If It Cannot Act, It Is Not AI Support
AI support, for an MSP, is software that resolves the ticket. It reads the request, checks the user in Microsoft 365 or your RMM, makes the approved change, tells the user, and writes the notes back to your PSA. A tool that only summarizes, suggests or drafts replies is a writing aid, and a tech still does the work.
That is the test this post applies to every tool: if it cannot act across your stack and close the ticket, it is not AI support. The category is sometimes called an AI technician for MSPs, and it is judged on one result. The ticket closed, the user got unblocked, and the PSA shows a clean record of what changed.
If you run an MSP or manage its queue, you already feel the pressure. Ticket volume keeps creeping up, clients expect chat-speed answers, labor costs don't go down, and every AI pilot seems to come with a Setup Tax that drags on for months before anything real happens.
Why AI Support That Only Talks Adds Work
AI support that only summarizes or suggests steps is still manual support with nicer wording. A tech still opens the PSA, logs into the IdP, clicks around in M365 or Okta, documents the change, and chases the user to confirm it worked.
That gap between suggestion and execution is where your margin disappears, and it's where most MSP AI stops. MSP owners who have talked to Rallied describe the same pattern with PSA-native AI: they trialed it, found it offered ideas without doing the work, and at least one switched ConnectWise Sidekick off entirely. If you're weighing the built-in option, what ConnectWise AI does and doesn't do covers it in more detail.
Chatbots and summarizers move words, support requires actions
Most L1 tickets are simple and repetitive. Password resets, account unlocks and MFA re-enrollments fill the board, along with "can you add me to this mailbox" and "I need a license." Each one takes 10 to 15 minutes because the work is spread across tools, even though none of it is hard.
A summarizer can turn a messy email into clean notes. Your tech still has to do the rest:
- Find the user in the IdP
- Perform the reset or unlock
- Send credentials in a safe way
- Update the PSA
- Tell the user what to do next
So your cost per ticket stays anchored to payroll. Some MSPs are fine with better notes, and if documentation quality is your biggest pain, that's a reasonable thing to buy. Most MSPs I talk to are losing money because the queue never stops, and prettier notes don't change that.
AI chatbots vs AI agents in IT support
Jeff Hume at ITSM.tools draws the line in a March 2026 piece on AI help desks. Chatbots work as knowledge engines, where a query triggers a search of internal documents and the output is a short summary. AI agents go further and act on their own, resetting passwords, assigning licenses, unlocking accounts and reconfiguring access.
That distinction matters when you read the 2026 roundups of AI help desk software. ProProfs' October 2026 list frames the category around ticket triage, priority, suggested replies and chatbot answers backed by a knowledge base. Those features help a team answer faster, but they leave the change itself to a person. For an MSP, a deflected ticket and a resolved ticket are different outcomes, and deflection vs resolution is worth getting straight before you sign anything.
The Setup Tax Is Why AI Support Pilots Stall
The Setup Tax is the upfront burden of designing workflows, writing runbooks and training an AI before it can act. It shows up on the quote as "implementation," and it behaves like a slow leak in your business.
You start optimistic, buy the tool and assign someone internally. A month later you're still mapping categories, writing SOPs, building brittle logic, tuning prompts and arguing about edge cases, and the person you assigned has become a person whose job is the tool.
Then maintenance starts. Once you've modeled every path, you have to keep it alive: a new client brings a new approval chain, a new SaaS app or license SKU appears, someone changes a form field in the PSA, and a workflow breaks. Now you're debugging automation like production code, and you never signed up to be a software company.
That's how AI projects become sunk costs, with delayed value, stalled adoption and the same manual busywork as before. The buyers Rallied talks to have been through it, with Sidekick disabled, Rewst workflows abandoned and a real fear of credit plans that stop working mid-month. "We got burned on the last platform" is pattern recognition from people who watched a good demo turn into an implementation that went nowhere, and that cynicism lingers for years. The next time anyone brings up automation, everyone flinches.
Measure time to first closed ticket
The metric that matters is time to first closed ticket. A drafted workflow or a configured dashboard doesn't count, because neither one takes a ticket off the board.
If a tool needs a quarter before it can safely act, it's asking you to fund a small internal implementation team. Big MSPs might absorb that, while smaller MSPs usually can't, because they have no spare capacity to babysit another platform. What they want is a ticket closed at 11pm without waking anyone up, and a Monday morning queue that doesn't look like a disaster.
How To Evaluate AI IT Support: Closed Tickets, Not Built Workflows
Workflow builders are seductive because you can point to a diagram and say "we built 12 automations." The business gets paid in SLA performance, retained clients and techs freed up for L2, L3 and project work, so the evaluation criteria change:
- How many L1 tickets get resolved without a tech touching them
- Resolution time for your top few ticket types
- What happens after hours
- How often tickets reopen
- How clean the closeout is in the PSA, with notes, timestamps and approvals
A lot of tools dodge these questions by steering the conversation back to customization, which is usually a tell. For a comparison of tools judged on these terms, see the best MSP AI tools for ticket automation.
Guardrails beat brittle logic
L1 work gets risky when the wrong action is done to the wrong user in the wrong tenant, even if the action itself is simple. That's why I'd rather have a clear approve, ask or deny posture than 400 branches of if-this-then-that.
A typical split looks like this. Password resets and account unlocks are often fine to run autonomously, as long as identity is checked, credentials are delivered securely and everything is logged. License upgrades might need approval. Mailbox permissions almost always need approval, or at least a check against the client's rules.
A commenter in an r/ITManagers thread on AI in IT support put the permission question plainly: an AI agent used by a help desk tech runs with the same authority as that tech, so treat it that way. In practice that means scoping what it can touch per client, deciding which actions need a human sign-off, and making sure that when someone asks "who approved this," the answer is a named approval captured on the ticket. How to scope AI agent permissions and help desk identity verification go further on both.
Some people argue flowcharts are safer because everything is explicit, and that's a fair point. In practice most flowcharts rot, because people forget to update them while the real world shifts, so you end up trusting logic that was accurate six months ago.
Learn from ticket history, not templates
Most MSPs don't have perfect runbooks for every client and edge case. They have ticket history, with comments that show how approvals actually happen: for this client finance approves license changes, and for that one the office manager approves mailbox access. That history is your real operating model, and it's closer to reality than the wiki you wish you had.
So when someone says "just document your SOPs and we'll automate it," hear what they're really saying, which is pay the Setup Tax first. Some MSPs do it, but it's rarely quick and rarely complete.
What L1 Costs When Your AI Support Can't Act
Password resets alone make up 10 to 50 percent of help desk tickets in many organizations, according to a Gartner Peer Community poll cited by ITSM.tools. The password reset ticket volume statistics break that down further.
Say you're doing 300 L1 tickets a month, and each one takes 15 minutes of tech time end to end. That's 75 hours before you add the hidden minutes:
- Intake back-and-forth because the user didn't include enough info
- Context switching between PSA, IdP, RMM and documentation
- Waiting on approvals
- Updating the ticket and messaging the user
That's how you land in the 50 to 100 hour range each month without trying. Multiply your own number by your loaded hourly cost and you have the monthly bill for work that rarely needs human judgment. MSP cost per ticket benchmarks and the tier 1 automation ROI math help you sanity-check the result.
Hours are only part of it. The pattern MSP owners describe to Rallied is a customer waiting an hour for an L1 tech to pick up a ticket that then takes 30 seconds to fix.
MFA re-enrollment is its own category of pain. Users get new phones and forget to transfer their authenticator, run cleaner apps that delete it, or have Samsung put the app to sleep, and every MSP tech has a story about the user who deleted it because "the code kept changing." Self-service password reset doesn't help here, because somebody still has to reset the MFA method, verify identity and walk the user through re-enrollment. That's 15 minutes of skilled labor on a task that needs no judgment, and when an L2 or L3 engineer gets pulled into the queue to do it, projects slip. The MSPs talking to Rallied are clear about where they'd rather spend that time: on L2, L3 and project work that makes more money.
What an autonomous password reset looks like
When L1 support is truly autonomous, the ticket gets finished as well as understood. A password reset or account unlock runs like this:
- Identify the user from the ticket
- Check account status in the IdP
- Unlock or reset
- Deliver temporary credentials securely
- Tell the user the next steps
- Update the PSA and close the ticket with notes
That sequence can happen in about 60 to 120 seconds for common requests, without a tech opening the ticket. A human doing the same work is usually in the 10 to 15 minute range, and that's if they aren't juggling three other things. The bigger change is in the queue, because when resets stop piling up, your techs stop drowning.
Legacy automation imposes a permanent admin tax
Even after you finish implementation, most MSP automation platforms still need ongoing care. Someone maintains workflows, updates runbooks, debugs integrations and watches for failures, and that someone is usually a technician you'd rather have on billable project work. The subscription is only part of what you pay.
These platforms exist for good reasons, since they're flexible and can do a lot. If your main goal is getting L1 under control, you need something that closes the highest-volume ticket types without turning you into a workflow shop.
Old Way Vs. Autonomous L1 In One Table
| Dimension | Old Way | Category Way |
|---|---|---|
| Time to value | Delayed value while workflows and runbooks get built | Same-week outcomes by starting from ticket history and scoped autonomy |
| Adoption | Stalled adoption after early pilot friction | Faster adoption because the first wins are visible in the PSA |
| Staffing | Techs pulled into L1 to keep SLAs | Fewer technician hours spent on repetitive L1 work |
| Day-to-day work | Persistent manual busywork across tools | Cross-tool execution with consistent closeout and user updates |
| Trust | Leadership cynicism after trainwreck projects | Guardrails, approvals and audit trails that stand up to scrutiny |
A 30-Day Rollout For AI Support That Acts
Autonomous L1 is an operating model you can stand up in a month. You connect the systems, let history define what normal looks like, set guardrails, watch outcomes and expand scope based on evidence. Autonomous L1 resolution covers the model in more depth.
- Start from ticket history. Pull out the categories that show up constantly (resets, unlocks, MFA issues, mailbox access, licenses), the comments that signal approval, who approves for which clients, and the edge cases that cause escalations.
- Set a simple guardrail matrix. Password resets, account unlocks and basic MFA resets run autonomously, mailbox permissions, license upgrades and group changes need approval, and anything outside L1 scope goes to a human.
- Baseline before you switch anything on. ProProfs recommends a 30-day pilot with first response time, average resolution time, deflection and CSAT measured up front, and for an MSP I'd add tickets closed without a tech and reopen rate.
- Review weekly, then expand. Look for failures, adjust permissions and widen scope where the receipts support it: audit logs, PSA notes, captured approvals and clear user messages.
L1 support is a loop of intake, context, action, closeout and user notification, and if any part is missing, a human fills the gap. The operating model has to take intake from chat and email, ask clarifying questions when needed, pull context from documentation and the RMM, execute the change, update the PSA and notify the user.
In one representative workflow, an ambiguous "cloud apps are broken" ticket comes in. Instead of a tech checking tools one by one, the system queries device health, SSO status and service health in parallel, spots a VPN misconfiguration and pushes a fix remotely, with the root cause found in 45 seconds. That compression is what stops the back-and-forth that eats your day.
What AI Support Looks Like With Rallied
Rallied is the AI agent that closes MSP tickets in ConnectWise, HaloPSA or Autotask. It runs the fix in Microsoft 365 and your RMM, including NinjaOne, pulls the client's documentation from IT Glue or Hudu during triage, and writes the notes and time entry back to the ticket. Your team can also work with it in Microsoft Teams or Slack.
Every MSP environment is different, so the cleanest way to judge it is to watch what happens after a ticket arrives. Start with high-volume, low-judgment L1 tasks like password resets and account unlocks, because they unblock users immediately and are easy to verify in the PSA.
Pricing follows the same logic of paying for work done. Rallied is $300 a month with 2,000 credits included, and each ticket is charged once, for the most work the agent did on it. That's 1 credit for replies, notes and status updates on the ticket, 3 credits when it looks up or changes things in your other systems (such as resetting a password), and 8 credits when it works across three or more systems with six or more actions, or runs a script. A ticket the agent couldn't finish or wasn't allowed to act on is never charged, and neither is one where it only asked a clarifying question.
In Rallied's production data a charged ticket averages about 2.7 credits, so 2,000 credits covers roughly 700 tickets in a typical month. That's a typical figure, not a guarantee. If credits run out, the agent pauses, posts an internal note on the ticket and resumes when credits are added or the month resets. Full details are on the pricing page.
The test is the same one this post started with. Connect the stack, pick your highest-volume L1 categories, and measure time to first closed ticket.
To see how Rallied handles this inside your PSA, read about AI Ticket Triage and Routing for MSPs.
Frequently Asked Questions
What counts as AI support for an MSP?
AI support is software that resolves the ticket: it reads the request, makes the approved change in systems like Microsoft 365 or your RMM, tells the user, and writes notes back to the PSA. A tool that only summarizes tickets or suggests steps is a writing aid, because a technician still does the work.
What is the difference between an AI chatbot and an AI agent in IT support?
ITSM.tools describes chatbots as knowledge engines that search internal documents and return a summary. AI agents act on their own, resetting passwords, assigning licenses, unlocking accounts and reconfiguring access. For an MSP, only the second kind takes the ticket off the board.
Which L1 tickets are safe to let an AI agent close on its own?
Password resets, account unlocks and basic MFA resets are common starting points, as long as identity is verified, credentials are delivered securely and the action is logged. License upgrades, mailbox permissions and group changes usually need approval. Anything outside L1 scope should go to a human.
Should an AI agent have the same permissions as a technician?
A commenter on r/ITManagers pointed out that an AI agent used by a help desk tech runs with that tech's authority, so it should be treated like one. Scope what it can touch per client, decide which actions need a human sign-off, and make sure approvals are captured on the ticket.
How long should an AI support pilot take?
ProProfs recommends a 30-day pilot with first response time, resolution time, deflection and CSAT baselined before you start. The number to watch is time to first closed ticket. If a tool needs a quarter of workflow building before it can act, you are paying the Setup Tax.
How much does Rallied cost?
Rallied is $300 a month, billed monthly, with 2,000 credits included. Tickets cost 1, 3 or 8 credits depending on how much work the agent did, and a ticket it couldn't finish or wasn't allowed to act on is never charged. In Rallied's production data a charged ticket averages about 2.7 credits, so 2,000 credits covers roughly 700 tickets in a typical month.