Use cases by function

AI agents for in-house IT in SMEs

Roles involved
IT managers, system administrators, external IT providers, developers, IT security leads, internal AI champions
Common software
Microsoft 365, Entra ID and Intune, Microsoft Defender, SharePoint and Teams, Azure, GitHub and GitHub Copilot, Claude Code, Jira and Confluence, a ticketing tool, Power BI, PowerShell
73

First-line IT support agent

Today

The same questions come back every week: passwords, printers, remote access, sharing a Teams folder. They keep interrupting the person who runs IT.

With AI

We configure an agent in Teams connected to your knowledge base, your ticketing tool and, read-only, to Intune. For each request it checks the status of the device concerned, answers when an approved procedure exists, and otherwise opens a triaged ticket (category, priority, device, steps already tried) with a proposed fix. Anything involving access or security goes to the person responsible for IT, who also reviews the standard answers; every exchange is logged in the ticket.

What to measureThe number of requests resolved without intervention, how many tickets arrive already triaged, and how colleagues rate the answers.

Tools Microsoft Copilot Studio, Teams, SharePoint, Intune, Jira Service Management or another ticketing tool

74

Infrastructure documentation agent

Today

Documentation of the network, servers and procedures is incomplete or out of date; it lives mostly in the head of the administrator or the provider.

With AI

The administrator places configuration exports with secrets removed, along with notes and scripts, in a repository. A ready-made agent such as Claude Code or GitHub Copilot in agent mode works through them, writes structured documentation and step-by-step procedures, flags gaps against the existing documentation and opens a pull request. The administrator checks each procedure by running through it before merging and publishing.

What to measureThe number of systems and procedures documented, and the date each was last verified.

Tools Claude Code, GitHub Copilot, GitHub or Azure DevOps, Confluence or SharePoint, PowerShell·Sectors IT services

75

Coding agents: from ticket to pull request

Today

The development team spends a lot of time on repetitive code, writing tests and making sense of old, poorly documented code.

With AI

We roll out coding agents (Claude Code, GitHub Copilot in agent mode, OpenAI Codex), excluding sensitive repositories, and train the team to hand them a task described in a ticket: the agent reads the code, writes the change and the tests, runs the test suite and opens a pull request explaining what it did. Every pull request goes through human review and continuous integration before merging; the technical lead decides on release to production.

What to measureTime from opening a ticket to a reviewed pull request, and the number of defects found after release to production.

Tools Claude Code, GitHub Copilot, OpenAI Codex, GitHub or Azure DevOps, Visual Studio Code·Sectors IT services

76

Patch and vulnerability agent

Today

Microsoft patches, business application updates and vulnerability advisories pile up. Working out which devices and servers are affected, and in what order to act, takes hours of research.

With AI

Whenever patches or vulnerability advisories are published, the agent cross-checks the Intune and Defender inventory against the release notes, lists the devices and servers affected, flags known incompatibilities with your applications and prepares a phased rollout plan as a change request in the ticketing tool. The administrator approves the plan and starts the rollout personally; the agent then tracks device status and reports those still lagging behind.

What to measureTime between the release of a critical patch and its rollout, and the number of devices left behind.

Tools Microsoft Intune, Microsoft Defender Vulnerability Management, Windows Autopatch, ticketing tool, Power Automate, an API-based agent

77

Joiner and leaver agent with access reviews

Today

With every new hire, role change or departure, permissions are adjusted case by case. Unused accounts and overly broad access linger.

With AI

When HR announces a new hire, role change or departure, the agent reads the role profile, prepares the matching groups, licences and application access in Entra ID as a request awaiting approval, and creates the ticket to set up the workstation. For periodic reviews, it compares actual permissions with the profile and lists discrepancies. The administrator approves every grant or removal, the relevant manager signs off the review, and the agent logs each of its actions.

What to measureTime to deactivate an account after someone leaves, and the number of discrepancies found at each review.

Tools Entra ID (access packages), Intune, Power Automate, Microsoft 365, HR software

78

Investigation agent for alerts and suspicious e-mails

Today

Staff forward dubious e-mails, and security tools produce alerts that nobody has time to read in full.

With AI

For each reported e-mail or Microsoft Defender alert, the agent investigates according to your procedures: it analyses headers and links, looks for the same message in other mailboxes, checks recent sign-ins for the account concerned and writes a summary in the ticket with severity, evidence and recommended measures. The person responsible for security decides on the measures (deletion, blocking, resetting, informing staff); the agent does not act on accounts by itself and logs every lookup.

What to measureTime to handle a reported e-mail, and the number of alerts left without follow-up.

Tools Microsoft Defender, Microsoft Security Copilot, Exchange Online, Entra ID, Teams, ticketing tool

79

Reporting agent for your POS and ERP data

Today

Sales, stock and footfall figures are split between the till, the online shop and the ERP. Every question from management needs a manual Excel export.

With AI

We build a database bringing these sources together and an agent that, on a question asked in Teams or every Monday, queries it through controlled queries, reconciles till, online shop and ERP, flags discrepancies, produces the report with its charts, files it in SharePoint and posts it in the management channel. The person in charge of data approves the definition of each indicator, and every figure cites its source and query.

What to measureTime to answer a question from management, and the number of discrepancies found between reports and the till.

Tools Lightspeed, Shopify, your ERP, Power BI, Azure SQL, Teams, SharePoint, a custom-built agent·Sectors Retail, Hospitality

80

Document search partitioned by client file

Today

Staff want to query files with AI, but each client file must remain visible only to authorised people, as professional secrecy requires.

With AI

We build a search assistant that respects, file by file, the access rights of your file server or SharePoint and logs every query. IT validates the permission setup through testing before launch, and the partners decide which files go in.

What to measureThe outcome of partitioning tests before each go-live, and the time needed to find a document in a file.

Tools SharePoint, Azure AI Search, Entra ID, a custom application·Sectors Law firms, Fiduciaries

In short

In an SME, IT often rests on one or two people, or on an external provider. An AI agent receives a trigger (a ticket, a security alert, a new joiner announced by HR, a published patch, a development task) and works through the steps: it checks Intune, Entra ID or Defender, triages the ticket with a proposed fix, prepares access rights awaiting approval or opens a tested pull request. It makes no security decisions, grants no access and puts nothing into production: the person responsible for IT approves, and every action the agent takes is logged.

Points to watch

Here, AI touches the systems themselves: accounts, permissions, logs, code. Access granted to an agent follows the principle of least privilege, goes through dedicated technical accounts and is logged. Hosting location (Switzerland, the EU or elsewhere), training clauses and sub-processing are checked before any deployment. Passwords, API keys and customer data stay out of prompts. Usage rules and nFADP matters belong to management and legal; we handle their technical implementation.

Can we let an AI agent act on our systems?

Yes to reading, investigating and preparing; no to deciding. The agent uses a technical account with limited permissions: it checks Intune, Entra ID or Defender, writes in the ticket, opens a pull request or an access request awaiting approval. It has no direct write access to production. The administrator reviews, tests in a separate environment and applies the change. Every action the agent takes is logged so you can trace who did what.

Which AI tool should we choose for the whole company?

The choice depends mainly on your environment. If you work in Microsoft 365, Copilot and its agents inherit your existing access rights; ChatGPT Business, Claude or Gemini can suit depending on your uses, the connectors available and your ecosystem. We compare the offers against your criteria (hosting, training, account administration, connectors) and test with a few colleagues before deciding. Many companies keep one main tool and a second one for specific needs.

Is code written by a coding agent reliable?

It is often right, and sometimes convincingly wrong. We treat every pull request from the agent like a colleague’s work that needs reviewing: code review, automated tests and a security scan before merging. Added libraries are checked, and no keys or customer data go into the agent’s context. The decision to release to production stays with the developer and their lead.

Choose your first use cases.

In half a day or a day, the AI Workshop sorts your ideas and keeps three, tested on your own documents.