Three ideas run this whole system: agents are the people who answer, queues are the topics tickets belong to, and groups decide who may do what in each queue. Set them up in that order and the helpdesk stays tidy for years. Set them up carelessly and you get shared logins, personal queues and everyone-is-admin chaos.
New administrators usually rush this part, because the screens look simple. Resist that. The structure you choose in the first hour is the structure your team will live in every day: tickets live in queues, people work as agents, and groups connect the two by carrying permissions. One person can work in many queues, one queue can hold many people, and nobody needs more rights than their actual job. This page builds that structure step by step, with an example layout.
An agent is a staff login - one per human, with their real name and email, because ticket history must show who actually answered. A queue is a topic bucket like Support or Billing; every ticket lives in exactly one queue. A group is a bundle of permissions, and agents join groups - that membership is what lets an agent see and work tickets in the queues attached to that group. Keep those three ideas separate in your head and every admin screen in this system starts to make sense.
Permissions in this system are granular, and the names are worth learning once: ro means read only, move_into lets an agent move tickets into a queue, create allows new tickets, note allows internal notes, owner and priority control taking responsibility and setting urgency, and rw is full read and write. Build one group per job type - for example Support Agents with rw on the Support queue and ro on Billing - and put people in groups. When someone changes role, you change one membership, not fifty individual settings.
Structure only works if tickets land correctly. Connect each mailbox to its queue, or use the dispatching settings so mail addressed to billing genuinely arrives in Billing. Whatever arrives unmatched falls into the default queue - check that queue every morning, because a ticket sitting unseen in the wrong place is worse than no ticket system at all. The full mail connection steps are in the email guide on this site.
The full OTRS helpdesk installation with every screen shown live - server, database, installer and first login.
▶ Watch Full VideoYes, and that is normal. The agent joins the groups that carry rights on each queue, so one person can fully work Support, read Billing, and never see Sales - all with a single login.
rw means full read and write in that queue - the agent can open, answer, move, prioritise and close tickets. It is the right grant for the team that owns the queue, and the wrong grant for everyone else.
No. Give the manager read-only rights across the queues instead. They can see everything, report on everything, and cannot accidentally change settings or delete the thing they were only supposed to look at.