--- schema_version: "1" id: 3fd46d6ebd181e5d77aa597a21d86b31e88a4e60e99b87ae2beb5ce0767780b7 title: Phase 3 — Provision Your IT Team collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/service/264-0-0/it_srvcs_day_1_provision_it_team.md canonical_url: https://help.salesforce.com/s/articleView?id=service.it_srvcs_day_1_provision_it_team.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: fbddda4aa640316ba01d9101964f9b8952cf5acf85b3b93fe8d8d94e38b1895a description: "Outcome: Each pilot participant has an existing or newly created Salesforce user, the required licenses and permissions, and membership in the queues or groups required for the pilot." products: - Service Cloud - Agentforce IT Service release: "264" --- # Phase 3 — Provision Your IT Team **Outcome:** Each pilot participant has an existing or newly created Salesforce user, the required licenses and permissions, and membership in the queues or groups required for the pilot. ### Required Editions | Actions | Permissions | | --- | --- | | Create users | _Manage Internal Users_ | | Create public groups | _Manage Users_ | | Create queues | _Customize Application_ AND _Manage Public List Views_ | **Owner:** System Admin 1. Create users by persona. Identify an existing Salesforce user for each pilot participant, or create a user when one doesn’t already exist. One person can perform more than one IT Service role. Use the following table to identify an appropriate baseline profile; grant IT Service access through the required permission sets and permission set groups. | Persona | Purpose | Profile | | --- | --- | --- | | System Admin | Configure and deploy core features | System Administrator | | Incident Fulfiller | Resolves day-to-day incidents | Standard User | | Incident Manager | Oversees incident resolution, SLAs, KPIs | Standard User | | Major Incident Manager | Manages Major Incident lifecycle, approves critical events | Standard User | | Problem Fulfiller | Investigates root cause | Standard User | | Problem Manager | Owns Problem process, prioritizes recurring issues | Standard User | | Change Fulfiller | Plans, executes, verifies changes; supports PIR | Standard User | | Change Manager | Approves change requests, assesses risk | Standard User | | Release Manager | Coordinates and executes releases | Standard User | ![Tip](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-it_service-264-0-0-production-enus/0a574a10-4c7a-4681-aacf-0767f8beaad4/images/icon_tip.png) Tip For the initial incident journey, identify at least one Salesforce admin, one incident fulfiller, and one person responsible for incident management. Add users for other roles as those processes enter scope. 2. Assign Permission Set Groups. Permission Sets and Permission Set Groups (PSGs) are how access is actually granted in Agentforce IT Service — not profile alone. 1. Open **Manage User Access** (from the post-install screen of Phase 2, or via Setup). 2. Assign each user the Permission Set Group that matches their role (for example _Change Request Fulfiller_, _Change Request Manager_). For detailed permission set assignments per feature, follow the per-feature topics: - Incident Management permission sets - Problem Management permission sets - Change Request Management permission sets - Release Management permission sets - Self-Service Portal permission sets - CMDB and Service Graph permission sets ![Tip](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-it_service-264-0-0-production-enus/0a574a10-4c7a-4681-aacf-0767f8beaad4/images/icon_tip.png) Tip **Why PSGs and not just profiles?** PSGs let you bundle permissions by _job function_. Updates to underlying permission sets propagate to all PSGs that include them, so you change permissions in one place. This is the recommended approach for IT Service. For more information, see [Incident Management Permissions for IT Services](https://help.salesforce.com/s/articleView?id=service.it_srvcs_inc_assign_permission_sets.htm&release=264.0.0&type=5 "Assign permission sets or permission set groups to manage incidents, propose major incidents, and handle associations with change requests, problems, and releases."). 3. Create Public Groups and Queues. Create the queues and public groups required by your pilot process. The following names and memberships are examples; use names that follow your organization’s conventions. | Group / Queue | Members | Purpose | | --- | --- | --- | | **IT Fulfillers Queue** | All Incident Fulfillers | Example destination for incidents assigned by an assignment rule and distributed through Omnichannel Routing when configured | | **Major Incident Approval Group** | Major Incident Manager(s) | Public group for notifications and approval requests when an incident is proposed as a major incident | | **Release Group** _(if rolling out Release Mgmt on Day 1)_ | Release Manager(s) | Coordinates approved change deployments and release planning | 1. Add the relevant users to each. **Validation** - Each named IT team user logs in successfully. - Each user can see the tabs and records their role requires (e.g., Incident Fulfiller sees Incidents). - At least one queue exists with at least one fulfiller as a member. ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-it_service-264-0-0-production-enus/0a574a10-4c7a-4681-aacf-0767f8beaad4/images/icon_important.png) Important **Common pitfalls** - **Profile-only setup.** Granting only a profile without the PSG produces hard-to-debug "I can't see this object" tickets. Always assign the PSG. - **Empty queues:** An assignment rule can assign an incident to a queue that has no eligible fulfillers. Confirm queue membership and, when used, Omnichannel availability before testing work distribution. - **No backup fulfiller:** For production readiness, add enough eligible fulfillers to provide coverage when a team member is unavailable.