Set Up Employees for IT Services

To provide a seamless service experience, you must create Employee records using the appropriate licenses and assign the necessary privileges to ensure they have the right level of access and support.

Required Editions

Available in: Lightning Experience

Available in: Enterprise, Performance, and Unlimited Editions with Agentforce IT Service.

User Permissions Needed
To create users:	Manage Internal Users
To enable Employee User:	Edit access on User record

Create Employees

To set up your employees, first create a user with the Unified Employee license and then designate them as an employee.

For more details on this license, see Unified Employee License Details.

Note All employee users created before the Spring ‘26 release using the Customer Community Plus license and user profile remain unaffected. These users retain their existing access, permissions, and functionality. However, we recommend using the Unified Employee license and profile for creating new employees moving forward.

Create a person account.
1. From the App Launcher, search for and select Accounts.
2. Click New and create a person account.
3. Enter the user’s details, such as first and last name.
4. Save the changes.
Build and publish an Experience Cloud site for your employee users using an IT Service template.
Create a new user record.
Assign the new user you created the Unified Employee license and the associated permission set licenses and permission sets.
See Assign the Unified Employee license.
Assign the required permission sets to your user.
See Set Up Permission Sets and Access for the Employee Services Portal.
Add the user as a member of the Experience Cloud site for your Employee Services portal.
See Assign the Unified Employee license.
Designate as an employee.
1. From the App Launcher, search for and select People.
2. Select the user you created.
3. Click Enable Employee User.
4. Enter the employee's specific details, such as the associated contact, employee number, start date, and employee status.
5. Save the changes to create the official employee record.
Give your employee users access to Microsoft Teams.
Give your employee users access to Slack.

Direct the employee to your employee portal URL. The employee can click Forgot Password on the login page and follow the email prompts to set their password and begin using the portal.

Assign a Service Management Privilege to Employees

Create and assign a service management privilege to employees so that records for privileged employees are prioritized by the IT team, whether they log the record themselves or an IT service rep logs it for them. When an employee with a privilege that’s tagged VIP reports an incident, a banner on the incident record tells fulfillers that the incident requires prioritized handling.

Required Editions

Note This feature applies to employees represented as person accounts. Person Accounts must be enabled in your org, and each person that you assign a privilege to must have an employee record.

User Permissions Needed
To assign or remove privileges for employees:	Assign Service Management Privilege User

The Assign Service Management Privilege User permission comes with the Service Management Privileges permission set license, which is included in the Incident Manager permission set group. Without this permission, the action for assigning privileges doesn’t appear on the employee record.

Tags categorize privileges and can be reused across records. When you turn on service management privileges, Salesforce adds a VIP tag value for you. To categorize privileges with your own tags, add Tag picklist values for Service Management Privileges in Object Manager. To add or edit Tag picklist values, see Add or Edit Picklist Values.

Turn on service management privileges, and create the privileges that you assign to employees.

From Setup, in the Quick Find box, search for and select Service Management Privileges.
You can also go to Feature Settings, and then select Service Management Privileges. In earlier releases, this page was under IT Service Management.
Turn on Service Management Privilege Assignment.
When you turn on this setting, Salesforce creates a privilege that’s tagged VIP so that your team can use it right away. Edit this privilege like any other privilege, or create more privileges alongside it. If you turn the setting off and on again, Salesforce doesn’t create a duplicate.
In the Service Privileges section, click New.

Enter the details.

Field	Description
Privilege Title	Enter the display name for the privilege, such as `CEO`. This name appears on the privilege badge wherever the privilege is shown to fulfillers.
Description	Enter a description for the privilege. For example, `This is for privileged employees only`.
Tag	Select a tag. For example, Privileged User or General User. Incidents reported by an employee who has a privilege that’s tagged VIP are automatically flagged for prioritized handling.
Function Type	Select a function type. IT Service is available by default.
Access Level	Enter an access level for the privilege. Higher access levels represent higher-priority employees in your org.
Color	Select the background color for the privilege badge. If you don’t select a color, the badge uses a default color.

Save your changes.
(Optional) To update or remove a service privilege, use the row actions menu, and select Edit or Delete.

Assign one or more service privileges to an employee.
1. From the App Launcher, find and select Agentic IT Service Desk, and then select Employees.
2. Open the record of the employee that you want to assign a privilege to.
  If the Employee Profile Card isn’t on the page, edit the page and add the component.
3. From the actions menu on the Employee Profile Card, select Assign Service Privileges.
  If you don’t see the action, check that Service Management Privilege Assignment is turned on and that you have the Assign Service Management Privilege User permission.
4. Select one or more privileges, and then click Assign.
  The privileges that you select replace the employee’s current assignments. To remove a privilege, clear its selection before you assign.

Assigned privileges appear to fulfillers in these places:

On the Requester Information card of a record such as an incident, each of the requester’s privileges appears as a colored badge. Up to three badges appear. If the employee has more privileges, the remaining ones are collapsed into a count that you can point to to see the rest.
When an employee who has a privilege that’s tagged VIP reports an incident, a banner at the top of the incident record tells fulfillers that the request requires prioritized handling.
The read-only Is VIP User Impacted field on the incident is selected when the employee who reported or created the incident has a privilege that’s tagged VIP. Use this field in list views, reports, and milestone criteria. The field isn’t on the default page layout.

Note Salesforce sets the Is VIP User Impacted field when an incident is created and when the Reported By field changes. If you assign a privilege to an employee after their incident is created, the incident doesn’t reflect the change until it’s saved again with a different Reported By value.

Prioritize Incidents for Employees with Privileges

Use the standard flow templates to give incidents from privileged employees faster SLA targets and specialized routing. Each template checks whether the employee who reported the incident has a privilege that’s tagged VIP.

Turn on service management privileges and assign a privilege that’s tagged VIP to at least one employee. See Assign a Service Management Privilege to Employees.

To use the entitlement template, SLA policies and entitlements must also be enabled for your org.

Note Flow templates don’t run on their own. Clone each template into a flow, and then activate the flow.

To give incidents from privileged employees faster response and resolution targets, create an SLA policy for incidents, add milestones, and activate the policy with an entitlement.
See Configure Your Own SLA Policies and Milestones for IT Services. Copy the ID of the entitlement, because you need it in the flow.

Note If you set a milestone’s activation criteria to Rules without adding any conditions, the milestone never activates. Leave the activation criteria blank, or use a formula with the value true.
From Setup, go to Flows, and find the Assign Incident Entitlement Based on Privilege template.
Clone the template into a flow.
In the Update Incident element, enter the ID of the entitlement to assign.
The template ships with this value blank. Until you set it, the flow doesn’t assign an entitlement.
Save and activate the flow.
The flow runs when an incident is created or updated and no entitlement is attached yet. Attaching the entitlement is what starts the SLA milestones on the incident.

To prioritize incidents for a privilege other than VIP, edit the condition in your cloned flow.
To route incidents from privileged employees to a specific queue or user, find the Assign Incident Owner Based On Privilege template, and clone it into a flow.
In the Update Incident Owner element, enter the ID of the queue or user to assign the incident to, and then save and activate the flow.
This flow runs only when an incident is created, and only when the Reported By field contains a person account.

If incidents from privileged employees don’t get an entitlement or an owner, check that you cloned the template into a flow and activated it, that you entered the entitlement, queue, or user ID, and that the employee has a privilege that’s tagged VIP.