Job descriptions in IT support are full of shorthand: "L1 support", "L2 application support", "L3 production support", "24x7 rotational shifts". If you are new to IT, or moving in from technical support in a BPO, these labels can feel like a secret code.
They are actually simple once you see how a support team handles a problem from start to finish. This guide follows one real-style ticket through every level, then explains the skills, tools and career path for each, so you know exactly where you fit and how to move up.
Why support is divided into levels
Most IT problems are common and quick to solve: a forgotten password, a locked account, a printer that will not connect. A smaller number need deeper investigation, and a very small number need an engineer to change code. Levels let simple issues be solved fast and cheaply, while experts focus on the hard problems. This structure comes from IT service management (ITSM) practice, and many organisations follow the ITIL framework for it.
The levels at a glance
| Level | Who | Typical work | Access |
|---|---|---|---|
| L0 | Self-service | Knowledge base articles, chatbots, password reset portals | None (user helps themselves) |
| L1 | Service desk / help desk | Log tickets, basic troubleshooting, password resets, known fixes, routing | Ticketing tool, admin console for accounts, knowledge base |
| L2 | Technical / application support | Deeper diagnosis: logs, database queries, configuration, reproducing issues | Servers, application logs, read access to databases, monitoring tools |
| L3 | Engineers / developers / specialists | Root cause fixes, code changes, complex infrastructure issues, permanent solutions | Source code, deployment pipelines, full system access |
| L4 | Vendor / product owner | Issues in third-party products that only the vendor can fix | Vendor’s own systems |
One ticket, all levels: a worked example
An employee at a bank reports: "I cannot download customer statements from the loan application. It shows an error."
- L1 (service desk): logs the ticket with the user’s details, application name, error message and screenshot. Checks the knowledge base, asks the user to clear the browser cache and try again, and confirms the user has the right access role. The error continues and other users report the same thing, so L1 marks it as a possible wider incident and escalates to L2 with all the details.
- L2 (application support): reproduces the error, checks the application logs and finds a "timeout" when the statement service queries the database for customers with very long loan histories. Runs a SQL query to confirm the affected customers. Applies a known workaround (generating the statement through a batch job) so branches can keep working, updates the users, and escalates the root cause to L3.
- L3 (development team): finds that the statement query has no index on a frequently filtered column and loads all transactions at once. Adds the index and pagination, tests the fix and deploys it through the change process.
- Closure: L2 confirms with users that statements download normally, L1 closes the ticket, and the knowledge base is updated so the next similar issue is handled faster.
Notice that every level added value. L1’s clear notes saved L2 time; L2’s workaround protected the business while L3 built the permanent fix.
ITIL terms you will hear every day
- Incident: an unplanned interruption or reduction in service quality ("the app is down").
- Service request: a standard request, not a failure ("I need access to a shared folder").
- Problem: the underlying cause of one or more incidents, investigated to prevent repeats.
- Change: a controlled modification to a system, usually approved before it is made.
- SLA (service level agreement): agreed response and resolution times, often by priority (P1 critical to P4 low).
- Escalation: passing a ticket to a higher level or a specialist team.
- RCA (root cause analysis): a report explaining why an incident happened and how it will be prevented.
Skills needed at each level
| Level | Technical skills | Soft skills |
|---|---|---|
| L1 | Windows and Office basics, Active Directory account tasks, networking basics (IP, DNS, DHCP, ping), email and VPN troubleshooting, ticketing tools | Clear communication, patience, accurate ticket notes, following procedures |
| L2 | Reading logs, SQL queries, Linux commands, application configuration, monitoring tools, scripting basics (PowerShell, shell or Python), understanding of the application’s architecture | Analytical thinking, ownership, writing clear updates for users and L3 |
| L3 | Programming in the application’s language, databases in depth, debugging, performance tuning, cloud and infrastructure, release processes | Root cause thinking, collaboration with developers and vendors, documentation |
Common tools
- Ticketing / ITSM: ServiceNow, Jira Service Management, BMC Helix, Freshservice, Zendesk.
- Remote support: remote desktop and screen-sharing tools approved by the company.
- Monitoring and logs: tools such as Splunk, Grafana, Dynatrace, AppDynamics or cloud monitoring dashboards.
- Directory and access: Active Directory, Microsoft Entra ID (formerly Azure AD).
Application support vs production support vs infrastructure support
- Application support: keeps business applications running (banking, insurance, HR, billing systems). Strong SQL and log analysis.
- Production support: often a name for L2/L3 application support on live systems, including on-call duty for critical incidents.
- Infrastructure support: servers, networks, storage, cloud and end-user devices.
Career path: from L1 to L3 and beyond
| Stage | Typical move | What gets you there |
|---|---|---|
| L1 → L2 | Service desk to application or technical support | SQL, log reading, Linux basics, deep knowledge of one application, an ITIL Foundation certificate |
| L2 → L3 | Support to engineering or senior specialist | Programming or scripting, debugging, cloud skills, ownership of RCAs |
| Beyond support | Site reliability engineering (SRE), DevOps, cloud engineer, system administrator, ITSM tool administrator (for example ServiceNow), service delivery manager | Automation, cloud certifications, leadership of major incidents |
Helpful certifications include ITIL 4 Foundation, CompTIA A+ / Network+, Microsoft Azure Fundamentals or an AWS foundational certificate, and later role-specific cloud or ServiceNow certifications. Read our cloud career guide for beginners if you want to move towards cloud.
Shifts and on-call
Many support teams run 24x7 rotational shifts because systems serve users in different time zones. L2 and L3 engineers may also be on call: reachable outside working hours for critical (P1) incidents. Ask about shift patterns and on-call expectations during the interview so there are no surprises.
Frequently Asked Questions
What is the meaning of L1, L2 and L3 support?
They are levels of IT support. L1 handles first contact and common issues, L2 investigates deeper technical problems using logs and system access, and L3 is the expert or engineering level that fixes root causes, often through code or configuration changes.
What does an L1 support engineer do?
Logs tickets, performs basic troubleshooting, resets passwords, applies known fixes from the knowledge base and escalates issues it cannot solve to L2 with clear notes.
What is the difference between L2 and L3 support?
L2 diagnoses and works around problems using logs, SQL and configuration. L3 makes permanent fixes, usually by changing code or infrastructure, and leads root cause analysis.
Is L1 support a good job for freshers?
Yes. It is a common entry point into IT, and with SQL, Linux, scripting and certifications you can move to L2 and beyond.
Which certification is best for IT support?
ITIL 4 Foundation is widely recognised for service management. CompTIA A+ and Network+ cover technical basics, and a foundational cloud certificate helps for modern support roles.
What is L0 support?
L0 is self-service: knowledge base articles, chatbots and password reset portals that let users solve problems without contacting the help desk.