Salesforce Docs Portal

Manage Incidents for IT Services

Create and manage incident records reported by employees or the incident records created from emails, voice, and chat conversations. Track, investigate, and resolve issues, and link incidents to related records, such as problems and change requests.

Required Editions

Available in: Lightning Experience
Available in: Enterprise, Performance, and Unlimited Editions with Agentforce IT Service.

Create Incident Records

Create an incident record to track disruptions that affect many employees.

  1. From the App Launcher, find and select Agentic IT Service Desk.
  2. In the Quick Find box, find, and select Incidents.
  3. Click New.
  4. Fill out the required fields:
    • Subject
    • Impact
    • Urgency
    • Priority
    • Status
  5. If you're creating an incident on behalf of someone else, in the Reported By field, select the person affected by the issue.
    When you create an incident on behalf of another user, Salesforce sets the Created By field to your username.
  6. Save your changes.
    During the incident lifecycle, fill out additional details as needed, such as:
    • Incident Owner
    • Assigned Group
    • Reported Method
    • Reported By
    • Resolution Summary
    To assign the incident to an individual user or to a queue, use the Incident Owner field. To assign the incident to a team, use the Assigned Group field, which accepts public groups only, not queues. This split keeps queue-based routing separate from team-based work assignment.
    Note
    Note In orgs created after the Winter ’26 release, the legacy Assigned User field is hidden by default and isn’t accessible through the API. Use Incident Owner instead, and update any integrations that rely on Assigned User. In orgs created earlier, the Assigned User field still works, but we recommend moving to Incident Owner and Assigned Group.
    If an incident is created from the employee portal, Salesforce sets the Reported Method field to Portal. Users can't change this value, including fulfillers who work on this incident later.

Create Problems from Incident Records

Create problem records directly from incident records to investigate recurring issues identified during triage. Creating a problem record helps identify root causes early in the process.

  1. Open an incident record.
  2. From the quick actions menu, select Create Problem.
    Note
    Note If you don’t see the action, open the Actions menu and select Create Problem.
  3. Fill out the required fields:
    • Subject
    • Impact
    • Urgency
    • Priority
  4. Save your changes.

If Create Problems with Einstein is enabled in your org, use the option to automatically generate problem records.

Create Change Requests from Incident Records

Create change requests directly from incident records when resolving the issue requires a change.

  1. Open an incident record.
  2. From the quick actions menu, select Create Change Request.
  3. Fill out the required fields:
    • Subject
    • Impact
    • Urgency
    • Priority
    • Risk Level
  4. Save your changes.

Create Incident Records from Emails

Turn incoming employee emails into detailed incident records automatically.

Admins must enable the Email-to-Incident feature. See Configure Email-to-Incident for IT Services.

If your admin has enabled incident creation from chat or voice, the Create Incident action appears in the respective channel. Use this action to open the incident form and follow these steps. When an employee sends an email to the designated support address, the system automatically converts the email into an incident record.

No manual steps are needed.

If your admin turned on HTML and rich text for incidents, the formatting from the email is kept on the incident. Tables, lists, and inline styling stay readable, and images that the employee embedded in the email appear in the conversation thread instead of as separate download links.

The new incident is routed by the active assignment rule for the Incident object. If no rule matches, the incident is assigned to the default incident owner that your admin set, so it’s never left unassigned. If the same email arrives more than once, only one incident is created, and later replies are added to that incident instead of creating another one.

Example
Example

The admin enables Email-to-Incident, sets up a routing address, and assigns a default “Impact = High” and “Urgency = Medium.”

Later, an employee sends an email with the Subject “VPN access not working” and the body “I can’t connect to the company VPN from this morning.”

From this email, the system automatically creates an incident record with these details:

Field Value
Subject VPN access is not working
Description I can’t connect to the company VPN from this morning.
Impact High
Urgency Medium

Because priority mapping is configured, the system calculates the priority as High.

The fulfiller reviews the incident record and proceeds with resolution.

Create Incident Records from Voice or Chat

Create incidents directly from messaging sessions or live conversations.

Your admin must have set up Messaging for In-App and Web Agents and Omni-Channel routing. If your admin has turned on AI for creating chat and voice records, the system automatically fills the incident fields.

  1. From a voice conversation or a messaging session’s record view, click Create Incident.
  2. If AI is enabled, review and, if needed, edit the fields:
    • Subject
    • Reported By
    • Impact
    • Urgency
    • Status
    If the chat originated from a guest session, enter a value for Reported By manually.
  3. If AI is not enabled, manually enter the values for these fields:
    • Subject
    • Reported By
    • Impact
    • Urgency
    • Status
  4. Enter or update information as required.
  5. Save your changes.

Create Service Requests from Incidents

Create a service request directly from an incident if the incident is actually a user request, such as for access or provisioning. Creating a service request routes the request through the correct fulfillment workflow and avoids incident-specific SLAs. The new service request retains key details from the incident, such as Reported By and Created By, while the original incident remains unchanged.

Your admin must have set up service requests from incidents and the Action Launcher deployment for incidents.

Permission Set Description
Industry Service Excellence Gives users access to objects and features for Industry Service Excellence.
Unified Catalog Agent Gives users access to use and manage catalog items and service processes.
  1. Open an incident record.
  2. From the Action Launcher, start the service process available as a service catalog item.
    For example, Create a Service Request.
  3. Enter values for the required fields, such as Reported By and Subject.
  4. Select Next.
  5. To view the new record, select the service request link on the confirmation page.
  6. Select Finish.

Associate Incidents with Other Records

Link incidents with other records, such as problems, change requests, and other incidents. By using these associations, incident management teams can understand the full context of an issue.

With these associations, incident management team members can establish relationships between incidents and other records. There are two types of associations:

  • Caused By indicates that another ticket was responsible for the incident.
  • Similar indicates that there appears to be a relationship between this incident and another ticket.
  1. Open the incident record and go to the Associations tab.
  2. From the Record Type dropdown, select the type of record you want to associate:
    • Incident
    • Problem
    • Change Request
    • Release
  3. Click Add.
  4. Select one or more records to associate.
  5. From Relationship Type, select Caused By or Similar.
  6. Save your changes.

Associate Affected and Impacted CIs with Incidents

Add configuration items to an incident so you can see which items are directly involved and which depend on them.

To associate configuration items with an incident, follow the steps in Associate Affected and Impacted CIs with IT Service Records.

Associate Cases with Incidents

Associate cases with an incident to give fulfillers more context about related support work.

Your admin must add the Cases related list to the incident page layout. For the steps to add a related list, see Customize Related Lists.

  1. Open an incident record, and then click the Related tab.
  2. In the Cases related list, click Add.
  3. Search for a case by name or number, select the case, and then click Save.

Associate Service Requests with Incidents

Associate service requests with an incident to give fulfillers more context about related requests.

Your admin must add the Service Requests related list to the incident page layout. For the steps to add a related list, see Customize Related Lists.

  1. Open an incident record, and then click the Related tab.
  2. In the Service Requests related list, click Add.
  3. Search for and select a service request.
  4. For Relationship Type, select a value, such as Linked to Service Request.
  5. Click Save.

Remove Associations

Update record relationships by removing outdated or incorrect associations.

Note
Note Removing an association doesn’t delete the associated record. For example, removing a problem from an incident doesn’t delete the problem record.
  1. Open the incident record and go to the Associations tab. To remove a case or a service request, go to the Related tab instead.
  2. Select the records that you want to remove.
  3. Click Remove.
  4. Click Yes.

Resolve Associated Records

Resolve incidents and their associated records together to make sure that all related work is completed together.

  1. Open the incident record and go to the Associations tab.
  2. Select the record type of the records you want to resolve.
  3. Select records from the list.
  4. Click Resolve.
  5. In the window, enter the required resolution details.
  6. Save your changes.
    When an incident transitions to a resolved state, Salesforce automatically populates the Resolved By field. If the incident is reopened, Salesforce clears the Resolved By field.

Close Incident Records

Update the incident status to Resolved or Closed to reflect the current state of the issue and complete the incident lifecycle.

  1. From the App Launcher, find and select Agentic IT Service Desk.
  2. In the Quick Find box, find, and select Incidents.
  3. Open the incident record that you want to close.
  4. In the Status field, select:
    Resolved to mark the issue as fixed.
    Closed to complete the incident lifecycle.
  5. In the Resolution Summary field, enter the resolution details.
  6. Save your changes.
    • When you select Resolved, Salesforce sets Resolution Date Time, End Date Time, and Resolved By.
    • When you select Closed, Salesforce sets End Date Time and Resolved By.

Manage Email Conversations from an Incident

After you configure Email-to-Incident, incoming emails and related replies are associated with the corresponding incident. You can review the email conversation directly from the incident record.

When you send an email from the incident, the email is added to the incident feed and remains associated with the incident. Subsequent replies are automatically linked to the same incident conversation.

  1. Open an incident.
  2. Click Feed.
  3. Review the email conversation associated with the incident.
    Formatting from the incoming email, such as tables and lists, is preserved, and embedded images appear in the conversation thread.
  4. Click Email.
  5. Enter the recipients and message details.
    If your admin set a default email template for the routing address, the reply opens with that template applied. Merge fields in the template resolve the incident details, such as the incident number and subject, so you don’t enter them manually.
  6. To add a standard response, such as troubleshooting steps that you send often, insert quick text.
  7. Review the email before you send it.
    Your signature is added automatically. Your admin controls whether it appears directly after your reply or at the bottom of the entire email thread.
    If your admin turned on Save unfinished replies as drafts, your reply is saved every 30 seconds while you work. If you navigate away or your session ends, open the incident again to resume the draft.
  8. Send the email, or schedule it to send at a later date and time.
    Schedule a reply when you don’t want it to reach the employee outside of their working hours. You can cancel a scheduled email before it’s sent.

Add Ticket Comments to an Incident

Post ticket comments to record the updates that people deliberately share on an incident, such as a diagnosis, a decision, or a status note. Comments stay in a dedicated thread, separate from system-generated feed activity.

Ticket comments and the Chatter feed serve different purposes and run alongside each other. The feed records system activity, such as field changes. Ticket comments record what fulfillers and employees deliberately post. Posting a comment doesn't create a Chatter post, and comments aren't synced to the feed.

Note
Note The same steps apply to service requests.
  1. Open an incident record.
  2. Click Comments.
  3. Enter your update in the comment editor.
    Use the toolbar to format the text, add hyperlinks, and insert code snippets for commands, logs, and scripts.
    A comment can contain up to 68,630 characters. A counter shows how many characters you have left.
  4. Select the visibility for the comment.
    Public to share the update with the employee who reported the incident. Public comments show a public badge.
    Private to keep the update visible only to the fulfillers who have access to the incident. Private comments show a lock badge.
    Your admin sets the default visibility for each object. Change the visibility before you post the comment.
  5. To give the team more context, attach one or more files to the comment.
    Attached files also appear in the Files list on the incident.
  6. Post the comment.
    Comments show a relative timestamp, such as 2 hours ago, for the first 6 hours. After that, they show the date and time.
    Public comments notify the employee who reported the incident along with the fulfillers on the incident. Private comments notify only the fulfillers. To set up these notifications, see Configure Related Object Notifications for IT Services.
  7. To find a comment in a long thread, filter, search, or sort the comments.
    • To show all comments, only public comments, or only private comments, select the All, Public, or Private tab.
    • To match text in the comment body or the author's name, enter a keyword in the search box.
    • To change the order of the thread, sort the comments by newest or oldest first.

Edit or Delete Your Ticket Comments

Correct a comment that you posted, or remove a comment that you posted in error.

  1. Open the incident record and click Comments.
  2. Find a comment that you posted.
  3. From the actions menu on the comment, select Edit or Delete.
  4. If you're editing the comment, update the text, and then save your changes.
    Edited comments show an Edited label so that readers know the text changed after it was posted.