Prerequisites: the IT help desk playbook. Device lookups need an MDM connected: Jamf for Apple fleets, Fleet for cross-platform, or Intune for Windows.
What good looks like
1
Ask for the four things that make a request shippable
Most hardware forms ask ten questions and still leave the responder chasing. Four fields cover it:
Set a default priority per request type. A broken machine and a second monitor should not arrive at the same urgency.
Learn more about forms and custom fields
2
Let the agent collect the details conversationally
People describe hardware problems in a sentence, not a form. Add a rule so the agent gathers the fields one at a time and then publishes a ticket the responder can act on.This is better than pointing people at a form link, because the requester never leaves the conversation and the responder still gets structured data.
For laptop replacements and repairs, ask for the asset tag, the preferred model, and the shipping address, one item at a time. Then create the ticket on the Device and hardware form with what you collected.
Learn more about conversational form filling
3
Put device context on the ticket
Connect your MDM and responders stop tool-hopping. Depending on the platform you get device lookups by serial, name, model, or OS, compliance state, encryption and MDM enrollment status, installed software, and last check-in time.That last field resolves more tickets than it looks like it should. A machine that has not checked in for three weeks explains a lot of “my policies are not applying” reports.
4
Gate the destructive actions
All three MDMs expose remote wipe or erase, and Jamf and Fleet can return disk encryption recovery keys. These are exactly the tools to put behind Requires approval rather than Auto-execute.A reasonable split:
- Auto-execute: device lookup, compliance state, software inventory, last check-in
- Requires confirmation: sync or refresh a device, request a policy re-push
- Requires approval: wipe, erase, retire, and any recovery key retrieval, pointed at an approval template with your IT leads
Learn more about tool execution policies
5
Handle a lost or stolen Mac
With Jamf connected, the agent can lock or erase a Mac from the conversation. Lock first. It is reversible, and the 6-digit unlock PIN goes to the requester by private Slack DM. Erase only when the Mac is confirmed stolen or will not come back.Anyone can lock or erase a Mac assigned to them in Jamf. Locking someone else’s Mac takes a workspace member or admin, and erasing one takes an admin. Set
When someone reports a lost or stolen Mac, use @Computer Info to find it and confirm the name and serial number with them. If the Mac is lost or misplaced, use @Lock Mac. Only if they confirm it was stolen or will not be recovered, use @Erase Mac. Tell them the command runs the next time the Mac is online.
@Erase Mac to Requires approval so an IT lead signs off on every wipe.Learn more about Jamf agent tools
6
Pair every replacement with a return
Build a task template for replacements with the return step in it, dated. Tasks are visible on the ticket, so the return is tracked in the same place as the shipment instead of in a spreadsheet.A workable template:
- Confirm the model and address with the requester
- Order or allocate the device
- Ship and record the tracking number
- Confirm receipt
- Return the old device, due 14 days after receipt
- Wipe and retire the returned device in the MDM
Learn more in task templates
7
Reuse the same template at offboarding
Offboarding is the return half of this playbook with a deadline attached. Rather than building a second flow, attach the return and wipe steps to the task template that lands on IT’s offboarding child ticket, so the device work sits alongside the access revocation on the ticket IT already owns.
Learn more in employee offboarding
Where teams get this wrong
A free-text device field
A free-text device field
You will get requests for hardware you do not stock, and a negotiation instead of a fulfillment.
No shipping address on the form
No shipping address on the form
This is the most common single cause of a stalled hardware ticket.
Auto-executing wipe
Auto-executing wipe
It is irreversible, and an agent misreading “wipe my browser cache” is not a theoretical risk.
Returns tracked outside the ticket
Returns tracked outside the ticket
If the return is not a dated task, it does not happen.
Next
Employee offboarding
Where the return step earns its keep.
SLAs and business hours
Different targets for broken and nice-to-have.