Every MSP service desk has a category it can’t get ahead of, and for most, it’s password resets. They look trivial, they repeat forever, and they still clog the Level 1 queue, because the reset is the easy part.
The maddening part is that resets feel like the one thing that should be fully automated by now. A user forgets a password; a machine should hand them a new one. But every reset carries an identity check in front of it and a client-specific approval behind it, and that’s the part you can’t let a script skip. So the tickets keep landing on the people you can least afford to tie up.
The volume is more controllable than it looks. Two moves do most of the work: SSO and passwordless to stop resets at the source, then managed automation for the ones that remain.
Why password resets dominate your Level 1 queue
Resets are sticky for three reasons, and only one of them is the reset.
The first is volume: the same users forget the same credentials, week after week.
The second is the identity check, which you can no longer skip. CISA’s advisory on Scattered Spider describes attackers who phone help desks to get passwords and MFA tokens reset, and the 2025 attacks on big retailers started exactly there, so verifying the caller is now mandatory.
The third is the approval behind each reset: one client needs sign-off from a named person, another wants a Duo push read aloud, a third a callback to the number on record. None of that lives in IT Glue or Hudu. It lives in your head, which is why a new technician hands the ticket straight back to you.
Put together, that’s where the hours go. The reset takes minutes. Verifying the caller and walking the client’s approval chain is the real work, and only your senior people know enough to do it. A few hundred resets a month becomes a meaningful slice of your best technicians’ time, and every hour there is an hour off the L2 and L3 work that earns margin.
Fixify’s 2026 IT Help Desk Benchmark Report, drawn from more than 50,000 tickets across 30-plus organizations, puts identity and access work at about 16% of volume, but the number that matters is your own, so count resets, lockouts, and MFA re-enrollments in your PSA.
What cuts reset volume
The reflex is to push resets to self-service, and it only takes you so far.
Self-service password reset works when a user still has a registered method and an unlocked account. Those are the users who wouldn’t have called in the first place. Microsoft’s SSPR documentation says plainly that a user needs a registered method to self-serve, and registration is usually optional, so the people most likely to forget a password are the least likely to have set it up. Lost phones, locked accounts, and MFA re-enrollment take the express line straight through to a human. SSPR trims the easy cases; it doesn’t touch the ones filling your queue.
Two things move the number.
First, cut resets at the source, and start with the free fix: stop forcing periodic password changes, which manufacture resets without improving security. From there, SSO leaves fewer passwords to forget, and passwordless removes the password altogether. The industry is leaning this way: Microsoft made passkeys the default in Entra ID on September 1, 2026 and is retiring its own SMS and voice codes on February 1, 2027. Fewer credentials and phishing-resistant sign-in mean fewer resets to field.
Second, deal with the resets that are left. Your options run from building your own workflows (Rewst, Pia), which puts the maintenance on your team, to adding people, which adds cost without fixing the cause. Managed automation sits in between: a provider builds, runs, and supervises the reset workflows and hands you completed tickets inside your PSA, under your brand, around the clock. Fixify for MSPs is one automation-native option in that category, priced on the tickets it resolves rather than on seats, endpoints, or client count.
Reducing resets pays off twice. Every manual reset is a chance for someone to talk a technician into resetting the wrong account, the exact move CISA described, so the fewer your team handles by hand and the more the rest run through the same identity and policy check, the smaller that opening gets.
How Fixify handles the resets that remain
When a reset comes in through normal intake, Fixify checks the requester against the client’s playbooks and policies. It formulates a plan and executes it through the identity provider. Okta, Microsoft Entra ID, and Google Workspace are among the live integrations, and routine resets, MFA resets, and lockouts run automatically end to end. The ones you’d want a human on, such as an executive or a caller who fails verification, go to a Fixify analyst who approves or adjusts the action first. About a dozen independent checks score each action’s risk, with guardrails set per integration and per skill.
Every action is logged back to your PSA, which stays the system of record, so your technicians keep working where they already do. The playbooks come from your own ticket history, documentation, and recorded calls with your experts, so the approval chain that lived in your head finally gets written down once. Rollout is read-first, write-second, and coverage expands as the playbooks mature.
Figuring out which problem you have
Before you spend a dollar, work out which problem you’ve got, because the two look alike and need opposite fixes. If a lot of your resets were self-service-eligible but came in as tickets anyway, that’s a deflection problem, and the answer is registration, expiration policy, and SSO. If only a few of them were eligible and each one burns verification time, that’s an automation problem, and the answer is handing the survivors to a provider who owns the identity checks and the client chains.
Pull four numbers from 90 days of PSA data:
- Share of L1 tickets that are resets, lockouts, or MFA re-enrollments, counted separately.
- How many were self-service-eligible: a registered method, no lockout.
- Repeat-reset rate per user, which exposes forced expiration and cached credentials.
- Average verification time per reset, from first contact to execution.
Upload 90 days of ticket data to Fixify’s free Ticket Snapshot to see which categories drive your volume and repeat work, then start with the one that is both high-volume and low-eligibility.
