demonstration uses synthetic observations and simulated service responses.
What changed
Each verified request now receives a structured diagnosis and safety check before recovery. Eligible actions are handed directly to the recovery workflow, security-sensitive cases receive an explicit SecOps decision, and the ticket is updated with the evidence, plan, assignment, and final outcome instead of relying on separate technician handoffs.
Work removed
Rechecking account and sign-in evidence, interpreting risk and error codes, identifying the likely lockout cause, assembling recovery actions, preparing SecOps approval requests, relaying approval decisions, and copying the diagnosis and outcome into the support ticket.
Expected outcome
A consistent and auditable recovery path that removes at least two recurring manual actions per eligible ticket: assembling the diagnosis and coordinating the recovery or approval handoff.
