Copilot Prompt Patterns for IT Support Incident Triage

IT support teams often spend too much time manually categorizing and prioritizing incoming incidents. Copilot in Microsoft 365 can help automate parts of this triage process by using structured prompt patterns. These patterns guide Copilot to extract key details from incident descriptions, classify urgency, and suggest initial response steps. This article explains how to design and use prompt patterns for incident triage in Copilot, including specific examples you can copy and adapt.

How Prompt Patterns Work for Incident Triage

A prompt pattern is a reusable template for phrasing requests to Copilot. When used for IT support triage, the pattern forces Copilot to follow a consistent logic: read the incident, extract facts, apply business rules, and produce a structured output. The goal is to reduce variance in how Copilot handles similar tickets and to make its output directly usable for routing or escalation.

Copilot does not have a built-in triage module. Instead, it relies on the prompt you write and the data it can access through Microsoft Graph. This includes incident tickets stored in SharePoint lists, Microsoft Teams messages, or Outlook email. Before using these patterns, confirm that Copilot has permission to read the relevant data sources. You need a Copilot for Microsoft 365 license or a Copilot Pro subscription with Microsoft 365 apps.

Three prompt patterns work well for triage: Role + Task + Format, Context + Constraint + Action, and Example + Output. Each pattern addresses a different triage need. You can combine them for complex scenarios.

Pattern 1: Role + Task + Format for Incident Summaries

This pattern is the foundation. It tells Copilot who it is, what to do, and how to present the result. Use it when you need a quick, consistent summary of a single incident.

1. Open Copilot in Microsoft 365
   Launch Copilot from the Microsoft 365 app bar or the Copilot pane in Teams. Ensure you are signed in with your work account.
2. Write the role statement
   Start with: “You are an IT support triage agent.” This sets the context for the response style and knowledge domain.
3. Add the task
   Follow with: “Read the following incident description and summarize it in three bullet points: affected system, user impact, and probable cause.”
4. Specify the format
   End with: “Use plain text bullet points. Do not add extra commentary.” Then paste or type the incident text after the prompt.

Example full prompt: “You are an IT support triage agent. Read the following incident description and summarize it in three bullet points: affected system, user impact, and probable cause. Use plain text bullet points. Do not add extra commentary. Incident: User reports that Outlook crashes every time they try to open calendar invites from a specific external domain.”

Copilot will output something like:

• Affected system: Microsoft Outlook desktop client
• User impact: Cannot open calendar invites from external domain, workflow interrupted
• Probable cause: Add-in conflict or corrupted calendar item from untrusted sender

Pattern 2: Context + Constraint + Action for Escalation Decisions

Use this pattern when you need Copilot to recommend an action based on business rules, such as severity level or affected user count. The constraint part is critical — it prevents Copilot from guessing outside your defined boundaries.

1. Open Copilot in the same location
   Use the Copilot pane in Teams or the Microsoft 365 Copilot sidebar. Keep the same session if possible to retain context.
2. Provide the incident context
   Write: “Incident: All users in the finance department cannot access the ERP system. The error message says ‘Connection refused.’ The incident was reported 30 minutes ago.”
3. Define the constraints
   Add: “Use these severity levels: Sev 1 = more than 10 users affected, Sev 2 = 3 to 10 users, Sev 3 = 1 to 2 users. Only escalate to Level 2 if severity is Sev 1 or Sev 2.”
4. Ask for the action
   End with: “Based on the incident and constraints, what is the severity level and the recommended escalation action? Output as two short sentences.”

Copilot will respond with something like: “Severity level is Sev 1 because more than 10 users are affected. Escalate to Level 2 support immediately.”

Pattern 3: Example + Output for Consistent Categorization

When you need Copilot to categorize incidents into predefined buckets, the Example + Output pattern works best. It shows Copilot one correctly labeled example, then asks it to apply the same logic to a new incident.

1. Open Copilot
   Use Copilot in any Microsoft 365 app that supports the chat interface.
2. Provide the example
   Write: “Here is an example of a categorized incident: Incident: VPN disconnects every 15 minutes. Category: Network. Subcategory: VPN connectivity. Priority: Medium.”
3. Give the new incident
   Follow with: “Now categorize this incident using the same format: Incident: Printer in room 204 is offline. Users cannot print to it from any device.”
4. Specify the output format
   End with: “Output the category, subcategory, and priority on separate lines. Do not add any other text.”

Copilot will output: “Category: Hardware. Subcategory: Printer. Priority: Low.” If the output is wrong, adjust the example or add more constraints like the exact category names you want.

Common Mistakes and Limitations When Using Prompt Patterns for Triage

Copilot ignores the role or constraints I set

This usually happens when the prompt is too long or contains conflicting instructions. Keep each prompt under 500 characters. Place the role statement first, the task second, and the format last. If Copilot still ignores the constraints, break the task into two separate prompts.

Copilot cannot access the incident ticket data

Copilot can only read data that is indexed by Microsoft Graph and that you have permission to view. Store incident tickets in a SharePoint list with at least Contributor-level access for your account. If you paste incident text directly into the prompt, Copilot does not need data access for that specific text, but it cannot pull related information like past incidents from the same user.

Output is inconsistent across identical prompts

Copilot is not deterministic — the same prompt can produce slightly different results. To reduce variance, use the Example + Output pattern and specify the exact output fields. For critical triage decisions, always have a human review the output before acting on it.

Copilot suggests actions that violate your IT policies

Copilot does not know your internal policies unless you state them in the prompt. Always include explicit constraints like “Do not recommend restarting the server without manager approval” or “Only escalate if the affected user count is above five.” Test each prompt with a few sample incidents before using it in live triage.

Pattern 1 vs Pattern 2 vs Pattern 3: When to Use Each

Item	Pattern 1: Role + Task + Format	Pattern 2: Context + Constraint + Action	Pattern 3: Example + Output
Best for	Single incident summary	Escalation or routing decision	Consistent categorization into fixed buckets
Key strength	Fast, structured output	Applies business rules	Reduces output variance
Key limitation	No action recommendation	Needs precise constraint wording	Requires a good example each time
Output format	Bullet points or short list	Two short sentences	Category, subcategory, priority lines

You now have three reusable prompt patterns for incident triage with Copilot. Start with Pattern 1 for quick summaries, then move to Pattern 2 when you need escalation logic. Use Pattern 3 only when categorization consistency is critical, such as for weekly reporting. For advanced triage, chain the patterns: use Pattern 1 to summarize, then feed that summary into Pattern 2 for an escalation decision. Always test each pattern with at least five sample incidents before using it in production.