L1, L2 and L3 support: what each level does and which one your company needs
When you compare IT support offers, you quickly meet the terms L1, L2 and L3. They describe how deep the technical knowledge goes at each level of a helpdesk. Understanding them helps you avoid paying for senior engineers to reset passwords, and avoid a cheap service that cannot fix a broken server.
L1: first-line support
L1 is where every request starts. The goal is to solve common issues quickly and to collect good information for the rest.
Typical L1 tickets:
- “I forgot my password” or “my account is locked”.
- “Outlook does not show new mail.”
- “Please install Adobe Reader on my laptop.”
- “The printer on the second floor does not print.”
- “How do I share this folder with a client?”
A good L1 team solves 60 to 70% of all requests without escalation. It works from documented procedures and a knowledge base about your company.
L2: technical support
L2 handles problems that need deeper knowledge of systems and permissions, or access that L1 does not have.
Typical L2 tickets:
- A laptop crashes after an update and needs troubleshooting.
- VPN works for everyone except one user.
- Setting up a new employee: account, licenses, groups, mailbox, laptop.
- Configuring shared mailboxes, Teams and SharePoint permissions.
- Mobile device enrolment and policies.
L3: senior engineers
L3 is for problems in the infrastructure itself, root cause analysis and work with vendors.
Typical L3 tickets:
- The file server or a virtual machine is down.
- The office network is slow and nobody knows why.
- Planning a migration to Microsoft 365 or to the cloud.
- A security incident: a mailbox was compromised and suspicious rules were created.
- Escalating a bug to Microsoft, a firewall vendor or the internet provider.
How a ticket moves between levels
A user writes to the support address. L1 registers the ticket, checks the basics and solves it if possible. If not, L1 documents what was checked and escalates to L2. L2 does the same for L3. Good escalation notes save time: the next engineer should never have to ask the user the same questions again.
Response time vs resolution time
Service agreements usually promise a response time, meaning when an engineer starts working on the issue. Resolution time depends on the problem and is rarely guaranteed. Make sure the response time is counted in business hours or calendar hours, and that “critical” is clearly defined, for example “the whole office cannot work”.
Which level does your company need?
- L1 only fits a small team with simple cloud tools and no servers, where someone internal can handle the occasional complex issue.
- L1 and L2 fits most companies of 10 to 50 people that use Microsoft 365 or Google Workspace, laptops and a VPN.
- L1 to L3 makes sense when you have your own servers, a more complex network or several offices, or when you have no in-house IT person at all.
Our helpdesk plans follow exactly this structure, from L1 Essentials to L1–L3 Complete. If you are not sure which one fits, start with a free IT audit and we will recommend a level based on what you actually run.