Why L1 Tickets Are Killing Your MSP (And What Actually Fixes It)

L1 tickets are the routine requests in an MSP queue: password resets, MFA re-enrollments, account unlocks, mailbox permissions, group changes and license swaps. Each takes a tech 10 to 15 minutes, which adds up to 50 to 100 hours a month. Faster triage doesn't shrink that, but resolving the identity and access tickets without a tech does.

You hire a sharp technician, train them up, and within a month they're spending half their day on password resets. Their skills are fine. The queue sends the most repetitive work to whoever is free, and a good tech clears tickets fast, so they end up with more of it.

What L1 tickets really cost your MSP

A typical MSP handles 200 to 400 L1 tickets per month. Each one takes 10 to 15 minutes once you count reading the ticket, pulling context, running the fix, notifying the client and closing it out. That's 50 to 100 hours of technician time every month on tasks that need no judgment, and the MSP ROI calculator shows what that costs your shop.

Put a dollar figure on it. At an internal cost of $150 per tech hour, that's $7,500 to $15,000 a month in L1 overhead, which is a full-time salary spent on work that doesn't need a human.

Those numbers are conservative because they assume a clean 15-minute resolution. Context switching adds more: the tech stops project work, reads the ticket, logs into a different system, handles the request, switches back and tries to remember where they left off. That drag never shows up in your PSA reports, but it shows up in your P&L. For per-ticket comparisons across shops, see MSP cost per ticket benchmarks.

How to find the L1 tickets eating your hours

Before you automate anything, find out where the hours go. Anakage's guide to reducing L1 tickets suggests pulling 90 days of ticket data, grouping it by category and ranking each category by volume multiplied by average handling time. That ranks by effort rather than count, so you start with the category that costs the most hours instead of the one that shows up most often.

The same exercise works in ConnectWise, Autotask or HaloPSA, as long as your techs categorize tickets consistently and log time against them. When you have the ranked list, look for categories where the steps are the same every time and the systems involved are known in advance. Those are your automation candidates.

Why SSPR doesn't clear the L1 queue

"Just set up SSPR" is the first thing people say, and they're right that self-service password reset through Microsoft Entra, with password writeback and two forms of MFA, is worth configuring. Adoption decides whether it actually deflects tickets. Anakage lists three things that drive usage: a link on the Windows login screen so locked-out users can reach it, on-screen prompts before a password expires instead of email reminders, and forced enrollment so users register before they need it. Email reminders fail for a plain reason, which is that a locked-out user can't open email.

Even with good adoption, SSPR covers one category of L1 work. It doesn't touch:

• MFA re-enrollments, after a user gets a new phone without moving their authenticator, runs a cleaner app that deletes it, or removes it because "the code kept changing." Someone still has to reset the method, verify the user and walk them through setup again.
• Account unlocks after conditional access failures, impossible travel alerts or risky sign-in detections.
• Shared mailbox permissions, as in "Can you give Sarah access to the billing inbox?"
• Group membership changes, such as adding someone to a security group or pulling them off a distribution list.
• License assignments and swaps, like upgrading a user to E3 or swapping their Visio license.
• Onboarding and offboarding, where someone creates the user, provisions email, assigns groups and tags the device.

Password resets might be 15 to 20 percent of your L1 volume, and SSPR handles those. The other 80 percent is still in the queue waiting for a tech. For what other shops report, see these password reset ticket volume statistics.

Which L1 tickets are worth automating (and which aren't)

Not all L1 work should be automated, and too many AI vendors skip over that.

Printer tickets are a poor fit. Any one of them could be a paper jam, a driver issue, PrintNightmare, a spooler crash, a GPO that didn't apply or a leased device managed by another vendor, so every ticket is slightly different. Anakage puts printer and spooler failures on its list of five repeat issues that drive 60 to 70 percent of L1 volume in most enterprises, and the fix that lasts is root cause work: DHCP reservations, universal print drivers deployed through your RMM, proper Group Policy, and a spooler restart script for the tickets that really are a stuck spooler. An AI guessing at symptoms won't get you there.

"My internet is slow" could be 100 different things. It might be too many Chrome tabs, a cloud backup still running, an eight-year-old machine with a spinning disk, a broken Ethernet clip, DNS, edge routing, or a user who means "my computer is slow" and says "internet." You can automate basic diagnostics like a speed test, an uptime check and ping latency, but the resolution still needs a person.

Identity and access work is where automation pays off. Password resets, account unlocks, MFA re-enrollments, mailbox permissions, group changes, license assignments and basic onboarding and offboarding follow clear patterns, touch a known set of systems and rarely need judgment. They're high volume and low ambiguity, which is exactly the profile worth automating. Onboarding is the heaviest of these, so it's worth reading up on automating new-user setup and Microsoft 365 user offboarding.

A fair estimate is that 60 to 70 percent of your L1 volume falls into that identity category, and the rest still needs a person. That's fine. The goal is to spend tech hours on work where techs add value.

Why triage tools don't fix L1 tickets

The first instinct is to speed up triage so tickets get categorized and routed to the right person sooner. PSAs have had keyword parsing for years, and newer tools use AI to classify and route.

Triage was never the slow part of an L1 ticket. A password reset that reaches a tech in 30 seconds instead of 5 minutes still needs the tech to open it, log into M365 or Entra, run the reset, notify the client and close the ticket, so the 15-minute task is still a 15-minute task.

A lot of MSP AI tools live in this space. They summarize the ticket, suggest a resolution and maybe draft a reply, which helps a little. But if the tech still has to execute the fix across multiple systems, the labor cost barely moves, because the preamble got shorter and the work is still sitting in the queue. The difference is covered in more depth in ticket deflection vs resolution.

The "human touch" argument

Some MSP owners push back on automation entirely. Clients pay for the human touch, L1 is where relationships get built, and good customer service can't be automated.

There's something to that. When someone calls frustrated at 8am because they can't get into their email, a calm human voice goes a long way, and techs notice it too. In a thread on r/ITManagers, one commenter said Level 1 calls allow for "some small talk and rapport building while you're troubleshooting."

The argument mixes two different jobs, though. One is relationship work: understanding the client, building trust, spotting patterns, finding upsell opportunities and making the business owner feel heard. The other is execution: opening Entra, clicking reset, copying a temporary password, updating the ticket and sending the notification. The execution part carries no relationship value, because the client cares that the password got reset fast and has no opinion on who clicked the button.

Taking execution off your techs gives them time for the relationship work. When your L2 techs aren't buried in MFA resets, they can do the proactive work, the QBRs and the root-cause work that cuts ticket volume, which is what builds client loyalty. A tech on their 200th password reset of the month is doing labor the task doesn't need a human for, and burning out on it.

Is it safe to let AI fix L1 tickets?

The other big objection is "I'm not giving an AI write access to passwords." That's a real concern. Social engineering attacks have succeeded by tricking help desk techs into resetting passwords for the wrong person, so any system that can change credentials, AI or otherwise, needs serious guardrails. Help desk identity verification covers the caller side of this in detail.

Responsible automation has five parts:

• The service account can only perform the specific actions it has been scoped to, and nothing a tech wouldn't do.
• The requester is matched to an identity in your IdP before anything runs, so the ticket alone is never trusted.
• Higher-risk changes, like mailbox access or group modifications, go to a manager or service lead for approval first, which can happen in a Teams or Slack message. A risk-based autonomy matrix helps decide which changes need that step.
• Every action is logged with who requested it, what was done, when and on whose authority, which is a better audit trail than most techs leave.
• You decide what runs on its own and where the agent has to stop and ask, starting narrow and widening as trust builds. AI agent permissions for MSPs walks through how to scope this.

Whether an AI should have write access comes down to the guardrails. A well-scoped agent with approval gates and an audit trail is often safer than an overtired tech at 11pm who resets a password without verifying the caller because the queue is backing up.

What actually fixes L1 tickets

Reclaiming those hours means getting the tech out of the loop on routine L1 work. Faster triage and better summaries leave the work where it is, so the ticket has to be resolved without a tech touching it.

That takes a system that can:

• read the ticket and work out what's being asked
• verify the requester against your identity provider
• connect to your PSA, your RMM and Microsoft 365
• run the fix: reset the password, unlock the account, grant the permission, re-enroll MFA
• route for approval when the action needs it
• tell the client what happened in plain language
• close the ticket with notes and a time entry

Rallied is an AI agent built to close tickets this way. It works inside ConnectWise, Autotask and HaloPSA, runs the fix in Microsoft 365 and your RMM (including NinjaOne), pulls the client's documentation from IT Glue or Hudu during triage, and writes the notes and time entry back to the ticket. Autonomous L1 resolution goes further into how that works.

The math on automating L1 tickets

Take the same 200 to 400 L1 tickets. If 60 to 70 percent are identity and access work, that's 120 to 280 tickets a month that could close without a tech. At 15 minutes each, that's 30 to 70 hours a month back for project work, escalations and the client relationships that grow your business. How many of those an agent actually closes depends on your environment and the approval rules you set, so treat that range as a ceiling until you've run it on your own queue.

On cost, Rallied is $300 a month, billed monthly, with 2,000 credits included. A ticket where the agent only works on the ticket itself (replies, notes, status updates) costs 1 credit, one where it looks up or changes something in another system, such as resetting a password, costs 3, and one that works across three or more systems or runs a script costs 8. At 3 credits each, 280 identity tickets would use 840 credits, under half the monthly allowance. Tickets the agent couldn't finish or wasn't allowed to act on aren't charged. The full breakdown is on Rallied pricing.

After-hours coverage changes too. L1 tickets don't stop at 5pm, and an MFA reset that arrives at 11:30pm doesn't have to wait until morning or wake up whoever is on call for routine work.

The MSP ROI calculator runs these numbers for your shop, and the ROI of tier 1 ticket automation covers the model in more detail.

What about L1 as a training ground?

One concern is worth taking seriously: if you automate L1, where do junior techs learn the fundamentals? L1 work is how a lot of techs build confidence with AD, networking basics and client communication, and if you remove all of it you lose that on-ramp.

Most L1 automation removes the repetition rather than the learning. A junior tech benefits from their first 20 password resets and gets nothing from their 2,000th, because once the pattern is learned the repetition is labor with no development value.

A better setup lets the agent handle the repeatable work while juniors use the freed-up time for shadowing, project work and exposure to L2 and L3 problems, where real skills get built. Junior techs grow faster when they aren't buried in a queue.

What's next

If L1 tickets are eating your team's week, book a 30-minute call with Rallied. The call looks at your ticket volume, which categories can be automated and what resolution looks like on your own tickets, without a pitch deck.

To see how Rallied handles this inside your PSA, read about AI Ticket Triage and Routing for MSPs.

For the wider picture, read Best MSP AI Tools for Ticket Automation in 2026.

Frequently Asked Questions

What counts as an L1 ticket at an MSP?

L1 tickets are routine, low-judgment requests: password resets, MFA re-enrollments, account unlocks, shared mailbox permissions, group changes, license swaps and basic onboarding and offboarding. Each takes a tech roughly 10 to 15 minutes once you count reading, fixing, notifying and closing. Printer and connectivity tickets often land in L1 too, but they vary too much to automate well.

Does self-service password reset fix L1 ticket volume?

SSPR handles password resets, which might be 15 to 20 percent of L1 volume, and only if users actually adopt it. It does nothing for MFA re-enrollments, unlocks from risky sign-ins, mailbox permissions, group changes or license work. Configure it, then look at the rest of the queue.

How do I find which L1 tickets to automate first?

Pull 90 days of ticket data from your PSA, group it by category and rank each category by volume multiplied by average handling time. That ranks by effort rather than count. Start with the highest-effort category whose steps are the same every time.

Which L1 tickets should an MSP not automate?

Printer problems and vague complaints like "my internet is slow" are poor fits because each ticket has a different cause. Fix printers with root cause work such as universal drivers, DHCP reservations and Group Policy. For slowness, automate the diagnostics and leave the resolution to a tech.

Is it safe to give an AI agent write access to reset passwords?

It depends on the guardrails. Scope the service account to specific actions, match the requester to an identity in your IdP before anything runs, route higher-risk changes for approval and log every action. Start with a narrow set of actions and widen it as trust builds.

How much does Rallied cost to handle L1 tickets?

Rallied is $300 a month, billed monthly, with 2,000 credits included. A ticket that changes something in another system, such as a password reset, costs 3 credits, and tickets the agent couldn't finish or wasn't allowed to act on aren't charged. In Rallied's production data a charged ticket averages about 2.7 credits, so 2,000 credits covers roughly 700 tickets in a typical month.

If L1 is automated, where do junior techs learn?

Automation takes away the repetition, and juniors still learn the basics. A junior tech learns from their first 20 password resets and gains nothing from their 2,000th. Use the freed-up time for shadowing, project work and exposure to L2 and L3 problems.