---
schema_version: "1"
id: 9492bd0819f8d279c83e71e3e9db10d1214493c75a32efd3d6a918b0acd8ce36
title: Manage Incidents for IT Services
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/service/264-0-0/it_srvcs_inc_manage_inc.md
canonical_url: https://help.salesforce.com/s/articleView?id=service.it_srvcs_inc_manage_inc.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 6472e12e6d545cfb975af4ab07bf59470a5115a0601bff0b0cd132962a666080
description: Create and manage incident records reported by employees or the incident records created from emails, voice, and chat conversations. Track, investigate, and resolve issues, and link incidents to related records, such as problems and change requests.
products:
  - Service Cloud
  - Agentforce IT Service
release: "264"
---
# Manage Incidents for IT Services

Create and manage incident records reported by employees or the incident records created from emails, voice, and chat conversations. Track, investigate, and resolve issues, and link incidents to related records, such as problems and change requests.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Enterprise</strong>, <strong>Performance</strong>, and <strong>Unlimited</strong> Editions with Agentforce IT Service.</td></tr></tbody></table>

## Create Incident Records

Create an incident record to track disruptions that affect many employees.

1. From the **App Launcher**, find and select **Agentic IT Service Desk**.
2. In the Quick Find box, find, and select **Incidents**.
3. Click **New**.
4. Fill out the required fields:
    - Subject
    - Impact
    - Urgency
    - Priority
    - Status
5. If you're creating an incident on behalf of someone else, in the Reported By field, select the person affected by the issue.
    
    When you create an incident on behalf of another user, Salesforce sets the Created By field to your username.
6. Save your changes.
    
    During the incident lifecycle, fill out additional details as needed, such as:
    
    - Incident Owner
    - Assigned Group
    - Reported Method
    - Reported By
    - Resolution Summary
    
    To assign the incident to an individual user or to a queue, use the Incident Owner field. To assign the incident to a team, use the Assigned Group field, which accepts public groups only, not queues. This split keeps queue-based routing separate from team-based work assignment.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-it_service-264-0-0-production-enus/0a574a10-4c7a-4681-aacf-0767f8beaad4/images/icon_note.png)
    
    Note In orgs created after the Winter ’26 release, the legacy Assigned User field is hidden by default and isn’t accessible through the API. Use Incident Owner instead, and update any integrations that rely on Assigned User. In orgs created earlier, the Assigned User field still works, but we recommend moving to Incident Owner and Assigned Group.
    
    If an incident is created from the employee portal, Salesforce sets the Reported Method field to Portal. Users can't change this value, including fulfillers who work on this incident later.

## Create Problems from Incident Records

Create problem records directly from incident records to investigate recurring issues identified during triage. Creating a problem record helps identify root causes early in the process.

1. Open an incident record.
2. From the quick actions menu, select **Create Problem**.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-it_service-264-0-0-production-enus/0a574a10-4c7a-4681-aacf-0767f8beaad4/images/icon_note.png)
    
    Note If you don’t see the action, open the **Actions** menu and select **Create Problem**.
3. Fill out the required fields:
    - Subject
    - Impact
    - Urgency
    - Priority
4. Save your changes.

If **Create Problems with Einstein** is enabled in your org, use the option to automatically generate problem records.

## Create Change Requests from Incident Records

Create change requests directly from incident records when resolving the issue requires a change.

1. Open an incident record.
2. From the quick actions menu, select **Create Change Request**.
3. Fill out the required fields:
    - Subject
    - Impact
    - Urgency
    - Priority
    - Risk Level
4. Save your changes.

## Create Incident Records from Emails

Turn incoming employee emails into detailed incident records automatically.

Admins must enable the Email-to-Incident feature. See [Configure Email-to-Incident for IT Services](https://help.salesforce.com/s/articleView?id=service.it_srvcs_inc_configure_email_to_incident.htm&release=264.0.0&type=5 "Automatically convert incoming emails into new incident records, manage threaded email conversations, and send email responses directly from the incident record. Configure how incoming email content is rendered, which senders are accepted, and how processing errors are handled.").

If your admin has enabled incident creation from chat or voice, the **Create Incident** action appears in the respective channel. Use this action to open the incident form and follow these steps. When an employee sends an email to the designated support address, the system automatically converts the email into an incident record.

No manual steps are needed.

If your admin turned on HTML and rich text for incidents, the formatting from the email is kept on the incident. Tables, lists, and inline styling stay readable, and images that the employee embedded in the email appear in the conversation thread instead of as separate download links.

The new incident is routed by the active assignment rule for the Incident object. If no rule matches, the incident is assigned to the default incident owner that your admin set, so it’s never left unassigned. If the same email arrives more than once, only one incident is created, and later replies are added to that incident instead of creating another one.

![Example](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-it_service-264-0-0-production-enus/0a574a10-4c7a-4681-aacf-0767f8beaad4/images/icon_example.png)

Example

The admin enables Email-to-Incident, sets up a routing address, and assigns a default “Impact = High” and “Urgency = Medium.”

Later, an employee sends an email with the Subject “VPN access not working” and the body “I can’t connect to the company VPN from this morning.”

From this email, the system automatically creates an incident record with these details:

 
| Field | Value |
| --- | --- |
| Subject | VPN access is not working |
| Description | I can’t connect to the company VPN from this morning. |
| Impact | High |
| Urgency | Medium |

Because priority mapping is configured, the system calculates the priority as High.

The fulfiller reviews the incident record and proceeds with resolution.

## Create Incident Records from Voice or Chat

Create incidents directly from messaging sessions or live conversations.

Your admin must have set up Messaging for In-App and Web Agents and Omni-Channel routing. If your admin has turned on AI for creating chat and voice records, the system automatically fills the incident fields.

1. From a voice conversation or a messaging session’s record view, click **Create Incident**.
2. If AI is enabled, review and, if needed, edit the fields:
    
    - Subject
    - Reported By
    - Impact
    - Urgency
    - Status
    
    If the chat originated from a guest session, enter a value for Reported By manually.
3. If AI is not enabled, manually enter the values for these fields:
    - Subject
    - Reported By
    - Impact
    - Urgency
    - Status
4. Enter or update information as required.
5. Save your changes.

## Create Service Requests from Incidents

Create a service request directly from an incident if the incident is actually a user request, such as for access or provisioning. Creating a service request routes the request through the correct fulfillment workflow and avoids incident-specific SLAs. The new service request retains key details from the incident, such as Reported By and Created By, while the original incident remains unchanged.

Your admin must have set up service requests from incidents and the Action Launcher deployment for incidents.

 
| Permission Set | Description |
| --- | --- |
| Industry Service Excellence | Gives users access to objects and features for Industry Service Excellence. |
| Unified Catalog Agent | Gives users access to use and manage catalog items and service processes. |

1. Open an incident record.
2. From the Action Launcher, start the service process available as a service catalog item.
    
    For example, Create a Service Request.
3. Enter values for the required fields, such as **Reported By** and **Subject**.
4. Select **Next**.
5. To view the new record, select the service request link on the confirmation page.
6. Select **Finish**.

## Associate Incidents with Other Records

Link incidents with other records, such as problems, change requests, and other incidents. By using these associations, incident management teams can understand the full context of an issue.

With these associations, incident management team members can establish relationships between incidents and other records. There are two types of associations:

- **Caused By** indicates that another ticket was responsible for the incident.
- **Similar** indicates that there appears to be a relationship between this incident and another ticket.

1. Open the incident record and go to the **Associations** tab.
2. From the Record Type dropdown, select the type of record you want to associate:
    - Incident
    - Problem
    - Change Request
    - Release
3. Click **Add**.
4. Select one or more records to associate.
5. From Relationship Type, select **Caused By** or **Similar**.
6. Save your changes.

## Associate Affected and Impacted CIs with Incidents

Add configuration items to an incident so you can see which items are directly involved and which depend on them.

To associate configuration items with an incident, follow the steps in [Associate Affected and Impacted CIs with IT Service Records](https://help.salesforce.com/s/articleView?id=service.it_srvcs_cmdb_affctd_impctd_ci.htm&release=264.0.0&type=5 "Track how configuration items (CIs) relate to IT service records like incidents, problems, and change requests. Use affected and impacted CI references to improve context, speed up resolution, and reduce service disruption.").

## Associate Cases with Incidents

Associate cases with an incident to give fulfillers more context about related support work.

Your admin must add the **Cases** related list to the incident page layout. For the steps to add a related list, see [Customize Related Lists](https://help.salesforce.com/s/articleView?id=platform.customizing_related_lists.htm&type=5&language=en_US).

1. Open an incident record, and then click the **Related** tab.
2. In the **Cases** related list, click **Add**.
3. Search for a case by name or number, select the case, and then click **Save**.

## Associate Service Requests with Incidents

Associate service requests with an incident to give fulfillers more context about related requests.

Your admin must add the **Service Requests** related list to the incident page layout. For the steps to add a related list, see [Customize Related Lists](https://help.salesforce.com/s/articleView?id=platform.customizing_related_lists.htm&type=5&language=en_US).

1. Open an incident record, and then click the **Related** tab.
2. In the **Service Requests** related list, click **Add**.
3. Search for and select a service request.
4. For **Relationship Type**, select a value, such as **Linked to Service Request**.
5. Click **Save**.

## Remove Associations

Update record relationships by removing outdated or incorrect associations.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-it_service-264-0-0-production-enus/0a574a10-4c7a-4681-aacf-0767f8beaad4/images/icon_note.png)

Note Removing an association doesn’t delete the associated record. For example, removing a problem from an incident doesn’t delete the problem record.

1. Open the incident record and go to the **Associations** tab. To remove a case or a service request, go to the **Related** tab instead.
2. Select the records that you want to remove.
3. Click **Remove**.
4. Click **Yes**.

## Resolve Associated Records

Resolve incidents and their associated records together to make sure that all related work is completed together.

1. Open the incident record and go to the **Associations** tab.
2. Select the record type of the records you want to resolve.
3. Select records from the list.
4. Click **Resolve**.
5. In the window, enter the required resolution details.
6. Save your changes.
    
    When an incident transitions to a resolved state, Salesforce automatically populates the Resolved By field. If the incident is reopened, Salesforce clears the Resolved By field.

## Close Incident Records

Update the incident status to Resolved or Closed to reflect the current state of the issue and complete the incident lifecycle.

1. From the **App Launcher**, find and select **Agentic IT Service Desk**.
2. In the Quick Find box, find, and select **Incidents**.
3. Open the incident record that you want to close.
4. In the Status field, select:
    
    |  |  |
    | --- | --- |
    | Resolved | to mark the issue as fixed. |
    | Closed | to complete the incident lifecycle. |
5. In the Resolution Summary field, enter the resolution details.
6. Save your changes.
    
    - When you select Resolved, Salesforce sets Resolution Date Time, End Date Time, and Resolved By.
    - When you select Closed, Salesforce sets End Date Time and Resolved By.

## Manage Email Conversations from an Incident

After you configure Email-to-Incident, incoming emails and related replies are associated with the corresponding incident. You can review the email conversation directly from the incident record.

When you send an email from the incident, the email is added to the incident feed and remains associated with the incident. Subsequent replies are automatically linked to the same incident conversation.

1. Open an incident.
2. Click **Feed**.
3. Review the email conversation associated with the incident.
    
    Formatting from the incoming email, such as tables and lists, is preserved, and embedded images appear in the conversation thread.
4. Click **Email**.
5. Enter the recipients and message details.
    
    If your admin set a default email template for the routing address, the reply opens with that template applied. Merge fields in the template resolve the incident details, such as the incident number and subject, so you don’t enter them manually.
6. To add a standard response, such as troubleshooting steps that you send often, insert quick text.
7. Review the email before you send it.
    
    Your signature is added automatically. Your admin controls whether it appears directly after your reply or at the bottom of the entire email thread.
    
    If your admin turned on **Save unfinished replies as drafts**, your reply is saved every 30 seconds while you work. If you navigate away or your session ends, open the incident again to resume the draft.
8. Send the email, or schedule it to send at a later date and time.
    
    Schedule a reply when you don’t want it to reach the employee outside of their working hours. You can cancel a scheduled email before it’s sent.

## Add Ticket Comments to an Incident

Post ticket comments to record the updates that people deliberately share on an incident, such as a diagnosis, a decision, or a status note. Comments stay in a dedicated thread, separate from system-generated feed activity.

Ticket comments and the Chatter feed serve different purposes and run alongside each other. The feed records system activity, such as field changes. Ticket comments record what fulfillers and employees deliberately post. Posting a comment doesn't create a Chatter post, and comments aren't synced to the feed.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-it_service-264-0-0-production-enus/0a574a10-4c7a-4681-aacf-0767f8beaad4/images/icon_note.png)

Note The same steps apply to service requests.

1. Open an incident record.
2. Click **Comments**.
3. Enter your update in the comment editor.
    
    Use the toolbar to format the text, add hyperlinks, and insert code snippets for commands, logs, and scripts.
    
    A comment can contain up to 68,630 characters. A counter shows how many characters you have left.
4. Select the visibility for the comment.
    
    |  |  |
    | --- | --- |
    | Public | to share the update with the employee who reported the incident. Public comments show a public badge. |
    | Private | to keep the update visible only to the fulfillers who have access to the incident. Private comments show a lock badge. |
    
    Your admin sets the default visibility for each object. Change the visibility before you post the comment.
5. To give the team more context, attach one or more files to the comment.
    
    Attached files also appear in the Files list on the incident.
6. Post the comment.
    
    Comments show a relative timestamp, such as 2 hours ago, for the first 6 hours. After that, they show the date and time.
    
    Public comments notify the employee who reported the incident along with the fulfillers on the incident. Private comments notify only the fulfillers. To set up these notifications, see [Configure Related Object Notifications for IT Services](https://help.salesforce.com/s/articleView?id=service.it_srvcs_notif_config_related_obj_notif.htm&release=264.0.0&type=5 "Send notifications when related (child) records are added, removed, or when parent records are updated. Use related object notifications to track child entities associated with your reference object.").
7. To find a comment in a long thread, filter, search, or sort the comments.
    - To show all comments, only public comments, or only private comments, select the **All**, **Public**, or **Private** tab.
    - To match text in the comment body or the author's name, enter a keyword in the search box.
    - To change the order of the thread, sort the comments by newest or oldest first.

## Edit or Delete Your Ticket Comments

Correct a comment that you posted, or remove a comment that you posted in error.

1. Open the incident record and click **Comments**.
2. Find a comment that you posted.
3. From the actions menu on the comment, select **Edit** or **Delete**.
4. If you're editing the comment, update the text, and then save your changes.
    
    Edited comments show an Edited label so that readers know the text changed after it was posted.