Ask ServAIceDesk

Select ✦ Ask next to the search box at the top of the service desk. Type a question in your own words and press Enter. Each answer is worked out from your service desk's records: the numbers are counted, not guessed, and the cases behind them are listed so you can open them. Days (*today*, *yesterday*, *the last 3 days*) follow your organization's time zone, as in Reports.

What you can ask

• How many, which ones: *How many Okta-related tickets have we received in the last three days?* *Show me all unresolved incidents affecting VIP users.*
• Breakdowns and trends: *Which services are generating the most incidents?* *Incidents per day this month.*
• What is happening now: *Is there currently a major incident?* *Why has our ticket volume increased today?*
• What needs you: *What are the most urgent issues requiring my attention?*
• Patterns: *Are there any recurring issues that should become problem records?* *Find duplicate tickets about the VPN outage.* *Summarize security incidents from the last 24 hours.*
• Deadlines and people: *Which cases are about to breach their SLA?* *Show tickets from sara@example.com.* *How busy is the Network team?* *Who has the most open cases?*
• Service levels: *What is our SLA performance this month?* *SLA performance by team.*
• Changes and services: *What changes are scheduled this week?* *Which change could have caused INC-000123?* (a change linked as the cause is confirmed; changes implemented in the 72 hours before, same service first, are suspects) *Which services are degraded?* *How is Microsoft 365 doing?*
• Assets: *Which assets have the most incidents?* *What assets are assigned to sara@example.com?*
• Knowledge: *How do I reset a VPN token?* *What's the fix for Outlook asking for passwords?* (help articles, and how similar cases were resolved)
• Contracts and customers: *Which contracts expire this quarter?* *Contracts with Zebra.* *Tell me about sara@example.com.*
• In Arabic: *كم عدد تذاكر Okta في آخر 3 أيام؟* *هل يوجد حادث كبير؟* Common service-desk words are understood; answers are in English.

Answers that count or group cases have Open as a report: it opens Reports with the same question, ready to adjust and save.

Right now

When you open Ask it shows what is happening without being asked, each marked Confirmed or Suspected with its evidence: declared major incidents, an outage forming (several new incidents about the same thing in the last hour), volume well above usual, many cases about to breach, urgent cases nobody owns, high-severity security alerts and new recurring issues. Ask *What's going on right now?* for the same at any time. Staff also get an in-app notification (not an email) when an outage seems to be forming, volume jumps or a high-severity security alert appears, at most once an hour for each.

Starting a request

Say what you need: *Start employee onboarding for Lina Haddad, starting Nov 2, in Finance, with a laptop* or *Request a laptop for sara@example.com*. Ask finds the request form and fills in what you said (dates, names, emails, yes/no answers and choices). Check it, complete the rest and select Submit request: nothing is requested until you do, and it goes through the form's normal approval and workflow.

Asking for changes

• *Resolve all eligible tickets associated with the resolved Okta outage.*
• *Assign all unassigned Microsoft 365 incidents to the appropriate support team* (your routing rules decide), *to the Network team*, *to sara@example.com* or *to me*.
• *Set them to urgent*, *escalate INC-000123* (one priority level up, or *to the Network team*).
• *Link them to INC-000123* or *to the VPN major incident*. *Categorize the Outlook incidents as Microsoft 365* (sets the service).
• *Put them on hold*, *start working on INC-000045*.
• *Add a note to them: vendor engineer booked for Thursday* (staff only). *Reply to the requesters of the printer incidents: the engineer comes Thursday morning* (each requester is emailed).
• *Merge the duplicate VPN tickets* (look-alikes merge into the oldest) or *merge them into INC-000123*.
• *Declare INC-000123 a major incident* (one at a time). *Create a problem record for the recurring Outlook issue* (admins).
• *Run triage on the unassigned incidents*, *investigate PRB-000012*, *review CHG-000031*: the built-in automations, under your autonomy policy.
• Security alert groups: *Dismiss the security alerts on vpn-gw-01 as false positive* (the reason is kept), *watch the alerts on fs-01*, *investigate the security alerts on fs-01*.
• Several steps at once: *Resolve the Okta incidents and tell the requesters: Okta fixed the sign-in issue.* Each step is its own plan to confirm.

After a run, Undo (within 24 hours, by whoever asked or an admin) sets back what can be reversed: priority, owner and team, status, service and links; resolved cases are reopened (their requesters already had the resolution email). Notes, replies, merges, major incidents, problem records, automations and security changes can't be taken back.

Ask first shows a plan: the exact cases and what would change on each, and the cases left out with the reason (already resolved, waiting for approval, open tasks to finish, the outage not resolved yet…). Nothing changes until you select the confirm button. Untick any case to leave it out. To resolve, add the resolution note the requesters will see (Ask suggests the outage's own note). Each case is then changed through the normal update, as if you did it yourself: its checks, emails to requesters and the audit history all apply, and a plan can be used once, within 30 minutes.

Act on the cases you just asked about with *them*: ask *Show me the unresolved VPN incidents*, then *Assign them to the Network team*. An action that doesn't say which cases (*Resolve everything*) is not planned; Ask asks which cases you mean. At most 100 cases change at once.

Approval for large changes

When an agent asks to resolve, merge or reply to more than 10 cases, or change more than 25 in another way, the plan goes to your admins instead (they're emailed). Admins can change both limits under Settings › AI & automation › Permissions & policy › Ask ServAIceDesk, along with how many new incidents in an hour suggest an outage and whether admins are also emailed about it; the same page shows how Ask is used and which questions it couldn't answer. An admin approves or declines it under My approvals; approving runs it as the agent who asked, with their permissions checked again. The agent is told the outcome. Admins' own plans don't need a second approval.

Ask limits are read back after saving. A failed load shows Refresh Ask settings; a failed save keeps your draft and asks you to refresh before retrying. Refresh asks before replacing unsaved edits. A usage-report failure has its own Retry Ask usage button and does not prevent configuring limits.

Follow-up questions

Ask a follow-up without repeating yourself: after a question about Okta tickets, *How does that compare to last week?*, *Show me the unresolved ones* or *by priority* keep the same subject and filters. A conversation is private to you and is forgotten after two hours without questions.

How answers are worked out

ServAIceDesk first reads the question with fixed rules. Only when it is unsure, and AI is turned on for your service desk, the AI helps by choosing among the same fixed options (for example *incidents*, *unresolved*, *the last 7 days*). The AI never writes database queries, never sees other organizations' data, and never decides or runs an action: changes come only from your own words, are shown as a plan, and run only when you (or an approving admin) confirm. When the rules understand that you want a change but not to what (*move these over to the infra folks*), the AI may pick it from fixed options: your own teams and services, the priorities and statuses. That too is only a plan to confirm. Open How I got this under an answer to see exactly which cases were counted.

Who can use it

Admins and agents. Each person sees and changes only what they could already see and change in the service desk. Requesters get a smaller Ask: their own requests (*Where is my request?*), the help articles they may read, and starting a request; they can't change anything through it. Every question, plan, approval and change is recorded in the audit history. To turn Ask off for your service desk, contact ServAIceDesk support.

VIP users

Questions about VIP users use your requester groups: create a requester group whose name contains VIP or Executive (Settings › People & access) and add its people or email domains.