L1, L2 and L3 IT Support Explained

L1, L2 and L3 describe who works on an IT problem, not how urgent it is. L1 is the first line: it answers the call, logs the ticket and fixes the common problems. L2 is the second line, with deeper skills in devices, networks and Microsoft 365. L3 is the specialist line for servers, identity design, security incidents and vendor cases. The tiers matter to a buyer because most tickets are quick, but the ones that stop a business need L3, and the contract decides how fast a ticket gets there. Our managed IT services in Dubai run the service desk end to end, from first contact to specialist work.

What does L1 support handle?

L1 handles first contact and every problem with a known fix. The L1 engineer logs the ticket, sets its priority, gathers the facts, and either fixes the fault or passes it on with the groundwork done.

• Password resets and multi-factor authentication (MFA) resets
• Access requests, such as a shared mailbox, a Teams channel or a SharePoint site
• New starter and leaver tasks from an agreed checklist
• Outlook, printer and "how do I" questions
• Triage: setting the priority and choosing the next tier

The common L1 fixes do not need full admin rights. In Microsoft Entra ID, the Helpdesk Administrator and Password Administrator roles can both reset passwords for users who are not administrators, and the Authentication Administrator role can reset their authentication methods. Microsoft's guidance is to give administrators exactly the permission they need to do their job. A provider whose L1 desk signs in as Global Administrator to reset a password is showing you a weak role model.

Some L1 work should not reach a person at all. Microsoft Entra self-service password reset lets users change or reset their own password with no administrator or help desk involvement. Switching it on gives L1 time back for the problems that need an engineer.

What does L2 support handle?

L2 handles faults that need diagnosis rather than a known fix. A ticket moves to L2 when the L1 checklist runs out, or when the fault sits in configuration rather than on one person's screen.

• Laptops that fail an Intune compliance policy, or will not take an app or update
• Outlook, Teams or OneDrive faults caused by tenant settings
• VPN, WiFi and firewall faults for one user or one team
• Failed backup jobs, and restores of single files or mailboxes
• Remote sessions to watch a fault happen on the user's device

L2 also works inside narrow roles. Microsoft Intune has a built-in Help Desk Operator role that performs remote tasks on users and devices and can assign apps or policies to them. Intune Remote Help lets an admin decide which helpers can only view a device and which can request full control of the session. A sensible split is L1 on view only and L2 able to request full control, as our Intune Remote Help page explains.

Before L2 spends an hour on a fault that hits everyone, it should check Microsoft's side. Microsoft advises checking service health in the Microsoft 365 admin center first, to see whether the problem is a known issue with a fix in progress.

What does L3 support handle?

L3 handles the problems that need design knowledge, root-cause work or a vendor. It is the tier that decides how bad a bad day gets.

• Server, storage and virtualisation faults
• Identity design: Conditional Access, privileged roles and emergency access accounts
• Security incidents: containment, investigation and recovery
• Root-cause analysis when the same fault keeps coming back
• Cases with Microsoft, the firewall maker or a software vendor, with the evidence already gathered
• Changes that could stop the business if they go wrong

L3 holds the most powerful access, so that access needs the tightest limits. Microsoft recommends giving the Global Administrator role to fewer than five people in an organisation.

Security incidents also need someone watching the alerts. On GR Managed IT, Defender for Endpoint and Defender for Office 365 alerts are triaged by our Dubai-based SOC.

Vendor escalation also depends on how you bought your licences. If you bought all your Microsoft 365 subscriptions through a partner, Microsoft tells you to contact that partner for support. In that case your support starts with the partner, so ask your provider who raises cases with Microsoft and who chases them.

Are L1, L2 and L3 the same as P1, P2 and P3?

No. The tier says who works on a ticket; the priority says how fast. A P1 outage can start at L1 and be with L3 within the hour, while a P4 request may need an L3 engineer next week. A good contract sets both.

Every ticket we receive gets a priority when it comes in:

• P1, business stopped: response within 5 minutes, 24/7, on every package. Resolution target: 4 hours.
• P2, a user or team blocked: response within 10 minutes. Resolution target: 1 business day.
• P3, work continues: response within 30 minutes. Resolution target: 3 business days.
• P4, low or planned: response next business day. Resolution target: 5 business days.

As standard, P2 and P3 run in support hours: Monday to Friday 9:00 to 18:00, and Saturday 9:00 to 14:00. P2 and P3 run 24/7 on GR IT AMC Scale and GR Managed IT Professional. On GR Managed IT Enterprise, the P2 and P3 targets are set in the contract. Response means an engineer is working on your issue remotely, not an automatic reply.

When should a ticket move up a tier?

A ticket should move up when its clock runs out, not when you complain. Good escalation runs on two tracks: the ticket moves to more skill, from L1 to L2 to L3, and the delay moves to more authority, so a manager knows before you have to chase.

On our GR IT AMC packages, every ticket starts with the helpdesk and moves up automatically if it is not closed inside its window. The escalation matrix sets the clock:

• P1: engineer working on it within 5 minutes, service manager notified within 30 minutes, director briefed within 1 hour, managing director briefed within 2 hours if still open.
• P2: engineer working on it within 10 minutes, service manager notified within 1 hour, director briefed within 4 hours, managing director review if the resolution target is missed.
• P3: engineer working on it within 30 minutes, service manager notified within 4 hours, director review in the monthly report.
• Repeat incidents: flagged on the third occurrence, with a root-cause analysis assigned.

Every missed target is listed in the monthly report, with the ticket, the time it took and the reason. The full matrix is on our IT AMC in Dubai page.

Should one provider cover all three tiers?

One provider covering all three tiers is simplest when you have no IT staff of your own. There is one queue, one escalation path and no hand-off between companies to argue over.

If you already employ IT staff, a co-managed split often fits better. Your team keeps the users, the business knowledge and the decisions, and the provider takes an agreed share, such as out-of-hours cover, security monitoring or specialist Microsoft work. The split is written down system by system, with escalation both ways: your engineers call on the provider for depth, and the provider calls your named contact when a decision belongs to the business. Our co-managed IT services page shows how we write that split.

Whichever model you choose, count the hand-offs. Each tier that sits with a different company adds a queue, a login and a delay. Support hours also drive the cost, as our guide to IT support pricing in Dubai explains.

How can you check a provider's L2 and L3 depth before signing?

Ask for evidence, not a tier diagram. Any provider can draw three boxes; these questions show what sits behind them.

1. Who is L3, and how fast do they join? Ask for a named escalation path with timings: who picks up when the first engineer cannot fix it, and after how long. It belongs in the contract.
2. Which admin roles does each tier use? Microsoft publishes the least privileged role for a range of Entra tasks. If every engineer is a Global Administrator, there is no real tier model.
3. How does a partner get into your tenant? For a Microsoft partner, ask whether access comes through granular delegated admin privileges (GDAP). Microsoft describes GDAP as granular, time-bound access that the customer must explicitly grant.
4. What did L3 do last month? Ask for anonymised sample tickets that reached L3: the fault, the root cause and the fix.
5. What happens on the third repeat of a fault? Listen for root-cause analysis, not another restart.
6. What does the monthly report show? It should list every missed target and the reason, not only averages.
7. What needs someone on site, and how is it charged? Our packages are delivered 100% remotely. When a fault needs hands on site, the visit is booked and charged separately, so ask every provider how theirs works.

Ask us the same questions. Tell us how your support is set up today and we will show you how the three tiers would work for your team.