IT Support That Resolves Issues,
Not Just Logs Tickets.

L1 helpdesk analyst operations covering the full spectrum of first-line IT support: user account management (password reset, account unlock, MFA setup, permission issue triage), Microsoft 365 and Google Workspace support (email setup, calendar sync issues, SharePoint access, OneDrive sync, Teams connectivity), Windows and macOS desktop support (application installation and removal, system performance, startup issues, update management), printer and peripheral setup, VPN configuration and connectivity troubleshooting, and the structured escalation process that routes issues to L2 with full context (what was attempted, what the error message says, what the impact on the user is) rather than an empty ticket that forces L2 to start the investigation from the beginning.

L2 support covering the mid-complexity issues that require deeper platform knowledge: Active Directory user and group management beyond basic account operations, Exchange Online and on-premise Exchange mailbox management (mailbox size, shared mailboxes, mail flow rules, distribution lists), device imaging and provisioning (Windows Autopilot, MDM enrolment, device build from image), application packaging and deployment via SCCM/Intune, network troubleshooting at the switch and router level (VLAN issues, DHCP conflicts, DNS resolution failures), server monitoring escalations, and the complex Microsoft 365 licence management and compliance issues that require admin centre access beyond the L1 analyst's permissions. L2 provides the technical bridge between everyday user issues and the specialist infrastructure and application knowledge that L3 provides.

L3 specialist support covering the expert-level issues that require platform-specific deep knowledge: Active Directory forest and domain issues (replication failures, schema conflicts, trust relationship problems), Exchange hybrid configuration and migration issues, VMware vSphere hypervisor and storage issues, SQL Server database performance and availability group failures, ERP application support (SAP, Oracle, Dynamics application-layer issues and integrations), bespoke application support (working with the development team or vendor to resolve production application issues), and the root cause analysis for recurring issues that L1 and L2 are resolving repeatedly identifying the underlying problem (a misconfigured Group Policy, an Autoproxy setting conflict, a capacity limit being approached) and implementing a permanent fix rather than a repeated workaround.

Knowledge base development and maintenance the investment that compounds over time, because every issue resolved and documented reduces the time to resolve the same issue the next time it occurs and increases the probability that L1 can resolve it without escalation. Knowledge-Centered Service (KCS) methodology: every ticket that cannot be resolved immediately from an existing KB article triggers a KB article creation or update as part of the resolution process, ensuring the knowledge base grows organically with the issues that actually occur in the environment. KB article quality standards: clear problem statement, step-by-step resolution procedure, screenshots where appropriate, platform version and applicability notes, and the related-articles cross-linking that helps analysts navigate to the right article quickly. Periodic KB review to identify and archive articles for retired systems and superseded solutions.

Structured ticket triage ensuring every ticket is assessed for priority, category, and routing within the first response SLA window. Priority classification: P1 (critical complete business function unavailable, multiple users affected, no workaround e.g. email system down, core business application unavailable, network outage), P2 (high significant productivity impact on one or more users, workaround available e.g. application crash for a specific user, shared drive inaccessible), P3 (medium limited productivity impact, workaround available e.g. printer not working, peripheral not functioning), P4 (low cosmetic issues, general queries, scheduled change requests e.g. software upgrade request, new device setup). Priority-appropriate SLA target applied from the moment of ticket creation, with automatic escalation alerts when SLA breach is approaching.

Self-service portal with AI-powered issue resolution reducing the ticket volume reaching human analysts for the most common issue categories. AI chatbot trained on the knowledge base for instant resolution of password reset requests, account unlock, software installation guidance, VPN troubleshooting steps, and common application error resolution available 24/7 without analyst involvement. Automated ticket classification and routing using NLP to analyse ticket content and automatically assign category, priority, and routing without manual triage for well-defined issue patterns. Service catalogue for standard request fulfilment (new user setup, software access request, device provisioning) with automated workflow and approval routing that fulfils standard requests within SLA without requiring analyst intervention at every step.

Microsoft Intune and Windows Autopilot implementation for zero-touch Windows device provisioning and management the gold standard for modern Windows EUC management. Autopilot profile configuration (user-driven or self-deploying mode, domain join vs. Azure AD join, provisioning package for corporate customisation), device group assignment policies, compliance policies (encryption, screen lock, OS version minimum, firewall enabled), configuration profiles (WiFi settings, VPN profiles, certificate deployment, Windows Update rings), and application assignment (required apps installed automatically at provisioning, available apps in Company Portal for self-service installation). Intune endpoint analytics for device health scoring across the fleet identifying the device models, application versions, and configuration states associated with the highest support ticket rates and slowest boot performance.

Jamf Pro for enterprise macOS and iOS management the market-leading Apple device management platform with the deepest integration with Apple Business Manager (ABM) and Apple School Manager (ASM) for zero-touch Apple device provisioning. macOS management: automated enrollment via ABM with Jamf, configuration profile deployment (WiFi, VPN, certificate, security settings, dock and Finder customisation), application deployment via Jamf Self Service, OS update management with deferral policy and forced compliance deadline, and the Jamf compliance policies that enforce the security baseline required for SOC 2 and ISO 27001 certification. iOS and iPadOS management: supervised mode enrollment, app volume purchasing via VPP, managed apps with corporate data separation, and Lost Mode remote wipe for lost or stolen devices.

Virtual desktop infrastructure for the use cases where centralised desktop delivery is operationally or commercially superior to physical device management call centres, bank branches, clinical workstations, and the temporary or contractor workforce that needs corporate applications without requiring corporate device issuance. Azure Virtual Desktop (AVD) for Microsoft 365-centric environments multi-session Windows 11 desktops hosted in Azure, with per-user or pooled desktop models, session host image management (golden image build, update, and deployment pipeline), profile management with FSLogix (cloud-hosted user profiles that follow the user across sessions and session hosts), and the autoscale policies that add and remove session hosts based on active user count to optimise the Azure compute cost. Citrix DaaS for organisations with existing Citrix estate or requirements that AVD cannot accommodate. Citrix Virtual Apps for application virtualisation without a full virtual desktop.

Application packaging and enterprise software deployment via SCCM (Microsoft Endpoint Configuration Manager) and Intune for the Windows environment, and Jamf for macOS ensuring that applications are deployed in the right version, with the right configuration, to the right devices and users, without requiring administrator privileges or manual installation by the end user. Application packaging: converting installer files (MSI, EXE, MSIX, PKG) into managed deployment packages with silent installation parameters, prerequisite checking, and installation verification. Application catalogue management: approved application list, licence tracking, version control (preventing users from installing older versions with known vulnerabilities), and the software licence compliance reporting that identifies over-licensed and under-licensed applications for optimisation.

Mobile device management for corporate iOS and Android devices and BYOD (Bring Your Own Device) programmes via Microsoft Intune MAM (Mobile Application Management), Samsung Knox, or VMware Workspace ONE. Corporate device management: full device enrollment with corporate data protection, remote wipe capability, and the compliance policies required for regulated industries. BYOD management: Intune MAM policies that protect corporate application data (Outlook, Teams, SharePoint) on personally-owned devices without enrolling the device in full MDM management enabling corporate email and data access on personal devices while maintaining corporate control over corporate data (remote wipe of corporate app data only, conditional access based on app protection policy compliance) without requiring employees to surrender control of their personal device.

Managed print services covering the printer estate from device management through consumables and maintenance a support category that consistently generates disproportionate helpdesk ticket volume relative to its strategic importance. Universal print driver deployment via Intune (Print Deploy) eliminating per-printer driver installation, print server administration for organisations with on-premise print infrastructure (queue management, driver updates, print spooler reliability), and print monitoring for consumables tracking (toner level alerts and automated ordering before the printer runs out, rather than after). Network printer discovery and configuration for new device deployments. Multi-function device administration (Konica Minolta, Ricoh, Canon, Kyocera, HP) including scan-to-email, scan-to-folder, copy code administration, and device firmware management.

Joiner, Mover, Leaver (JML) process management — the most operationally critical identity management function and the most commonly mismanaged. Joiner: new user account creation in AD with the correct OU placement, group membership (based on role-based access model aligned to the user's department, location, and position), Exchange mailbox provisioning or Microsoft 365 licence assignment, manager relationship configuration, and the day-one access pack (applications, shared drives, printer queue) that the user needs to be productive from their first day without multiple helpdesk tickets. Mover: role change account modification — removing group memberships associated with the previous role, adding memberships for the new role, updating the manager field, and notifying the relevant application owners. Leaver: account disable within 4 hours of HR notification (or immediately for terminations with elevated security risk), email delegation to manager, OneDrive access delegation, licence reclamation, and scheduled account deletion after the retention period.

Group Policy Object (GPO) design, implementation, and ongoing management — the mechanism that applies security settings, software configuration, and user environment configuration to domain-joined computers and users at scale. Security baseline GPO implementation aligned to the CIS Microsoft Windows Benchmark or Microsoft Security Baseline (password policy, account lockout, audit policy, User Account Control, Windows Firewall, Windows Defender, SMB signing, NTLM restrictions). GPO architecture: OU structure design that enables the right GPO to apply to the right users and computers without complex WMI filters; GPO testing on a pilot OU before production deployment; GPO change management integrated with the ITSM change process. Group Policy troubleshooting using Resultant Set of Policy (RSoP), gpresult, and the Group Policy Management Console to diagnose GPO application failures and precedence conflicts.

Microsoft Entra ID (Azure AD) management for cloud-only and hybrid identity environments — tenant configuration, domain verification, Azure AD Connect synchronisation management for hybrid environments (synchronisation rule customisation, attribute flow troubleshooting, password hash synchronisation vs. pass-through authentication vs. federation), Conditional Access policy design and implementation (requiring MFA for cloud application access, blocking access from non-compliant devices, blocking access from high-risk sign-in locations), Microsoft Entra Privileged Identity Management (PIM) for just-in-time admin access (reducing standing privileged access in favour of on-demand activation with justification and approval workflow), and Identity Protection for risk-based Conditional Access that responds to risky sign-in events in real time.

MFA deployment and management as a fundamental security control for identity protection — covering the full Microsoft 365 and Azure AD MFA capability (Microsoft Authenticator app push notifications, TOTP codes, FIDO2 hardware security keys, phone call, SMS), Conditional Access-driven MFA enforcement (requiring MFA for all users accessing cloud applications, requiring phishing-resistant MFA for privileged accounts), and the MFA self-service registration and reset capability that allows users to register and manage their authentication methods without helpdesk involvement. MFA exception management for legacy applications that do not support modern authentication — identifying and mitigating the risk of applications that bypass MFA through basic authentication protocols. MFA recovery process for users who have lost access to their authenticator device — with appropriate identity verification before credential reset to prevent social engineering attacks targeting the MFA recovery process.

SSO configuration for corporate application portfolio — reducing the number of separate credentials users must manage while improving security by centralising authentication through the corporate identity provider. Azure AD Enterprise Application configuration for SAML 2.0 and OIDC SSO to SaaS applications (Salesforce, ServiceNow, Workday, SAP SuccessFactors, and 3,000+ pre-integrated applications in the Azure AD gallery). ADFS for on-premise federation where cloud-based SSO is not appropriate. Okta as an identity provider for multi-cloud and heterogeneous environments where Azure AD is not the primary identity platform. Application access provisioning automation: new user provisioning to applications via SCIM 2.0 integration (automatic creation of application accounts when a user is added to an Azure AD group) and access recertification campaigns (periodic review of which users have access to sensitive applications, with automatic access removal for uncertified users).

Privileged access management for administrator accounts — the credentials that control the entire IT environment and represent the highest-value target for attackers. Microsoft LAPS (Local Administrator Password Solution) for randomising and rotating local administrator passwords on all managed Windows devices (preventing lateral movement via shared local admin credentials). CyberArk or BeyondTrust PAM for enterprise organisations requiring a full privileged access vault — just-in-time access to server and application admin accounts with session recording, credential checkout, and automatic rotation. Separation of privileged and standard user accounts for IT administrators (no daily work performed from domain admin accounts), privileged access workstations (PAWs) for the most sensitive administration tasks, and the quarterly privileged access review that validates that all privileged account holders still require the access they have been granted.

Continuous infrastructure health monitoring with alert thresholds set to catch developing problems before they become user-impacting incidents: disk space at 85%, server CPU at P90 above 80%, memory utilisation approaching physical limit, SMART disk error count increase, network interface error and discard rate elevation, backup job failures, certificate expiry approaching, and application availability check failures. Automated remediation scripts for the issues that can be resolved without human intervention (disk cleanup, service restart, DNS cache flush), and alert routing for the issues that require engineer attention within defined response windows.

Automated patch management for the full managed device and server estate — Windows Update management via WSUS or Intune Update Rings, third-party application patching via RMM tooling, and server operating system patching via WSUS or scheduled maintenance windows. Patch compliance reporting: every managed device's patch status visible in the monthly report, with devices missing critical security patches flagged for immediate remediation and escalated to the client's IT management team.

Monthly and quarterly maintenance windows for infrastructure tasks that cannot be performed during business hours: server reboots for pending updates, VMware cluster maintenance mode rotation, storage array firmware updates, UPS battery tests, network device configuration audits, and the database maintenance tasks (index rebuilds, statistics updates, consistency checks) that keep SQL Server and other database systems performant. Maintenance window communication to stakeholders 5 days in advance with description of planned activities and expected impact (typically zero or minimal for well-designed maintenance procedures).

Ongoing security baseline maintenance — the continuous programme that keeps the security configuration of managed devices and infrastructure aligned to the defined baseline. Monthly security configuration audit using CIS Benchmark tools (CIS-CAT), Intune compliance policy dashboard, and Group Policy Resultant Set of Policy review to identify devices that have drifted from the security baseline. Vulnerability scanning via Nessus Essentials or Microsoft Defender Vulnerability Management identifying known CVEs in installed software and OS configurations — with remediation prioritised by exploitability and business impact.

SSL/TLS certificate lifecycle management — inventory of all certificates (public-facing web servers, internal services, code signing, email encryption), expiry monitoring with 90-day and 30-day alerts, and automated renewal for certificates managed through Let's Encrypt or Azure-managed certificates. Software licence management: installed software vs. purchased licence reconciliation, unused licence reclamation, subscription renewal tracking (Microsoft 365, Adobe Creative Cloud, security tools), and the annual licence audit that identifies optimisation opportunities before renewal negotiations.

Monthly IT health report providing the IT management team and business leadership with the intelligence to make informed IT investment decisions — helpdesk ticket volume and CSAT trend, SLA performance by priority level, top 10 recurring issues and their planned remediation, infrastructure health summary (patching compliance, storage capacity, backup success rate), security posture (unpatched CVEs, endpoint protection coverage, MFA adoption rate), and the IT recommendations section that translates the operational data into specific, costed recommendations for the coming quarter.