Philippines staffing blog ·
Onboard an Outsourced Agent Into a Client ITSM Tool With Limited Admin
You rarely get full administrator rights. Plan the onboarding around the permissions you can request, test, and remove.
Direct answer
Operational guidance
Start from the work, not the tool
Before requesting a role, list the actions the agent must perform: view tickets in the assigned queues, add internal notes, send approved replies, attach evidence, and route to a specialist. Then list the actions the agent must not perform: change SLA settings, edit workflows, export the full ticket database, or manage other users. The permission request should follow from that list, not from a generic template.
Ask for a role, not an admin account
A named account with a scoped role is easier to audit and safer to remove than a shared admin login. If the client insists on an admin account because roles are not configured, treat that as a finding and ask for a temporary, time-bound exception with logging. Do not accept a shared account as the normal path. Shared credentials destroy the audit trail and make offboarding unreliable.
Test the boundaries before go-live
Create a test ticket and try the permitted actions. Then try one action that should be blocked, such as exporting the queue or editing a workflow, and confirm that it fails. Record the result. A permission that looks correct in the admin console may behave differently in the agent's view. The test is the only reliable evidence that the role matches the work.
Configure notifications and views carefully
An agent needs the queues, filters, and saved views that match the assigned work. Too many notifications create noise; too few hide new work. Set the views with the client's process owner and record the naming convention. Avoid personal filters that only one agent can see, because they disappear at reassignment and hide work from the team.
Write the local work instructions
The client's tool will have its own fields, statuses, and required notes. Write a short local guide that maps the client's terms to the actions the agent performs. Include screenshots only if they contain no customer data. Keep the guide versioned with the client onboarding record so a later change can be traced.
Plan the exit on day one
Record the account name, the role, the systems, the client administrator contact, and the removal steps. Set a review date for the access and a trigger for removal at assignment end. Offboarding should not depend on remembering which client had which tool. The record belongs with the assignment, not in someone's inbox.
Review the first two weeks
Ask the agent which action was missing, which field was confusing, and which request had to be routed because the role was too narrow. Distinguish a genuine permission gap from a workaround the agent wanted for convenience. Adjust the role only with the client's approval, and record the change.
Authoritative sources
- NIST SP 800-53 Rev. 5, Security and Privacy Controls
- CISA, Require Multifactor Authentication
- Atlassian, Jira Service Management Documentation