You are here:
Phase 3 — Provision Your IT Team
Outcome: Each pilot participant has an existing or newly created Salesforce user, the required licenses and permissions, and membership in the queues or groups required for the pilot.
Required Editions
| Actions | Permissions |
|---|---|
| Create users | Manage Internal Users |
| Create public groups | Manage Users |
| Create queues | Customize Application AND Manage Public List Views |
Owner: System Admin
-
Create users by persona.
Identify an existing Salesforce user for each pilot participant, or create a user when one doesn’t already exist. One person can perform more than one IT Service role. Use the following table to identify an appropriate baseline profile; grant IT Service access through the required permission sets and permission set groups.
Persona Purpose Profile System Admin Configure and deploy core features System Administrator Incident Fulfiller Resolves day-to-day incidents Standard User Incident Manager Oversees incident resolution, SLAs, KPIs Standard User Major Incident Manager Manages Major Incident lifecycle, approves critical events Standard User Problem Fulfiller Investigates root cause Standard User Problem Manager Owns Problem process, prioritizes recurring issues Standard User Change Fulfiller Plans, executes, verifies changes; supports PIR Standard User Change Manager Approves change requests, assesses risk Standard User Release Manager Coordinates and executes releases Standard User 
Tip For the initial incident journey, identify at least one Salesforce admin, one incident fulfiller, and one person responsible for incident management. Add users for other roles as those processes enter scope. -
Assign Permission Set Groups.
Permission Sets and Permission Set Groups (PSGs) are how access is actually granted in Agentforce IT Service — not profile alone.
- Open Manage User Access (from the post-install screen of Phase 2, or via Setup).
-
Assign each user the Permission Set Group that matches their role (for example
Change Request Fulfiller, Change Request Manager).
For detailed permission set assignments per feature, follow the per-feature topics:
- Incident Management permission sets
- Problem Management permission sets
- Change Request Management permission sets
- Release Management permission sets
- Self-Service Portal permission sets
- CMDB and Service Graph permission sets
Tip Why PSGs and not just profiles? PSGs let you bundle permissions by job function. Updates to underlying permission sets propagate to all PSGs that include them, so you change permissions in one place. This is the recommended approach for IT Service.For more information, see Incident Management Permissions for IT Services.
-
Create Public Groups and Queues.
Create the queues and public groups required by your pilot process. The following names and memberships are examples; use names that follow your organization’s conventions.
Group / Queue Members Purpose IT Fulfillers Queue All Incident Fulfillers Example destination for incidents assigned by an assignment rule and distributed through Omnichannel Routing when configured Major Incident Approval Group Major Incident Manager(s) Public group for notifications and approval requests when an incident is proposed as a major incident Release Group (if rolling out Release Mgmt on Day 1) Release Manager(s) Coordinates approved change deployments and release planning - Add the relevant users to each.
Validation
- Each named IT team user logs in successfully.
- Each user can see the tabs and records their role requires (e.g., Incident Fulfiller sees Incidents).
- At least one queue exists with at least one fulfiller as a member.
Common pitfalls
- Profile-only setup. Granting only a profile without the PSG produces hard-to-debug "I can't see this object" tickets. Always assign the PSG.
- Empty queues: An assignment rule can assign an incident to a queue that has no eligible fulfillers. Confirm queue membership and, when used, Omnichannel availability before testing work distribution.
- No backup fulfiller: For production readiness, add enough eligible fulfillers to provide coverage when a team member is unavailable.
