This post walks through how to think about ticket workflows on Microsoft 365 and SharePoint from a developer's point of view: data modelling, intake, routing, SLAs, permissions and reporting. It closes with a production example from a cross-border payments company that shows what a mature version looks like.

Start with the data model

Everything in a SharePoint ticketing system rests on the list schema. Get it right early, because changing column types later on a list with thousands of items is painful.

A reasonable starting point for a Tickets list:

Keep agent-only notes in a separate TicketNotes list linked by ticket ID, rather than in a column on the ticket. That makes it far easier to guarantee they never appear in customer-facing views or emails.

Index early

SharePoint's list view threshold will bite once you pass a few thousand items. Add indexes on the columns you filter by most, typically Status, AssignedTo, Department and Created, before the list grows.

Intake: forms and email

Most teams need two front doors.

Internal requests

An SPFx web part gives you a proper form with validation and conditional fields. Writing to the list from SPFx with PnPjs looks like this:

import { spfi, SPFx } from "@pnp/sp";
import "@pnp/sp/webs";
import "@pnp/sp/lists";
import "@pnp/sp/items";

const sp = spfi().using(SPFx(this.context));

await sp.web.lists.getByTitle("Tickets").items.add({
  Title: summary,
  Description: details,
  Priority: "Medium",
  Category: category,
  Status: "New"
});

Because SPFx runs as the signed-in user, there is no extra auth to manage, and SharePoint permissions apply automatically.

Email

Many requesters, especially external customers, will only ever send email. A Power Automate flow using the Office 365 Outlook trigger "When a new email arrives in a shared mailbox" can create a ticket item, store attachments and reply with a reference number. Thread replies back to the same ticket by putting the ticket ID in the subject line and parsing it on inbound mail.

Routing: keep rules out of your flows

The most common mistake is writing routing logic directly into flow conditions. It works for three rules. By thirty, nobody wants to touch it.

A cleaner pattern is a RoutingRules list that your flow reads at runtime:

{
  "Category": "Refund",
  "Priority": "High",
  "Department": "Payments Ops",
  "AssignToGroup": "Refund Agents",
  "SlaHours": 4
}

The flow fetches the matching rule for the new ticket's category and priority, then sets Department, assignment and DueBy. Changing behavior becomes a list edit, not a deployment. Turn on versioning for the rules list so you have a history of every change, which auditors appreciate.

SLAs and escalation

Calculate DueBy at creation from the matched rule. A scheduled flow then runs every 15 minutes or so, queries open tickets where DueBy is in the past, and escalates them: bump priority, notify the team lead, post to a Teams channel.

A simple OData filter for the query:

Status ne 'Resolved' and Status ne 'Closed' and DueBy lt '@{utcNow()}'

Track FirstResponseAt separately from resolution time. Most SLA commitments care about both.

Permissions

Map roles to SharePoint groups backed by Microsoft Entra ID:

• Agents can read and edit tickets in their department.
• Team leads can reassign and close across their area.
• Admins manage configuration lists and settings.

Avoid breaking inheritance on every item. It is tempting for per-department privacy, but thousands of unique permission scopes hurt performance. If a category needs strict segregation, consider a separate list.

Reporting

For day-to-day work, a dashboard web part showing open tickets by status, priority and agent is enough. For deeper analysis, export to Excel or connect Power BI to the list. Keep export rights limited if the data is sensitive.

A production example: payments support on SharePoint

Building all of this yourself is a real project. The alternative is to use a packaged app that implements the same patterns. The CV Helpdesk product overview describes one such option: it is built on SPFx, uses Power Automate for workflows, runs inside your Microsoft 365 tenant, and includes department-wise assignment, priority levels, internal notes, role-based access, dashboards and Excel export.

A good reference deployment comes from a tuition payments company in the Greater Toronto Area that supports students, parents and partner institutions. Before the change it ran two help desks, Help Scout and a self-hosted open-source tool. Routing rules lived in custom code that the internal IT team did not know well, so every change needed outside developers. Per-agent licensing raised costs during seasonal peaks, and ticket data sat outside the Microsoft 365 compliance boundary.

The replacement follows the same architecture described above: SharePoint lists for ticket data, Power Automate for notifications and escalation, SharePoint permissions for role-based access across agents, team leads and administrators. Tickets are created from the existing shared inbox, routing is department-based by payment type, and SLA tracking drives priority-based triage.

The detail developers will appreciate is that more than 40 business rules were configured without custom code. According to how a tuition payments platform rolled out its Microsoft 365 help desk, it went straight into production with no pilot, has processed more than 5,000 tickets, keeps all support data in-tenant and held 95% SLA compliance through tuition deadlines and refund cycles. Three more business units have since adopted it.

Build or buy?

Build when your requirements are unusual and you have people to maintain the solution. Buy when the requirements look like the list in this post, because the hard parts (rule configuration, SLA handling, permissions and reporting) are already built for you. Either way, the architecture is the same, and knowing it makes you a better evaluator of helpdesk solutions.

Conclusion

Ticket workflows on Microsoft 365 come down to a handful of decisions: a solid list schema with indexes, separate storage for internal notes, rules stored as data, scheduled SLA checks and permissions mapped to Entra groups. Get those right and SharePoint holds up well as a ticketing backend, even for demanding teams such as a Helpdesk for Payments Company operations.

FAQs

Is SharePoint a good backend for a help desk?

For organizations already on Microsoft 365, yes, as long as you plan for list thresholds with indexing and archiving. The payments example above runs in production with more than 5,000 tickets.

Should routing logic live in Power Automate?

The execution should, but the rules themselves are better stored in a configuration list. That keeps flows generic and lets non-developers change behavior.

How do I handle external requesters without Microsoft 365 accounts?

Use a shared mailbox and a Power Automate flow to create tickets from email. Requesters keep using email while agents work in SharePoint.

Can I enforce SLAs without custom code?

Yes. Calculate a due date at creation from your rules and use a scheduled flow to escalate overdue tickets.

This post walks through how those pieces fit together for ticket workflows, from intake to escalation. The examples are generic and meant to illustrate the patterns. Toward the end there is a real production example from a payments company that used this approach at scale.

The data model

Start with lists. A minimal helpdesk needs a Tickets list and a handful of supporting lists for configuration. Keeping configuration in lists, rather than in code, is the decision that pays off most later.

Tickets

A practical Tickets list includes a unique ticket ID, title, description, requester, department or category, priority, status, assigned agent, created and due dates, and attachments. Priority usually follows a fixed set such as Low, Medium, High and Critical so that triage is consistent.

Tickets
  TicketId      (text, unique)
  Title         (text)
  Category      (lookup -> Categories)
  Priority      (choice: Low | Medium | High | Critical)
  Status        (choice: New | Assigned | In Progress | Resolved | Closed)
  AssignedTo    (person)
  Requester     (person or email)
  DueBy         (date/time)

Comments and internal notes

Store the conversation in a separate list linked to the ticket, with a flag that marks a note as internal. Agents see everything; requesters see only public comments. This keeps collaboration on the record without exposing internal discussion.

Configuration lists

Categories, routing rules, SLA targets and email templates each get their own list. Your SPFx web part and your flows read from these lists at runtime. When the business changes a rule, an administrator edits a list item instead of a developer shipping a release.

Intake: portal and shared inbox

There are two common intake paths. Employees can submit through an SPFx form on a SharePoint page, which gives you validation and mandatory fields. External customers usually prefer email, so a flow watches a shared support inbox and creates a ticket for each new message.

When you build the email path, handle replies carefully. Include the ticket ID in outgoing subject lines and match on it when new mail arrives, so a reply is appended as a comment rather than opening a duplicate ticket.

Routing

Routing is where rules-as-configuration matters most. A simple pattern is a RoutingRules list where each row describes a condition and a target queue.

RoutingRules
  Order       1
  Field       Category
  Operator    equals
  Value       Refunds
  TargetTeam  Payments Escalations

A flow triggered on ticket creation reads the rules in order, evaluates each against the new item and assigns the first match. Department-wise assignment and approval steps can be modelled the same way. Because the logic lives in data, the operations team can add or reorder rules without touching the flow.

SLAs and escalation

Store SLA targets per priority in a configuration list. When a ticket is created, calculate its due time and write it to the DueBy column. A scheduled flow then queries for open tickets approaching or past DueBy and escalates them, either by notifying a team lead or by raising priority.

Index the Status, Priority and DueBy columns. SharePoint list views and queries perform best when they filter on indexed columns, and keeping the list view threshold in mind early saves pain later.

Notifications

Power Automate handles email and in-app alerts at each stage: creation, assignment, updates and resolution. Pull message content from a templates list so that wording and branding can change without editing flows. Keep notification flows separate from routing flows so that each is easy to test on its own.

Permissions

Map roles to SharePoint groups: requesters, agents, team leads and administrators. Use item-level permissions or filtered views so that requesters only see their own tickets. Because the helpdesk uses the tenant's identity and permission model, there is no separate user directory to maintain, and access reviews follow the processes you already have.

Attachments and context

Agents resolve tickets faster when they have the full picture. Let requesters attach screenshots, documents or logs at submission, and store them with the ticket item so they inherit the same permissions. In the SPFx form, show attachment previews in the ticket view and keep file size limits sensible. For payments or finance support, where a ticket may include a statement or transaction reference, keeping attachments inside the tenant matters just as much as keeping the ticket text there.

Reporting

An SPFx dashboard can query the Tickets list for open tickets, resolution times, agent workload and trends across a date range. For ad hoc analysis, an export to Excel is often more useful than another chart, especially for compliance or management reviews.

Build or adopt?

Everything above can be built in-house, and for small teams a few lists and flows may be enough. As rules and volume grow, the maintenance burden grows too. That is where packaged options built on the same stack come in. The CV Helpdesk feature overview lists most of the capabilities described here, including department-wise assignment, priority management, internal notes, role-based access, Power Automate notifications, dashboards and Excel export, delivered as an SPFx solution.

A production example from payments

A tuition payments company in the Greater Toronto Area provides a useful reference. It was running support on Help Scout and a self-hosted open-source help desk. Payment-specific routing on the open-source tool relied on custom code, and changing a rule meant hiring outside developers, because the in-house team's skills were in Microsoft 365 and SharePoint.

The company consolidated onto a SharePoint-based helpdesk in its own tenant, with SharePoint lists for ticket data, Power Automate for notifications and escalations and SharePoint permissions for access. There was no separate database, Dataverse environment or outside data store. More than 40 business rules covering payment status questions, refund escalations and partner institution requests were configured rather than coded, and customers kept emailing the same shared inbox.

The write-up describes a production deployment that processed 5,000+ tickets with 95% SLA compliance during tuition deadlines and refund cycles. Three more business units have since adopted the same setup. For developers, the interesting part is how much was achieved through configuration alone.

Conclusion

A SharePoint ticketing system is a natural fit for teams already invested in Microsoft 365. Lists give you a governed data store, SPFx gives you a native interface, Power Automate handles workflow and SharePoint groups handle access. The design choice that matters most is keeping routing, SLA and notification rules in configuration lists, so the people who own the process can change it without a release.

FAQs

Do I need Dataverse to build a helpdesk on Microsoft 365?

No. SharePoint lists can store tickets, comments and configuration. The payments deployment above used lists only.

How do I stop email replies from creating duplicate tickets?

Put the ticket ID in outgoing subject lines and match on it in the inbound flow, appending replies as comments.

Where should routing logic live?

In a configuration list that a flow reads at runtime. That lets administrators change rules without editing the flow.

How do I keep list queries fast as tickets grow?

Index the columns you filter on, such as status, priority and due date, and design views that avoid full-list scans.

These are field notes on that wiring, aimed at developers and Microsoft 365 admins. The code is illustrative, not lifted from any particular product.

Start with the data model, not the UI

It is tempting to open the SPFx Yeoman generator first. Resist that. The list schema decides how far the system will scale and how easy reporting will be.

A workable minimum looks like this:

• Tickets: Title, Description, Status (choice), Priority (Low, Medium, High, Critical), Category, Department, Requester (person), AssignedTo (person), DueBy (date/time), Source (Portal or Email)

• TicketComments: TicketId (lookup), Body, IsInternal (yes/no), Author

• RoutingRules: Name, MatchField, MatchValue, TargetDepartment, TargetPriority, Enabled, Order

• SlaPolicies: Priority, ResponseHours, ResolveHours

Two decisions here save pain later. First, keep internal notes in the comments list with an IsInternal flag, so you can permission or filter them separately. Second, store routing and SLA logic as data in their own lists. That turns "change a rule" from a deployment into an edit.

Plan for the list view threshold early

SharePoint's list view threshold is 5,000 items. You can store far more, but queries that scan past the threshold on non-indexed columns will fail. Index Status, Priority, AssignedTo, Department and Created before you go live. Every agent queue you build should filter on at least one indexed column first.

Reading tickets from SPFx

PnPjs keeps list access readable. A typical agent queue query might look like this:

const items = await sp.web.lists
  .getByTitle("Tickets")
  .items
  .select("Id", "Title", "Priority", "Status", "DueBy", "AssignedTo/Title")
  .expand("AssignedTo")
  .filter("Status eq 'Open' and Department eq 'Payments'")
  .orderBy("DueBy", true)
  .top(100)();

Ordering by DueBy puts tickets closest to their SLA deadline at the top, which is what agents actually need during a busy period. Paging with top() keeps responses small.

Let SharePoint handle identity

SPFx web parts run in the signed-in user's context, so there is no separate login and no token juggling for list access. Use SharePoint groups to model roles: Requesters, Agents, Team Leads and Admins. In the UI, show or hide actions based on group membership, but never rely on the UI alone. The list permissions are the real boundary.

Turning email into tickets

Many teams, especially customer-facing ones, cannot ask users to visit a portal. A Power Automate flow on a shared mailbox solves this:

1. Trigger: when a new email arrives in the shared mailbox.

2. Create item in Tickets with subject as Title, body as Description, sender as Requester and Source set to Email.

3. Copy attachments to the new item.

4. Reply to the sender with the ticket ID.

Handle replies too. If the subject contains an existing ticket ID, append the message to TicketComments instead of creating a new ticket. Otherwise one customer conversation splinters into several tickets.

Routing rules as configuration

Hard-coded routing is the most common way these projects become unmaintainable. A cleaner pattern: a flow triggered on ticket creation reads enabled rules from the RoutingRules list in order, evaluates them against the new ticket and applies the first match.

A rule stored as list data might be represented like this:

{
  "Name": "Refund requests to Payments",
  "MatchField": "Category",
  "MatchValue": "Refund",
  "TargetDepartment": "Payments",
  "TargetPriority": "High",
  "Order": 10,
  "Enabled": true
}

Now a support lead can add or reorder rules without touching code. This is not a theoretical benefit. In the cross-border payments helpdesk case study from CodeVision, a tuition payments company configured more than 40 business rules, covering payment status questions, refund escalations and partner institution requests, with zero custom code. Its previous system needed outside developers for every routing change.

SLA timers and escalation

On ticket creation, look up the matching SlaPolicies row and set DueBy. In a Power Automate expression that is roughly:

addHours(utcNow(), int(outputs('Get_SLA_policy')?['body/ResolveHours']))

Then run a scheduled flow every 15 minutes that queries open tickets where DueBy is within the next hour and AssignedTo has not responded. For each one, notify the assignee and their team lead, and optionally raise priority.

Keep escalation flows under a service account connection. If they run under a developer's personal account, they will quietly break the day that person leaves.

Notifications without noise

Agents ignore systems that email them about everything. Be selective:

• Notify requesters on creation, on status change to Resolved and on new public comments.

• Notify agents on assignment and on approaching SLA deadlines.

• Never send internal comments to requesters. Filter on IsInternal in the flow condition.

Teams adaptive cards work well for agents. Email remains the safest default for external requesters.

Reporting and export

A dashboard web part can aggregate open tickets by status, priority, department and assignee using indexed queries. For anything heavier, export to Excel and let analysts work offline. If you operate in a regulated industry, think about who is allowed to export, since an exported file leaves the governed list.

Test with real tickets, not toy data

Before go-live, replay a realistic sample of historical requests through the system. Check that each one lands in the right queue, gets the right priority and triggers the right notifications. Pay attention to edge cases: emails with large attachments, replies to closed tickets, requesters who belong to more than one department and rules that overlap.

Load matters too. Seed the Tickets list with several thousand items and confirm your agent views still return quickly. It is far easier to add an index now than after agents start complaining during a busy week.

Build or buy?

Everything above is buildable by a capable Microsoft 365 team in a few sprints. The hidden cost is everything around it: forms, branding, permissions edge cases, upgrade paths and documentation. If you would rather configure than build, a packaged SharePoint helpdesk built with SPFx covers the same ground: SharePoint or email ticket submission, department-wise assignment, priority management, Power Automate notifications, internal notes, role-based access and Excel export.

For reference, the payments company mentioned earlier ran its tenant-native setup in live production, handled more than 5,000 tickets, reported 95% SLA compliance during tuition deadlines and refund cycles, and extended the same approach to three more business units.

Wrapping up

A SharePoint ticketing system works best when you treat SharePoint as the database, Power Automate as the workflow engine and SPFx as a thin UI. Keep business logic in lists, keep flows under service accounts and design every query around indexed columns. Do that, and the system stays maintainable long after the original developer has moved on.

FAQs

Do I need Dataverse for a SharePoint-based helpdesk?

No. SharePoint lists can hold tickets, comments and configuration. Dataverse is an option, not a requirement.

How do I stop internal notes reaching requesters?

Store them with an IsInternal flag or in a separate list, and filter them out in both the UI and notification flows.

What happens when the Tickets list passes 5,000 items?

Nothing breaks if your queries filter on indexed columns. Unindexed queries that scan the whole list will fail.

Can routing rules change without a redeploy?

Yes, if you store them as list items and have a flow evaluate them at runtime.