Conflicting Alerts at a Three-Person Support Desk
You manage a three-person support desk for a SaaS product with 47 open tickets at 09:00 Monday. Two new alerts arrive simultaneously: (A) a login-failure report from a single enterprise customer worth $120,000 annual recurring revenue, whose contract renews in 14 days; (B) a spike in failed logins affecting roughly 200 users across 30 small accounts, first seen 25 minutes ago. Your SLA promises first response within 4 hours for enterprise and 8 hours for standard. One agent is on a scheduled training until noon; the other two are handling a backlog of password resets. The enterprise customer has a named account manager who is asking for an immediate call. You have no confirmed root cause for either alert.
1. Rank the two alerts and justify the ranking using impact, urgency, and reversibility. State what you would do in the first 30 minutes.
Read the worked answer
Ranking: Treat B as the operational priority and A as the relationship priority until you know whether they share a cause.
- Impact: B affects ~200 users and 30 accounts; A affects one account. Blast radius favors B.
- Urgency: B is 25 minutes old and may still be spreading; A's renewal is 14 days away, not 14 minutes.
- Reversibility: A failed login can often be resolved with a password reset or workaround; a broad authentication failure can lock out many users and generate more tickets.
First 30 minutes: Put one agent on auth logs, status page, and a quick reproduction of B. Put the other on a 10-minute call with A's account manager: acknowledge, gather the exact error, and offer a password-expiry workaround. You triage the 47-ticket backlog for anything that looks like B. Do not promise a root cause. If B and A turn out to be linked, collapse them into one incident and communicate once.
2. The account manager demands a written commitment that the enterprise issue will be fixed within 2 hours. What do you commit to, and why?
Read the worked answer
Commit to communication and escalation, not to a fix time you cannot control.
A credible commitment: 'We will update you at 10:00, 12:00, and 14:00, or sooner if we have a root cause. If we have not identified the cause by 12:00, I will escalate to our engineering lead and give you a workaround plan.' This separates acknowledgement from resolution.
Why not promise two hours? You have no confirmed root cause, and a missed promise damages trust more than an honest cadence. The account manager's real need is not a magic timestamp; it is evidence that someone owns the issue and that the renewal risk is being managed. Offer a workaround if possible, document the commitment in writing, and copy the account executive. If the customer insists on a fix SLA, route it to your manager rather than improvising a contractual term.
3. At 11:00 you learn the 200-user spike is caused by a partner SSO misconfiguration, and the enterprise issue is unrelated password expiry. How does this change your prioritization?
Read the worked answer
Now the two alerts are separate incidents, so the ranking changes.
- B (partner SSO): The cause is external but the fix may still be in your control-disable the broken SSO path, notify the partner, and give affected users a fallback login. Because the blast radius is large, keep one agent on it until the fallback is verified.
- A (password expiry): This is likely a quick, deterministic fix. Resolve it first or in parallel because it is cheap and removes renewal risk. The account manager's 2-hour demand is now easier to satisfy.
Update the enterprise customer that their issue is unrelated to the broader spike, which protects confidence. Reassign the second agent to A and keep the first on B. Recheck the backlog for users who reported B but are actually A. Communicate a single status page note for B and a direct note for A.