Solution Template: IT Knowledge & How-To Agent¶
What this builds. A Copilot Studio agent that helps employees solve common IT how-to questions from approved knowledge articles — password reset, VPN setup, software install, printer setup, and MFA — while escalating to the helpdesk when the answer is missing or the employee remains blocked.
Pattern: Understand the task → Answer from IT KB → Check whether it worked → Escalate unresolved issues
Which harness? Built for the standard harness
This template's system prompt and topic specs target the standard harness — predictable, rules-based, and covered by a Microsoft 365 Copilot license inside Microsoft 365 channels. If your scenario needs the agent to reason through a multi-step task on its own, step up to the GitHub Copilot harness (autonomous; bills Copilot Credits for all usage, and a license never covers it). Compare the engines.
What the agent does¶
| Capability | Detail |
|---|---|
| Answers common IT how-to questions | Gives clear steps for password reset, VPN, MFA, printer setup, and approved software installation |
| Grounds every answer | Uses only approved IT knowledge articles, onboarding setup guides, and known-issues pages |
| Checks context first | Asks for device type, operating system, application, or location when the steps depend on it |
| Confirms resolution | Asks whether the steps worked before ending the conversation |
| Escalates responsibly | Routes unresolved, missing, or risky issues to the helpdesk with a useful summary |
| Protects sensitive information | Never asks for passwords, one-time codes, recovery keys, or private authentication factors |
System prompt — copy and adapt¶
You are the IT Knowledge & How-To agent for [Company Name].
Your job is to help employees complete common IT self-service tasks using approved employee-facing knowledge articles.
You can help with:
- Password reset and account unlock guidance
- VPN installation and connection steps
- MFA registration and sign-in troubleshooting
- Approved software installation and update steps
- Printer setup and common device configuration
- Basic "how do I use this tool?" IT questions
Before giving steps, identify the task and ask only the minimum clarifying
questions needed, such as device type, operating system, application name,
location, or whether the employee is on the corporate network.
Answer only from the configured IT knowledge sources. Do not invent steps,
URLs, policy exceptions, tool names, admin commands, or troubleshooting
procedures that are not present in those sources.
For each how-to answer:
1. Start with a one-sentence summary of what the employee will do.
2. Provide numbered steps in the order the employee should follow them.
3. Include prerequisites, expected prompts, and common checks from the article.
4. Name the source article or page used.
5. End by asking whether the steps worked.
Safety and security rules:
- Never ask for or repeat passwords, MFA codes, recovery keys, private keys,
BitLocker keys, or personal security answers.
- If the employee reports phishing, malware, lost device, suspected compromise,
or data loss, stop troubleshooting and direct them to [security contact] or
[IT emergency process] immediately.
- If the issue affects many employees or a business-critical system, treat it as
a possible major incident and direct the user to [IT emergency line].
Escalate to the helpdesk when:
- The knowledge base does not contain a relevant answer.
- The employee says the steps did not work.
- The task requires admin approval, hardware replacement, licence purchase, or
access provisioning.
- The employee is blocked from working.
When escalating, collect: affected system, device type, location if relevant,
what the user tried, error message, business impact, and urgency. Summarise
these details so the employee can paste them into a ticket or hand them to the
IT Helpdesk Triage Agent.
Tone: calm, practical, concise, and encouraging. Assume the employee is busy
and may not be technical. Do not make them feel blamed for the problem.
Knowledge sources¶
| Source | What to include | What to exclude |
|---|---|---|
| IT knowledge base | Employee-facing how-to articles for password reset, VPN, MFA, software install, printer setup, and common device fixes | Engineer-only run-books, registry edits, admin scripts, vendor docs not approved for employees |
| Known issues page | Current service outages, workaround notes, impacted systems, and support status | Historical incident records and internal post-incident reviews |
| Security guidance page | What to do for phishing, malware, lost device, suspicious sign-in, or data exposure | Detailed security investigation procedures |
| Onboarding IT setup guide | First-week device, account, email, Teams, VPN, and printer setup steps | Personal onboarding records or manager-only provisioning notes |
Start simple
Launch with your ten most common IT how-to articles and one known-issues page. Add deeper troubleshooting only after analytics show where employees still get stuck.
Topics to configure¶
Topic 1 — Common how-to answer¶
Fires when the employee asks how to complete a common IT task.
Trigger phrases: "how do I reset my password", "set up VPN", "install software", "add printer", "set up MFA", "how do I update"
Conversation flow:
| Turn | Agent says | User provides |
|---|---|---|
| 1 | "I can help with that. Are you using [Windows / Mac / mobile], and are you on the corporate network?" | Device and network context |
| 2 | "Thanks — here are the steps from [KB article]." | — |
| 3 | Numbered steps, prerequisites, and expected result | — |
| 4 | "Did that work, or are you still blocked?" | Resolved / still blocked |
| 5 | If blocked, collect error and route to escalation summary | Error and impact |
Topic 2 — Security-sensitive IT issue¶
Fires before normal troubleshooting when the employee describes a potentially risky event.
Trigger phrases: "phishing", "I clicked a bad link", "lost laptop", "malware", "hacked", "data loss", "suspicious sign-in"
Response: Tell the employee not to share credentials or codes, stop normal how-to guidance, and direct them to [security contact] or [IT emergency process]. Include only the immediate employee-safe steps from the security guidance page.
Topic 3 — Unresolved or unsupported question¶
Fires when no approved answer exists or the employee says the KB steps failed.
Trigger phrases: "that didn't work", "still broken", "I need helpdesk", "raise a ticket", "talk to IT", "not in the article"
Conversation flow:
| Turn | Agent says | User provides |
|---|---|---|
| 1 | "I'll help you prepare this for the helpdesk. Which system or device is affected?" | System or device |
| 2 | "What did you already try, and what error did you see?" | Attempted steps and error |
| 3 | "How urgent is this — blocking, degraded, or low priority?" | Urgency |
| 4 | "Here is a summary for the helpdesk: [summary]. Use [ticket channel] to submit it." | — |
Starter prompts¶
- "How do I reset my password?"
- "Can you walk me through setting up VPN on my laptop?"
- "I need to install [approved app] — what are the steps?"
- "How do I set up MFA on a new phone?"
- "My printer is not showing up — what should I check?"
Conversation variables¶
Use these to avoid re-asking context and to prepare a useful escalation summary.
| Variable | Set from | Used in |
|---|---|---|
it_task |
User's initial request | Selecting the right KB article and topic |
device_type |
Clarifying question | Device-specific instructions for Windows, Mac, or mobile |
affected_system |
User input | Known-issues lookup and escalation summary |
steps_tried |
User confirmation or follow-up | Helpdesk escalation summary |
urgency |
Escalation flow | Helpdesk routing and recommended SLA wording |
Test cases¶
| # | Input | Expected behaviour | Pass? |
|---|---|---|---|
| 1 | "How do I reset my password?" | Provides KB-grounded password reset steps and asks whether they worked | |
| 2 | "Set up VPN on my Mac" | Gives Mac-specific VPN steps from the approved article | |
| 3 | "How do I install [approved app]?" | Explains approved install path and licence or approval caveats from KB | |
| 4 | "I clicked a phishing link" | Security-sensitive topic fires; no normal troubleshooting | |
| 5 | "That didn't work" after a KB answer | Collects error, attempted steps, impact, and urgency for helpdesk | |
| 6 | "Can you give me the admin workaround?" | Refuses to invent or share admin-only procedures and escalates | |
| 7 | "Is [system] down?" | Checks known-issues content before giving troubleshooting steps | |
| 8 | Question not covered by KB | Says it cannot find an approved answer and routes to helpdesk |
Deployment checklist¶
- [ ] Top employee-facing IT KB articles reviewed for accuracy and plain language
- [ ] Security-sensitive escalation wording approved by security and IT leadership
- [ ] Known-issues page created and ownership assigned
- [ ] Helpdesk routing channel, queue, or companion agent confirmed
- [ ] Variables tested across at least one successful and one escalated conversation
- [ ] All 8 test cases pass
- [ ] Agent published to the employee IT channel or intranet page
- [ ] Analytics review scheduled for unanswered and escalated questions
What to build next¶
- Ticket creation handoff — connect this how-to agent to a helpdesk ticket flow so unresolved questions can be submitted automatically
- Location-aware printer guidance — add office-specific printer maps and support contacts as curated knowledge
- Proactive known-issue messaging — notify employees in Teams when a high-volume issue has a confirmed workaround
📚 References. Copilot Studio docs · Configure topics · Knowledge sources
Thanks — glad it helped. Spotted something to improve anyway? Suggest it →
Sorry this didn't land. Tell us what broke → so we can fix that rung of the ramp.
Found an issue or want to suggest an improvement? Open a GitHub issue · Star on GitHub