Why SuperSupport Does Not Manage Users and Licenses

If you let people create accounts by chat, you also let people take them over by chat.

“Please create an account for our new colleague and give her Business Premium.” Some AI service desks promise to do exactly that by chat: create the account, assign the license, add groups, done. SuperSupport deliberately does not do this. As with passwords (see Why SuperSupport does not reset passwords), there are good reasons.

What first level is, and what it is not

First-level support solves problems an employee has with their device and their programs. The printer does not print, Outlook hangs, OneDrive does not sync, the Teams camera does not work. That is what the SuperSupport agent runs on the Windows or Mac device for.

User management is administration. Who gets an account, which license, which groups, which shares: those are decisions about costs, permissions and data. They belong with IT or the MSP and with tools built for it.

Reason 1: Licenses cost money

Every assigned license shows up on the next invoice. A bot that hands out Business Premium, E5 or add-on licenses on request moves budget decisions into a chat window. Who gets which license should be decided deliberately. See Choosing a Microsoft 365 license and Planning your IT budget.

Reason 2: Groups are access rights

A group in Entra ID is often a key: to the accounting library, to the management team, to a business application. Whoever gets into the “Accounting” group by chat has access to data they perhaps should not see. Such changes need approval from someone who knows the consequences.

Reason 3: Traceability

Auditors, insurers and NIS2 ask: Who granted which permissions when, and why? The answer “the chatbot, because someone asked” is not enough. Granting accounts and permissions belongs in a documented process. See Automating onboarding and offboarding and NIS2 for MSPs.

Reason 4: Fewer permissions for the support tool

A system that can create users and assign licenses needs far-reaching administrator rights in the tenant. For an MSP with many customers, that would mean one more privileged account in every customer tenant. SuperSupport does not need these rights to handle first level, so it does not get them.

What SuperSupport does instead

• Task: New employee – Who: IT / MSP; What the agent contributes: collects all details in the chat (start, role, programs, mailboxes, device) and hands over a complete case
• Task: First working day – Who: Agent; What the agent contributes: answers questions on the device (printer, OneDrive, Teams, VPN); see IT checklist for new employees
• Task: Additional license/software – Who: IT / management; What the agent contributes: records the request with a justification instead of fulfilling it itself
• Task: Employee leaves – Who: IT / MSP; What the agent contributes: records cutoff date, forwarding, successor, files; see Mailbox of a departed employee
• Task: “Office says no license” – Who: Agent + IT; What the agent contributes: checks the account and Office status on the device, hands over if a license is really missing

That way, IT does not get a “The new person needs something” but a complete order, and the decision stays where it belongs.

Beta

IT support that fixes itself.

supersupport.ai handles your 1st-level support fully automatically. Secure your spot on the waitlist now.

Join the Waitlist

And if you want to automate user management?

There are suitable ways to do that, with fixed rules instead of free-form chat requests:

• Group-based licensing in Entra ID: whoever is in the “Sales” group automatically gets the matching license.
• Templates and lifecycle workflows for joiners and leavers.
• The MSP's automation in the RMM or PSA. See NinjaOne alternative or complement.

SuperSupport complements this: the agent makes sure the request arrives complete and helps the employee afterward on the device.

What does SuperSupport offer?

SuperSupport takes over first-level IT support via chat, directly on the Windows or Mac device: the agent handles harmless things itself, submits sensitive ones to IT for approval, every step is logged, and every chat is also the case record. Multi-tenant for MSPs. How this looks for internal IT teams and MSPs is described on the respective pages.

Frequently asked questions

Can SuperSupport create new users in Microsoft 365?

No, deliberately not. SuperSupport has no write access to Active Directory, Entra ID or the Microsoft 365 admin center. IT manages accounts, licenses and groups, with the tools built for it.

Why should an AI not assign licenses?

Because every license costs money and means access to data. Who gets which license, which group and which share is a decision for management or the department, and it should be documented in a traceable way. It should not be the result of a chat request.

What does SuperSupport do when onboarding new employees?

In the chat, the agent collects all the details IT needs (name, start date, role, required programs, mailboxes, drives, device) and hands over a complete case. From the first working day, it answers the typical questions on the new employee's device.

And for offboarding?

Here too, the agent takes the request in full (cutoff date, forwarding, successor, files, device return) and passes it to IT. IT blocks the accounts and removes the licenses.

Are there tools that automate user management?

Yes, for example group-based licensing in Entra ID, lifecycle workflows, templates in the admin center or the IT service provider's automation. They work with fixed rules and approvals instead of free-form chat requests.

Beta

IT support that fixes itself.

supersupport.ai handles your 1st-level support fully automatically. Secure your spot on the waitlist now.

Join the Waitlist