Freshdesk Agents, Roles & Groups Explained

What agents, roles, and groups are in Freshdesk

The three concepts stack on top of each other, and it's worth pinning down each one before you touch any settings.

An agent is a person with a login who works on tickets — replies, adds notes, changes status, closes things out. Freshdesk distinguishes two flavors. A full-time agent occupies a paid seat and is your day-in, day-out support staff. An occasional agent (sometimes called a day-pass agent) is someone who dips in intermittently — a developer who fields the odd escalation, or a manager who covers a busy week — and is billed differently so you're not paying a full seat for someone who logs in twice a month. The availability and exact billing of occasional agents varies by plan, so confirm it against your own subscription.

A role is a named bundle of permissions that answers "what is this person allowed to do?" Freshdesk ships with default roles — typically Account Administrator, Administrator, Supervisor, and Agent — that range from full run-of-the-house access down to a front-line agent who can work tickets but can't reconfigure the account. Roles gate concrete privileges: managing tickets, creating and publishing solution (knowledge base) articles, viewing reports and dashboards, and reaching admin configuration. On higher tiers you can build custom roles — your own permission sets — so, for instance, a QA reviewer can read every ticket and see reports but can't edit automations.

A group is a bucket of agents that tickets get routed to — Billing, Tier 2, Onboarding, EU Support. Groups are the backbone of routing: your automation and dispatch rules assign an incoming ticket to a group, and then it lands in front of the agents who belong to it. A group can also carry its own business hours, an escalation path, and — where enabled — automatic ticket assignment so tickets are handed out round-robin or by load instead of sitting in a shared pile.

How it works in Freshdesk

You manage all three under Admin → Team (Agents, Roles, and Groups each have their own page). Per Freshdesk's Agents, groups and roles documentation, the pieces connect like this.

Adding an agent. You invite them by email and, on the agent's own record, set three things: their role (the permission bundle), the groups they belong to, and their ticket scope. That last one is separate from the role and easy to miss. Scope comes in three levels:

• Global — the agent can see and act on all tickets in the account.
• Group — the agent sees tickets that belong to the groups they're a member of.
• Restricted — the agent sees only tickets specifically assigned to them.

Scope is the privacy dial; the role is the capability dial. A Supervisor role with Group scope, for example, can do supervisory things but only within their own groups' queues.

Building routing with groups. Create a group, add its member agents, and — if your plan supports it — turn on automatic ticket assignment (round-robin or load-balanced) so new tickets are distributed rather than cherry-picked. Then your automation / dispatch rules do the actual sorting: "if Type is Billing, assign to the Billing group," "if the requester's plan is Enterprise, assign to Tier 2." The rule targets the group; the group's assignment logic (or an agent manually) picks the person. This is why groups matter more than they first appear — they're the join between your routing rules and your actual staff.

Setting roles and permissions. Assign each agent a default role, or on higher plans create a custom role by ticking the exact privileges it should carry — manage tickets, edit and publish solutions, view reports, access admin settings — and assign that instead. The principle is least privilege: give front-line agents what they need to resolve tickets and nothing that lets them reshape the account. For where all of this sits in the wider product, see our Freshdesk features overview.

Where the native feature stops — and an AI layer begins

Agents, roles, and groups are a solid structure, but they're static. Freshdesk can route a ticket to the Billing group; it can't read the message, decide it's actually a refund question, draft the answer from your policy, and only escalate the genuinely hard ones. Routing rules match on fields and keywords, so anything ambiguous — the majority of real tickets — still lands in a human queue to be read, understood, and answered from scratch. Roles and groups govern who works a ticket; they do nothing to reduce how many tickets a human has to work.

That's where Macha comes in. Macha is an AI agent layer that runs on top of Freshdesk as a native connector — not a replacement for it, and not a Freshdesk alternative. (It connects to Freshdesk specifically; it does not connect to Freshchat, Freshservice, or Freshcaller.) Because it reads and writes real tickets through the Freshdesk API, a Macha agent behaves like a tireless extra "agent" in your account: it can pick up an incoming ticket, classify it, reply from your documented policy, and — for anything it shouldn't handle — leave a note and hand a fully-triaged ticket to the right human group. Your roles and groups keep governing the humans; the AI layer just means fewer tickets ever reach them.

The pieces that make this trustworthy rather than a black box: Custom Tools let an agent turn any REST API into a callable action, so it can look up an order or a subscription in your own systems before it answers instead of guessing. Sources ground its replies in your help center so answers match your real policy rather than inventing one. And Studies batch-grade the agent against real historical tickets before it ever touches a live queue — you see how it would have classified and answered hundreds of past tickets, and only ship when the numbers are good. If you're weighing whether to assemble this yourself, our guide on building an AI agent from scratch versus using a platform walks the trade-offs, and AI agents for customer service covers the category end to end. For the Freshdesk-specific setup, see how to automate Freshdesk with AI.

FAQ

What's the difference between agents, roles, and groups in Freshdesk? Agents are the people who work tickets. Roles are permission bundles that define what each agent is allowed to do — from Account Administrator down to a front-line Agent. Groups are the buckets of agents that tickets route to, like Billing or Tier 2. In short: agents are who, roles are what they can do, and groups are where tickets land.

What is an occasional agent in Freshdesk? An occasional (or day-pass) agent is someone who logs into Freshdesk intermittently rather than full-time — a developer who handles the odd escalation, or a manager covering a busy week. They're billed differently from full-time agents who occupy a permanent seat. Availability and pricing of occasional agents vary by plan, so check your own subscription.

How does ticket routing to groups work in Freshdesk? Your automation or dispatch rules assign an incoming ticket to a group based on its fields — for example, sending all Billing-type tickets to the Billing group. If the group has automatic ticket assignment enabled, Freshdesk then hands the ticket to a specific agent round-robin or by load; otherwise agents pick from the shared group queue. The rule targets the group, and the group distributes to the person.

Can Macha act as an agent inside Freshdesk? Yes — Macha runs as a native AI agent layer on top of Freshdesk (it connects to Freshdesk, not Freshchat/Freshservice/Freshcaller). It reads incoming tickets, classifies them, replies from your help center, and hands anything it shouldn't handle to the right human group with a note. Your existing roles and groups still govern your human agents; the AI layer just reduces how many tickets reach them. You can grade it against real past tickets with Studies before going live — see pricing for plan details.