Autonomous L1 resolution: how MSPs are closing tickets before a tech opens them

TL;DR

Between 60 and 70% of MSP tickets are L1 - routine, repeatable, fully solvable without deep technical judgment. At $9-20 in fully-loaded labor per ticket, that's a lot of money to spend on password resets. Autonomous L1 resolution means an AI agent closes those tickets before a technician opens them: reads the ticket, checks your PSA, RMM, and identity systems, resets the credential or unlocks the account or runs the script, logs every action, closes the ticket. No draft to review. No queue to monitor. The distinction that matters: AI that helps your team resolve tickets is a different product category from AI that resolves tickets. Rallied is built for the second one.

What "autonomous L1 resolution" actually means

We need to clear this up first, because the phrase gets used for three different things and only one of them is worth deploying.

AI-assisted resolution is when the AI reads a ticket and drafts a reply for a technician to review and send. This is a typing assistant. Useful, but the tech still opens every ticket, still makes every judgment call, still clicks send. The queue doesn't shrink.

Workflow automation is when a pre-built rule fires when a ticket matches a pattern. "If ticket type = password reset and client = Acme Corp, run steps 1-7." Powerful for processes you've fully documented, but brittle on edge cases and expensive to maintain across dozens of client environments.

Autonomous resolution is when the agent reads the ticket, gathers live context from your connected systems, decides what needs to happen, executes it, documents what it did, and closes the ticket - without a human in the loop for that ticket. This is not a typing assistant. It's not a rule that fires. It's a technician that works 24 hours a day, doesn't need a queue, and runs on one $150 monthly plan.

The reason MSPs sometimes conflate these is that AI vendors have every incentive to describe their typing assistant in the language of autonomous resolution. It sounds the same. The queue tells you the difference.

Why L1 tickets are the right starting point

The business case isn't complicated, which is actually why it's so easy to underestimate.

Between 60 and 70% of MSP tickets are L1 - password resets, account unlocks, basic troubleshooting, onboarding and offboarding, access management. These don't require expertise. They require access and process. A technician with the right credentials and a clear runbook can close a password reset in 12-15 minutes. The problem is that 12-15 minutes is $7-10 in direct labor at a $36-41/hour fully-loaded rate, before you account for context-switching overhead, queue wait time, or the fact that your senior techs shouldn't be spending their afternoons on this.

Password resets alone account for 18% of tier-1 ticket volume in the average MSP. For a 10-person shop handling 300 tickets a day, that's 195 L1 tickets daily at roughly $15 each - $730,000 a year in L1 labor. Automate even half of that, and the math gets interesting fast.

The other reason L1 is the right starting point: it's the lowest-risk place to deploy autonomous action. A password reset agent that makes a mistake resets the wrong password. That's fixable. You're not giving the agent access to billing systems or firewall configuration on day one. The floor on a bad day is "wrong account touched" - not "production database corrupted."

What tickets actually get resolved autonomously

Not everything that arrives in the queue is a good candidate. Here's a realistic breakdown of what autonomous resolution handles well, what it handles with approval gating, and what still goes to a human.

Handles autonomously (no approval needed, low blast radius):

• Password resets - the canonical use case. Agent verifies the user identity from the ticket context, resets in the identity provider (M365, Entra ID, Okta, JumpCloud, Google Workspace), logs the action, closes the ticket.
• Account unlocks - same pattern. Agent checks account status, unlocks, confirms.
• MFA resets and enrollment - agent walks through the re-enrollment process and documents the result.
• RMM script execution for endpoint fixes - agent identifies the endpoint in your RMM (NinjaOne, Datto RMM, ConnectWise Automate), runs an approved remediation script, writes the result back to the ticket.
• Triage and routing - for tickets the agent can't resolve, it classifies, documents its findings, and routes with full context attached.

Handles with approval gating (agent proposes, human confirms):

• Onboarding and offboarding - higher blast radius. Agent plans the full workflow (account creation, license assignment, group membership, mailbox setup for onboarding; account disablement, session revocation, license reclamation for offboarding), presents the plan for sign-off, then executes.
• Access management changes - adding or removing group memberships, adjusting permissions.
• License reclamation - particularly when downstream systems like Pax8 are involved.

Still routes to a human:

• Novel issues with no established runbook.
• Anything that requires real diagnostic judgment - the agent will still add triage value (what it checked, what it found), but execution goes to a tech.
• Client-specific exceptions that aren't documented.

Here's what an offboarding runbook looks like in Rallied's interface - written in plain English, executing 6 steps autonomously when the trigger fires:

Six steps. Account disabled, sessions revoked, groups cleaned up, license reclaimed, mailbox converted, Pax8 subscription updated. Every action attributed to the ticket. Tech never opens a tab.

How it works: the mechanics of a ticket going from open to closed

The workflow is worth walking through concretely, because most of the skepticism about autonomous resolution dissolves once you understand what's actually happening at each step.

1. Ticket arrives. A user submits "I can't log in - locked out of my account" to the helpdesk. The ticket lands in ConnectWise, HaloPSA, Autotask, or SuperOps - wherever your PSA lives. Rallied is watching the queue.

2. Agent reads and gathers context. The agent reads the ticket text, identifies the user, pulls their record from the PSA, and checks documentation in IT Glue or Hudu for any client-specific handling notes. If the user's identity is ambiguous, it checks the policy - does this client require MFA verification before a reset? Most do.

3. Agent checks live system state. This is where autonomous resolution is fundamentally different from workflow automation. The agent doesn't fire a pre-built rule. It checks: is this account actually locked? Which identity provider owns it - M365, Entra, Okta, or Google Workspace? What does the runbook say for this client? Is there anything in the ticket history that would make a standard reset the wrong call here?

4. Agent takes action. If everything checks out, the agent resets the credential in the appropriate system. If approval gating is configured (required for sensitive operations), it presents its plan to a tech: "I'm about to reset the M365 password for [user] at [client] - confirm?" Tech clicks confirm; agent executes.

5. Agent logs and closes. Every tool call is written back to the ticket. The tech who opens that ticket later sees exactly what the agent did, what it checked, and what the outcome was. The ticket closes. Client gets a confirmation. From submission to close: under two minutes.

"It figures out things we don't even have in documentation and solves issues without my team touching them. That to me is amazing."

• Ryan Huneidi, owner of Huneidi Services

Why previous AI automation didn't do this (and what's different now)

The MSP community has a well-earned skepticism here. Most AI tools that promised autonomous resolution over the last few years delivered one of two things: a chatbot that answered basic questions (not the same as resolving a ticket), or a workflow automation layer that required 3 months of configuration before it touched anything real.

The Reddit r/msp community's experience captures the pattern: "The Slack/Teams portion is awesome. The AI just creates noise on the actual ticket. Our team didn't get really any value from it."

That thread is from people who tried the previous generation. What they got was AI that worked well in the communication layer - summarizing, drafting, routing suggestions - and added friction in the actual resolution layer. The AI was not connected to the identity systems. It couldn't execute a password reset. It could only tell a tech what to do.

The shift that makes current autonomous resolution different comes down to three things:

Deep stack integration. A tool that can read a ticket but can't execute in your identity provider, RMM, and PSA is still a typing assistant. Genuine autonomous resolution requires live read-write access to the systems where the work actually happens. That integration depth is what most previous-generation AI tools were missing.

Plan Mode for safe deployment. The confidence problem is real: how do you trust an AI to act on client systems before you've seen it work? Modern autonomous resolution tools solve this with an observation phase - Rallied calls it Plan Mode - where the agent shows you exactly what it would do on every ticket without actually doing it. You run it for 6-10 weeks, review the plan output, and flip it live when you're confident the right tickets are going to the right outcomes.

Runbooks in plain English. Previous automation required configuring a workflow builder - building decision trees, mapping API calls, handling edge cases explicitly. Writing a plain-language runbook ("When an employee leaves, disable their account, revoke sessions, reclaim their M365 license, and convert their mailbox to shared") is a different order of magnitude of effort. The agent reads the runbook and decides how to execute it, rather than requiring you to anticipate every case in advance.

The safety and approval question

This comes up in every serious evaluation, and it should. The right answer is that approval gating is a feature, not a workaround for AI that isn't ready to act.

A well-deployed autonomous resolution setup has three tiers:

Full autonomy for low-risk, high-confidence actions. Password resets, account unlocks, basic triage. The blast radius on a bad call is small and reversible. These run without human sign-off.

Approval gating for higher-stakes operations. Offboarding, access changes, anything that modifies group memberships or external billing systems. The agent plans the full workflow, presents it to a tech, waits for an explicit confirm. The tech is a reviewer, not an operator - they're checking the plan, not building it.

Escalation for anything outside the agent's established scope. Novel issues, complex diagnostics, situations where the runbook doesn't apply. The agent hands off with full context so the tech isn't starting from zero.

Every action - whether the agent took it, proposed it, or escalated it - is logged to the ticket. The audit trail isn't just for compliance; it's the feedback loop that lets you tune the agent's behavior over time. Rallied is SOC 2 Type II certified, which matters when you're deploying an agent with write access to client identity systems.

The ROI math

Let's be concrete. For a 10-person MSP:

• Tickets per day: 300
• L1 percentage: 65% = 195 tickets
• Labor cost per L1 ticket: $15 (15 minutes at $36/hour fully-loaded)
• Daily L1 labor cost: $2,925
• Annual L1 labor: ~$730,000

Deploy autonomous resolution and achieve a conservative 30% resolution rate on L1 volume:

• Autonomously resolved: 58 tickets/day = ~1,750/month
• Rallied cost: $150 a month includes 2,000 credits, about 700 tickets in a typical month, and extra credits are $0.10 each
• Labor recovered: 1,750 tickets × $15 = $26,250/month

Mizo's published ROI model for a similar-sized shop puts the year-one net gain at approximately $269,000 when you factor in dispatcher overhead reduction, escalation rate improvements, and the capacity to take on additional clients without adding headcount.

The payback period in their model: 3-4 months.

The more interesting number for a constrained shop isn't the cost savings - it's the capacity recovery. Support Adventure's 2026 MSP Industry Trends report shows that the share of MSPs reporting staffing shortages jumped from 29% to 42% between October 2025 and January 2026. For a shop that can't hire fast enough to keep up with ticket volume, autonomous resolution isn't a cost play. It's how you keep the lights on.

Getting started: the sequence that works

The MSPs that succeed with autonomous L1 resolution don't try to automate everything at once. They start narrow, prove the value in one category, and expand.

Step 1: Pick your highest-volume L1 category. Password resets are the standard first pick - they're 18% of tier-1 volume, the runbook is the same for 95% of clients, and the blast radius on a mistake is small. Document the runbook in plain language. That's usually a 30-minute exercise.

Step 2: Connect your stack. Your PSA, your primary identity provider (M365 or Entra for most MSPs), and your RMM if endpoint scripts are in scope. Rallied handles ConnectWise, HaloPSA, Autotask, SuperOps, NinjaOne, Datto RMM, IT Glue, Hudu, M365, Entra ID, Okta, JumpCloud, and Google Workspace. Setup is measured in hours.

Step 3: Run in Plan Mode for 6-10 weeks. You see exactly what the agent would do on every ticket. Review the plan output daily for the first two weeks, then weekly. When you're confident - which typically comes faster than you'd expect - flip it live on password resets only.

Step 4: Measure and expand. After password resets are humming, add account unlocks. Then MFA resets. Then onboarding. Each category gets its own Plan Mode window before going live. The MSPs closing 10-25% of tickets without human involvement got there by doing this one category at a time over months - not by throwing the full stack at the queue on day one.

The thing that trips up most deployments isn't the AI - it's ticket hygiene and runbook documentation. Gartner's projection that 40% of agentic AI projects get scrapped by 2027 tracks with what happens when an MSP deploys autonomous resolution into a queue where tickets arrive without consistent categorization and runbooks live in the heads of senior techs. Clean data and written process first. Autonomous resolution after.

For a deeper look at how this fits into the broader AI agent stack - triage, workflow automation, and autonomous resolution as three distinct layers - that post walks through the full architecture and the deployment sequence that tends to work.

Try Rallied

Rallied is the AI technician for MSPs that closes L1 tickets before a tech opens them. It connects natively to your PSA (ConnectWise, HaloPSA, Autotask, SuperOps), your RMM, and your full identity stack. Runbooks are written in plain English. Plan Mode lets you see exactly what it would do before it does anything. Setup takes under an hour.

Rallied is $150 a month, billed monthly, with 2,000 credits included. Each ticket costs 1, 3 or 8 credits depending on how much work the agent did on it, so a typical month covers about 700 tickets.

Named one of 10 Hot MSP Tools by CRN for AI and agentic AI capabilities, and SOC 2 Type II certified.

To see how Rallied handles this inside your PSA, read about AI Ticket Triage and Routing for MSPs.

Frequently Asked Questions

What is autonomous L1 resolution?

Autonomous L1 resolution is when an AI agent reads an incoming helpdesk ticket, gathers live context from connected systems (PSA, RMM, identity providers), takes action to resolve the issue - password reset, account unlock, license reclaim - logs every step to the ticket, and closes it without a technician ever opening it. It's different from AI-assisted work, where the AI drafts a response and a tech reviews it. Rallied is an AI technician built specifically for this use case in MSP environments.

Which tickets are good candidates for autonomous L1 resolution?

The highest-volume candidates are password resets and account unlocks (estimated 25-35% of all L1 tickets), onboarding and offboarding workflows, MFA resets and enrollment, M365 license reclamation, and RMM script execution for common endpoint fixes. Research suggests 40-60% of total MSP ticket volume falls into repeatable categories that autonomous resolution can handle.

How is autonomous L1 resolution different from workflow automation like Rewst?

Workflow automation tools like Rewst run pre-configured rule-based sequences: if ticket type = X, run steps 1 through 7. They're deterministic and powerful for processes you've fully mapped, but they break on edge cases and require significant setup per client. Autonomous resolution agents reason from context - reading the ticket, checking live system state, and deciding what to do even for situations no workflow was explicitly built for. The tradeoff: workflow automation is more predictable for tightly-defined processes; autonomous resolution handles messier real-world tickets with less configuration overhead.

What happens when the AI can't resolve a ticket?

A well-designed autonomous resolution agent escalates gracefully. Rallied, for example, documents everything it checked and what it found, routes the ticket to the right queue with full context, and leaves the technician with far less diagnostic work to do. The tech never opens a blank ticket - they open a ticket with a diagnosis already complete. For sensitive operations like password changes or offboarding, approval gating means the agent presents its plan and waits for explicit sign-off before acting.

How long does it take to see ROI from autonomous L1 resolution?

Most MSPs running a proper shadow-mode pilot see capacity gains within 30 days and full ROI realization within 90 days. An L1 ticket costs $9-20 in labor. At 200 tickets per month, that volume fits inside Rallied's $150 a month plan in a typical month (2,000 credits, about 700 tickets).