Microsoft 365 Copilot prompts for IT Helpdesk — 10 prompts that deflect tickets

Showing 10 of 10 prompts

• Ticket triage

  M365 Chat

  Prompt

  Analyse the open helpdesk tickets in the attached export. Group by likely category (password, access, email, device, M365 issue, network). Suggest a priority for each based on user impact and SLA. Flag any that look like security incidents.

  Expected outcome

  Triaged ticket list with priorities and security flags.

  Copy promptSubstitute {placeholders}

• Runbook draft

  Word

  Prompt

  Draft a runbook for {Common Issue}. Cover: symptom, likely causes, diagnostic steps in order, remediation steps, escalation path if remediation fails, and what to log post-resolution. Format consistent with our existing runbooks in /sites/it/runbooks.

  Expected outcome

  Runbook draft ready for technical review.

  Copy promptSubstitute {placeholders}

• Incident communication

  Outlook

  Prompt

  Draft a status update for the ongoing {Incident}. Cover: what's affected, what's not affected, current investigation status, next update time, who to contact for urgent issues. Plain English, no jargon, no speculation. Update frequency: every 30 minutes until resolved.

  Expected outcome

  Incident comms ready to send.

  Copy promptSubstitute {placeholders}

• Root cause analysis

  Word

  Prompt

  Conduct a 5 Whys analysis for {Incident Name}. Use the timeline data, the change log, and the post-incident chat thread. Identify the surface cause and walk through to the root cause. End with three specific corrective actions with owners and dates.

  Expected outcome

  Structured RCA with corrective actions.

  Copy promptSubstitute {placeholders}

• Microsoft 365 admin centre triage

  M365 Chat

  Prompt

  Look at the open Microsoft 365 service health alerts. Summarise which ones affect us (we use {Services}), which ones to act on now, which ones are informational, and what the user-facing impact is for each.

  Expected outcome

  Service health triage with user impact.

  Copy promptSubstitute {placeholders}

• User onboarding ticket

  M365 Chat

  Prompt

  Generate the IT setup checklist for a new {Role Title} starting {Date}. Cover: M365 licence assignment, mailbox setup, Teams provisioning, OneDrive setup, distribution list memberships, SharePoint site access, MFA enrolment, device assignment, software installs.

  Expected outcome

  IT onboarding checklist for the runbook.

  Copy promptSubstitute {placeholders}

• Phishing report triage

  M365 Chat

  Prompt

  We received a phishing report from {User}. The attached email and headers — analyse: sender authenticity, link reputation, sender spoofing, attachment risk. Recommend: confirm-and-quarantine, block sender, alert Defender for Office 365, or close as legitimate.

  Expected outcome

  Phishing analysis with recommended action.

  Copy promptSubstitute {placeholders}

• M365 licence right-sizing query

  Excel

  Prompt

  Analyse this Microsoft 365 licence assignment export against our active sign-in data. Identify: users with E5 who haven't used E5-only features in 90 days, F-eligible users on E3, disabled accounts still licensed, guest accounts with full licences. Suggest a right-sizing action per row.

  Expected outcome

  Right-sizing recommendations per user.

  Copy promptSubstitute {placeholders}

• Change request technical write-up

  Word

  Prompt

  Draft the technical write-up for the {Change Request}. Cover: change rationale, scope, technical implementation steps, rollback plan, testing approach, expected user impact, communication plan, change window. Use the standard change template in /sites/it/change-management.

  Expected outcome

  Change request write-up ready for CAB review.

  Copy promptSubstitute {placeholders}

• Access review draft

  Excel

  Prompt

  Review this privileged access export from Entra. Identify: standing Global Admins, users with multiple privileged roles, accounts not used in 30 days, accounts without recent MFA. Recommend an access review action per row (revoke, convert to PIM-eligible, retain, investigate).

  Expected outcome

  Privileged access review with per-row actions.

  Copy promptSubstitute {placeholders}