service-itsm-teams-configure

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Enable Microsoft Teams for Employee Service (ITSM)

为员工服务（ITSM）启用Microsoft Teams

Enable the Salesforce Go feature "Microsoft Teams for Employee Service" (

service-cloud-itsm-teams-integration

) — the feature that lets IT Desk and IT Service agents track tickets, request catalog items, and get Agentforce assistance from inside Microsoft Teams. Every operation dispatches through headless-360.

Execute one step at a time. These steps make real, state-changing API calls. Run a single operation, show its result, confirm it succeeded, then proceed — do not batch multiple setup calls into one parallel block.

启用Salesforce Go功能**"Microsoft Teams for Employee Service"** （

service-cloud-itsm-teams-integration

）——该功能允许IT服务台和IT服务人员在Microsoft Teams内跟踪工单、请求目录项，并获取Agentforce协助。所有操作均通过headless-360调度执行。

请分步执行操作。这些步骤会调用真实的、改变系统状态的API。每次仅运行一个操作，展示结果并确认成功后再继续——请勿将多个设置调用批量放入一个并行块中执行。

Scope

适用范围

In scope: Enabling the
```
service-cloud-itsm-teams-integration
```
Go feature via its feature-enablement Connect API; verifying feature and
```
ITSMTeamsEnabled
```
preference state afterward; explaining why the direct org-preference PATCH route fails and why this route works instead; disabling the feature if requested; giving the user step-by-step instructions for the Azure/Entra app registration (Step 4a) since no Salesforce API can perform that part; once the user provides the resulting Client ID/Tenant ID (in chat) and the Client Secret (via the
```
TEAMS_ENTRA_CLIENT_SECRET
```
env var / secret file, never in chat), writing them directly into the
```
MSTeamsSetupClientCredentialsEC
```
Named Credential via API — this Salesforce-side write is always automated by this skill, never deferred back to the user; registering the Experience Cloud site as the Teams "preferred site" extension via
```
/connect/service-itsm-teams/graph-api/extensions
```
once that credential exists.
Out of scope: Notification-channel preferences (
```
Notifications
```
,
```
TeamsNotifications
```
) — a separate concern from this feature. Enabling the
```
service-cloud-swarming
```
Go feature itself — delegate to
```
service-itsm-swarming-configure
```
. The IT Desk/fulfiller checklist group (Turn on IT Desk, Install IT Desk app, Manage User Access, Set Teams as Collaboration Tool for Swarming) — delegate to
```
service-itsm-teams-itdesk-configure
```
. The IT Service/employee checklist group (Turn on IT Service, Install IT Service app, Manage User Access, Select a Digital Experience Site) — delegate to
```
service-itsm-teams-itservice-configure
```
. Portal/site creation — use
```
experience-portal-create
```
. The actual Azure-side actions (clicking through the Azure portal, generating the client secret, granting Microsoft admin consent) must be performed by the user in the Microsoft admin center — no Salesforce API reaches Azure/Entra — but this skill still provides the exact instructions for those steps (see Gotchas and Step 4a) rather than treating them as someone else's problem.

适用场景：通过功能启用Connect API启用
```
service-cloud-itsm-teams-integration
```
Go功能；启用后验证功能及
```
ITSMTeamsEnabled
```
偏好设置状态；解释直接调用组织偏好设置PATCH接口失败的原因及本方案可行的原因；根据请求禁用该功能；为用户提供Azure/Entra应用注册的分步指导（步骤4a），因为没有Salesforce API可完成此部分操作；一旦用户提供生成的客户端ID/租户ID（在聊天中）和客户端密钥（通过
```
TEAMS_ENTRA_CLIENT_SECRET
```
环境变量/密钥文件，绝不在聊天中传输），通过API直接将其写入
```
MSTeamsSetupClientCredentialsEC
```
命名凭据——Salesforce端的写入操作始终由本技能自动完成，绝不交由用户手动执行；一旦该凭据存在，通过
```
/connect/service-itsm-teams/graph-api/extensions
```
将Experience Cloud站点注册为Teams“首选站点”扩展。
不适用场景：通知渠道偏好设置（
```
Notifications
```
、
```
TeamsNotifications
```
）——属于与本功能无关的独立事项。启用
```
service-cloud-swarming
```
Go功能本身——交由
```
service-itsm-swarming-configure
```
处理。IT服务台/处理人员检查清单组（启用IT服务台、安装IT服务台应用、管理用户访问、将Teams设置为Swarming协作工具）——交由
```
service-itsm-teams-itdesk-configure
```
处理。IT服务/员工检查清单组（启用IT服务、安装IT服务应用、管理用户访问、选择数字体验站点）——交由
```
service-itsm-teams-itservice-configure
```
处理。门户/站点创建——使用
```
experience-portal-create
```
。实际Azure端操作（在Azure门户中点击操作、生成客户端密钥、授予Microsoft管理员权限）必须由用户在Microsoft管理中心完成——没有Salesforce API可访问Azure/Entra，但本技能仍会提供这些步骤的详细说明（参见注意事项和步骤4a），而非将其视为其他人员的职责。

The problem this skill solves

本技能解决的问题

ITSMTeamsEnabled

is the Salesforce Go page toggle preference gating Microsoft Teams ITSM integration. Its UDD definition (

ServiceItsmTeams.settings.xml

) declares

orgAccess="always"

but has no
editAccess
attribute — unlike working preferences such as

Notifications

TeamsNotifications

, which explicitly set

editAccess="always"

. As a result, the direct Setup preferences Connect API route is blocked:

text

GET  /services/data/vXX.0/setup/org/preferences/ITSMTeamsEnabled
PATCH /services/data/vXX.0/setup/org/preferences/ITSMTeamsEnabled  body: {"desiredState": true}

Both return

json

{"error_code":"API_ERROR","status_code":401,"body":"[{\"errorCode\":\"INSUFFICIENT_ACCESS\",\"message\":\"Cannot read data!\"}]"}

(

"Cannot update preference value!"

on the PATCH). This is a real, code-level access gate (

StandardMetadataChecker

setup-connect-impl

relays an Aura

NoAccessException

— "bit(s) do not have READ/WRITE access" — for this preference specifically), not a version-prefix or routing mistake. Do not retry this route with different API versions or bodies.

The verified working path is different: enable the Go feature, not the preference directly. The Salesforce Go feature-enablement Connect API sits behind a different access check and, on enable, flips

ITSMTeamsEnabled

(and related feature state) as a side effect.

ITSMTeamsEnabled

是管控Microsoft Teams ITSM集成的Salesforce Go页面切换偏好设置。其UDD定义（

ServiceItsmTeams.settings.xml

）声明

orgAccess="always"

但没有
editAccess
属性——与可正常工作的

Notifications

TeamsNotifications

等偏好设置不同，这些设置明确指定了

editAccess="always"

。因此，直接调用Setup偏好设置Connect API接口会被拦截：

text

GET  /services/data/vXX.0/setup/org/preferences/ITSMTeamsEnabled
PATCH /services/data/vXX.0/setup/org/preferences/ITSMTeamsEnabled  body: {"desiredState": true}

两个请求均返回

：

json

{"error_code":"API_ERROR","status_code":401,"body":"[{\"errorCode\":\"INSUFFICIENT_ACCESS\",\"message\":\"Cannot read data!\"}]"}

（PATCH请求返回

"Cannot update preference value!"

）。这是一个真实的、代码级别的访问限制（

setup-connect-impl

中的

StandardMetadataChecker

会针对此偏好设置转发Aura

NoAccessException

——“位(s)不具备读/写权限”），并非版本前缀或路由错误。请勿尝试使用不同的API版本或请求体重试此接口。

经验证的可行方案有所不同：启用Go功能，而非直接启用偏好设置。Salesforce Go功能启用Connect API采用不同的访问检查机制，启用后会将

ITSMTeamsEnabled

（及相关功能状态）作为副作用自动切换。

Workflow

工作流程

Step 1 — Check current feature status

步骤1 — 检查当前功能状态

text

mcp__headless-360__dispatch(
  method: "POST",
  url:    "/services/data/v67.0/connect/setup/discovery/features/status",
  body:   { "featureApiNames": ["service-cloud-itsm-teams-integration"] }
)

Response shape:

json

{
  "items": [
    {
      "apiName": "service-cloud-itsm-teams-integration",
      "status": "ENABLED",          // or "NOT_ENABLED" / "DISABLED"
      "blockedByApexLock": false,
      "dependencyStatuses": [],
      "enableBlockedReasons": [],
      "disableBlockedReasons": []
    }
  ]
}

status

is already

"ENABLED"

, skip to Step 3 (verification) — do not re-enable. If

enableBlockedReasons

is non-empty, surface those reasons to the user (typically a missing license/add-on) before attempting Step 2.

text

mcp__headless-360__dispatch(
  method: "POST",
  url:    "/services/data/v67.0/connect/setup/discovery/features/status",
  body:   { "featureApiNames": ["service-cloud-itsm-teams-integration"] }
)

响应格式：

json

{
  "items": [
    {
      "apiName": "service-cloud-itsm-teams-integration",
      "status": "ENABLED",          // 或 "NOT_ENABLED" / "DISABLED"
      "blockedByApexLock": false,
      "dependencyStatuses": [],
      "enableBlockedReasons": [],
      "disableBlockedReasons": []
    }
  ]
}

如果

status

已为

"ENABLED"

，跳至步骤3（验证）——无需重新启用。如果

enableBlockedReasons

不为空，在尝试步骤2前向用户展示这些原因（通常是缺少许可证/附加组件）。

Step 2 — Enable the feature

步骤2 — 启用功能

text

mcp__headless-360__dispatch(
  method: "POST",
  url:    "/services/data/v67.0/connect/setup/discovery/feature/service-cloud-itsm-teams-integration/enable",
  body:   {}
)

Known gotcha (verified): this call can return

500 INTERNAL_ERROR

even when the feature successfully ends up

ENABLED

. Do not treat a

here as a hard failure — always re-run Step 1 (

features/status

) and Step 3 (

ITSMTeamsEnabled

read) afterward to check actual state before reporting failure to the user. If status still shows

NOT_ENABLED

after retrying once, then report the failure with the raw error.

text

mcp__headless-360__dispatch(
  method: "POST",
  url:    "/services/data/v67.0/connect/setup/discovery/feature/service-cloud-itsm-teams-integration/enable",
  body:   {}
)

已知注意事项（已验证）：即使功能最终成功启用，此调用仍可能返回

500 INTERNAL_ERROR

。请勿将此处的

视为彻底失败——务必重新运行步骤1（

features/status

）和步骤3（读取

ITSMTeamsEnabled

）以检查实际状态，再向用户报告失败。如果重试一次后状态仍显示

NOT_ENABLED

，则携带原始错误信息报告失败。

Step 3 — Verify

ITSMTeamsEnabled

flipped

步骤3 — 验证

ITSMTeamsEnabled

已切换

text

mcp__headless-360__dispatch_readonly(
  method: "GET",
  url:    "/services/data/v67.0/setup/org/preferences/ITSMTeamsEnabled"
)

Expect

200 {"isPreferenceEnabled": true}

. This confirms the underlying preference — otherwise inaccessible via direct PATCH — is now enabled as a side effect of the feature enable.

text

mcp__headless-360__dispatch_readonly(
  method: "GET",
  url:    "/services/data/v67.0/setup/org/preferences/ITSMTeamsEnabled"
)

预期返回

200 {"isPreferenceEnabled": true}

。这确认了原本无法通过直接PATCH访问的底层偏好设置已通过功能启用的副作用被启用。

Step 4 — Report interim status (setup is NOT complete yet)

步骤4 — 报告临时状态（设置尚未完成）

Report feature status and whether

ITSMTeamsEnabled

reads

true

— but frame this as progress, not completion. Enabling the Go feature is only the first half. The integration is not functional until the Microsoft Entra app is registered, its credentials are written into the Named Credential + Auth Provider, and admin consent is granted (Step 4a). Do not call this an "optional manual tail," do not mark Teams "Done"/"configured"/"complete," and do not hand back to any coordinator as done. State plainly: "The Salesforce feature is enabled; Teams integration is not yet complete — the required Microsoft Entra app registration comes next." Then proceed directly into Step 4a. See the Completion contract below for what "complete" requires.

报告功能状态及

ITSMTeamsEnabled

是否为

true

——但需将此表述为进展，而非完成。启用Go功能仅完成了一半工作。在Microsoft Entra应用注册完成、其凭据写入命名凭据+身份验证提供程序并授予管理员权限（步骤4a）之前，集成无法正常工作。请勿将此称为“可选手动收尾步骤”，请勿标记Teams为“已完成”/“已配置”/“就绪”，也请勿将其作为已完成事项移交至协调人员。需明确说明："Salesforce功能已启用；Teams集成尚未完成——接下来需要完成Microsoft Entra应用注册。" 然后直接进入步骤4a。请参阅下文的完成契约了解“完成”所需满足的条件。

Step 4a — Follow the Go page's own order: Create Entra app → Configure Named Credentials → Grant consent

步骤4a — 遵循Go页面的既定顺序：创建Entra应用 → 配置命名凭据 → 授予权限

The Salesforce Go feature page (Setup → Salesforce Go → this feature,

.../lightning/setup/page/feature/service-cloud-itsm-teams-integration/home?topic=SalesforceGo

) renders a "Complete the Required Steps" → "Integrate Salesforce with Teams" checklist with exactly three items, in this order — verified from a live screenshot of the page. Follow this order; do not skip ahead to Named Credentials before the Entra app exists, and do not treat "Grant Azure Administrator Consent" as optional:

Create Microsoft Entra ID App ("Set Up Microsoft Entra ID App" button — opens portal.azure.com). There is no Salesforce API for this sub-step; give the user these exact clicks and wait for them to provide the resulting values:
- portal.azure.com → Microsoft Entra ID → App registrations → New registration. Name it something identifiable (e.g.
```
Salesforce ITSM Teams Integration
```
  ); single-tenant is fine unless the user's org spans multiple tenants; no redirect URI is needed for the client-credentials flow used here.
- From the app's Overview page, note the Application (client) ID and Directory (tenant) ID.
- Certificates & secrets → New client secret → copy the secret value immediately (unrecoverable after leaving the page).
- API permissions → Add a permission → Microsoft Graph → Application permissions → add the Graph permissions this integration needs (at minimum
```
ChannelMessage.Send
```
  ,
```
Team.ReadBasic.All
```
  ,
```
Channel.ReadBasic.All
```
  ,
```
TeamworkAppSettings.ReadWrite.All
```
  — confirm against the org's current Teams for Employee Service documentation, since required scopes can change between releases).
- Provide the credentials without exposing the secret in chat: the Client ID and Tenant ID are non-secret identifiers and may be given in the conversation, but the Client Secret is a confidential credential — NEVER ask for it in chat and never accept it there. The user places the secret in the
```
TEAMS_ENTRA_CLIENT_SECRET
```
  environment variable (or a gitignored secret file whose path they give you); you read it from that source at write time and never print, echo, or log its value.
Configure Setup Named Credentials ("Go to Setup" button on the Go page — the manual equivalent of what this skill automates). Once you have the Client ID / Tenant ID and the secret is available in the env var / file, do not tell the user to enter anything into Setup — call the Named Credential APIs directly, per "Populating
```
MSTeamsSetupClientCredentialsEC
```
given a user-supplied client ID/secret" under Step 5 below. This same set of values must ALSO be written into the
microsoft_auth_provider
Auth Provider (the inbound-SSO side, distinct from the outbound-Graph Named Credential) — the org provisions this Auth Provider empty. Do this automatically too; see "Populating the
```
microsoft_auth_provider
```
Auth Provider" under Step 5. Both artifacts share the same Client ID / Tenant ID / Client Secret and must be populated together — populating only the Named Credential leaves portal SSO login broken.
Grant Azure Administrator Consent ("Grant Consent" button on the Go page). Clicking it opens a modal with a one-time consent link to a fixed Salesforce-owned Entra app (
```
client_id=cd6bd63f-41ef-47cc-9465-86e986179a29
```
, tenant segment
```
organizations
```
— not the user's own tenant ID, and not the app created in step 1) requesting the
```
Organization.ReadWrite.All
```
delegated scope:
text
```
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=cd6bd63f-41ef-47cc-9465-86e986179a29&response_type=code&redirect_uri=https://salesforce.com&response_mode=query&scope=Organization.ReadWrite.All
```
This link is static — it does not need to be fetched per-org or per-user, and headless-360 has no operation that generates or dispatches it (it's rendered by an internal Aura controller with no public Connect API mirror). Paste this exact link and tell the user to click it, signed in as a Microsoft tenant admin, to grant consent — this action authenticates as the Microsoft admin and cannot be performed by this skill via API.

Everything the user does above (steps 1's Azure clicks and step 3's consent click) is their manual responsibility because no Salesforce API reaches Azure/Entra. Everything Salesforce-side — writing the supplied credential (secret read from the env var / secret file, never from chat) into the Named Credential in step 2 — is this skill's job to automate; that division of labor is the entire point of this skill.

Salesforce Go功能页面（Setup → Salesforce Go → 本功能，

.../lightning/setup/page/feature/service-cloud-itsm-teams-integration/home?topic=SalesforceGo

）会显示一个**"完成必要步骤" → "集成Salesforce与Teams"**的检查清单，包含以下三个明确的步骤——已从实时页面截图验证。请遵循此顺序；请勿在Entra应用创建完成前跳过至命名凭据配置，也请勿将“授予Azure管理员权限”视为可选操作：

创建Microsoft Entra ID应用（"设置Microsoft Entra ID应用"按钮——打开portal.azure.com）。没有Salesforce API可完成此子步骤；请向用户提供以下精确操作步骤并等待他们提供生成的信息：
- 打开portal.azure.com → Microsoft Entra ID → 应用注册 → 新注册。为应用命名以便识别（例如
```
Salesforce ITSM Teams Integration
```
  ）；除非用户组织跨多个租户，否则单租户模式即可；此处使用客户端凭据流，无需重定向URI。
- 从应用的概述页面，记录应用程序（客户端）ID和目录（租户）ID。
- 证书和机密 → 新客户端机密 → 立即复制机密值（离开页面后无法恢复）。
- API权限 → 添加权限 → Microsoft Graph → 应用程序权限 → 添加此集成所需的Graph权限（至少需要
```
ChannelMessage.Send
```
  、
```
Team.ReadBasic.All
```
  、
```
Channel.ReadBasic.All
```
  、
```
TeamworkAppSettings.ReadWrite.All
```
  ——请根据组织当前的Teams for Employee Service文档确认，因为不同版本所需的范围可能会变化）。
- 请勿在聊天中暴露机密：客户端ID和租户ID是非机密标识符，可在对话中提供，但客户端密钥是机密凭据——绝不要在聊天中索要或接收。用户需将密钥放入
```
TEAMS_ENTRA_CLIENT_SECRET
```
  环境变量（或他们提供路径的git忽略密钥文件）；您需在写入时从此源读取密钥，绝不要打印、回显或记录其值。
配置Setup命名凭据（Go页面上的"转到Setup"按钮——相当于本技能自动执行的手动操作）。一旦您获取了客户端ID/租户ID且密钥已在环境变量/文件中可用，请不要让用户在Setup中输入任何信息——直接调用命名凭据API，参见下文步骤5中的“根据用户提供的客户端ID/密钥填充
```
MSTeamsSetupClientCredentialsEC
```
”。同一组信息还必须写入
microsoft_auth_provider
身份验证提供程序（入站SSO端，与出站Graph命名凭据不同）——组织预配的此身份验证提供程序为空。请自动完成此操作；参见步骤5中的“填充
```
microsoft_auth_provider
```
身份验证提供程序”。这两个组件共享相同的客户端ID/租户ID/客户端密钥，必须同时填充——仅填充命名凭据会导致门户SSO登录失败。
授予Azure管理员权限（Go页面上的"授予权限"按钮）。点击该按钮会打开一个模态框，包含指向固定的Salesforce自有Entra应用的一次性权限链接（
```
client_id=cd6bd63f-41ef-47cc-9465-86e986179a29
```
，租户段为
```
organizations
```
——不是用户自己的租户ID，也不是步骤1中创建的应用），请求
```
Organization.ReadWrite.All
```
委派范围：
text
```
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=cd6bd63f-41ef-47cc-9465-86e986179a29&response_type=code&redirect_uri=https://salesforce.com&response_mode=query&scope=Organization.ReadWrite.All
```
此链接是静态的——无需按组织或用户获取，headless-360也没有生成或调度此链接的操作（它由内部Aura控制器渲染，没有对应的公共Connect API）。请粘贴此精确链接并告知用户以Microsoft租户管理员身份登录后点击该链接以授予权限——此操作用于验证Microsoft管理员身份，无法通过本技能的API执行。

用户完成上述所有操作（步骤1的Azure点击操作和步骤3的权限点击操作）属于他们的手动职责，因为没有Salesforce API可访问Azure/Entra。所有Salesforce端操作——将提供的凭据（从环境变量/密钥文件读取的密钥，绝不是从聊天中获取）写入步骤2中的命名凭据——是本技能的自动化职责；这种分工正是本技能的核心价值。

Step 4b — Delegate to the IT Desk / IT Service child skills

步骤4b — 交由IT服务台/IT服务子技能处理

Before touching the "Set Up Salesforce IT Desk" / "Set Up Salesforce IT Service" checklist groups, ask the user which they want — these are two independent halves of the feature (fulfiller side vs. employee side) and a user may only need one:

Salesforce IT Desk — for IT agents/fulfillers to swarm on and resolve tickets from Teams. Invoke
```
service-itsm-teams-itdesk-configure
```
.
Salesforce IT Service — for employees to create and manage their own tickets from Teams. Invoke
```
service-itsm-teams-itservice-configure
```
.
Both — invoke both child skills.

Each child skill handles its own 3-4 item checklist group (Turn on

<app>

→ Install

<app>

App on Teams → Manage User Access → optional 4th item) end-to-end — do not duplicate that logic here.

在处理“设置Salesforce IT服务台”/“设置Salesforce IT服务”检查清单组之前，请询问用户的需求——这些是该功能的两个独立部分（处理人员端 vs 员工端），用户可能只需要其中一个：

Salesforce IT服务台——供IT人员/处理人员在Teams中协作解决工单。调用
```
service-itsm-teams-itdesk-configure
```
。
Salesforce IT服务——供员工在Teams中创建和管理自己的工单。调用
```
service-itsm-teams-itservice-configure
```
。
两者都需要——调用两个子技能。

每个子技能会端到端处理各自的3-4项检查清单组（启用<应用> → 在Teams上安装<应用> → 管理用户访问 → 可选第4项）——请勿在此处重复该逻辑。

Step 4c — Delegate the embedded Agentforce agent (Teams "Ask AI Agent")

步骤4c — 交由嵌入式Agentforce代理（Teams“询问AI代理”）处理

If the user wants the embedded Agentforce agent to reply inside the Teams custom client ("Salesforce Employee Assist" → "Ask AI Agent") — i.e. build the

Teams_AgentForce

MIAW deployment, its Web channel (User Verification ON + a
JWKS_URL
Key Set), the routing flow to the IT Service Employee Agent, and the Agent Access permission set for the portal user — invoke
service-itsm-teams-employee-agent-configure
. That is a distinct, large capability with its own object model; do not attempt it inline here. It requires the employee portal site (

experience-portal-create

) to exist first.

如果用户希望嵌入式Agentforce代理在Teams自定义客户端（"Salesforce Employee Assist" → "询问AI代理"）中回复——即构建

Teams_AgentForce

MIAW部署、其Web渠道（用户验证开启 +
JWKS_URL
密钥集）、指向IT服务员工代理的路由流，以及门户用户的代理访问权限集——请调用
service-itsm-teams-employee-agent-configure
。这是一个独立的、复杂的功能，拥有自己的对象模型；请勿尝试在此处内联处理。它要求员工门户站点（

experience-portal-create

）已提前创建。

Step 5 — Register the preferred site (Teams extension), once the Azure credential exists

步骤5 — 注册首选站点（Teams扩展），前提是Azure凭据已存在

Once the org has an external credential named

MSTeamsSetupClientCredentialsEC

(see Step 4a and "Populating..." below), register the Experience Cloud site that should back the Teams integration:

text

mcp__headless-360__dispatch(
  method: "POST",
  url:    "/services/data/v67.0/connect/service-itsm-teams/graph-api/extensions",
  body:   { "siteUrlPathPrefixes": ["<site urlPathPrefix from GET /connect/communities>"] }
)

Update later with:

text

mcp__headless-360__dispatch(
  method: "PATCH",
  url:    "/services/data/v67.0/connect/service-itsm-teams/graph-api/extensions/{extensionId}",
  body:   { "siteUrlPathPrefixes": ["<updated prefix list>"] }
)

If this returns

400 UNKNOWN_EXCEPTION "...external credential \"MSTeamsSetupClientCredentialsEC\" might not exist"

, the Azure/Entra step (Gotchas) has not been completed yet — this is not a bug in the call itself.

If instead it returns

AccessDenied

(or

400 UNKNOWN_EXCEPTION "Exception while creating Teams extension: Unable to fetch tenant ID"

) even after the external credential shows

authenticationStatus: "Configured"

, the cause is almost always the Azure app's Graph permissions being of type Delegated rather than Application (client-credentials token flow cannot use delegated-only permissions). This is a fixable Azure/Entra misconfiguration, not a hard license wall — verified live this session: the same call went from

AccessDenied

201 Success

(

com_sf_itsm_teams_config

) after two changes on the Azure side, with no license change:

In the Azure app registration → API permissions, ensure the Microsoft Graph permissions are the Application type (not Delegated), then click "Grant admin consent" for the tenant.
Repopulate the credential (see "Populating..." below) — re-provisioning or any feature re-enable can leave the EC/Auth Provider empty; a freshly-populated
```
MSTeamsSetupClientCredentialsEC
```
showing
```
authenticationStatus: "Configured"
```
is required at the moment of the retry.

Retry Step 5 after both. Only treat this as a genuine org-license blocker (the

MsTeamsAppApiFamily

gotcha below) if the call still fails once Application-type Graph permissions + admin consent are confirmed and the credential is freshly

Configured

Once you have the Azure Client ID and Tenant ID (given in chat) and the Client Secret (read from the

TEAMS_ENTRA_CLIENT_SECRET

env var / secret file — never requested in chat; Step 4a), do the Salesforce-side writes yourself — do not tell the user to enter values in Setup. The full verified recipe (populating

MSTeamsSetupClientCredentialsEC

, populating the

microsoft_auth_provider

Auth Provider for inbound SSO via the Metadata API, matching the portal user's

Username

to the Microsoft UPN so

MsTeamsItsmSSOHandler

resolves them, and granting the portal user

ApiEnabled

for the Teams Connect APIs) — with exact API bodies, the AuthProvider MDAPI template, the Web-vs-SPA callback constraint, and their gotchas — is in:

→
references/azure-credential-population.md

一旦组织拥有名为

MSTeamsSetupClientCredentialsEC

的外部凭据（参见步骤4a和下文的“填充...”），注册应作为Teams集成后端的Experience Cloud站点：

text

mcp__headless-360__dispatch(
  method: "POST",
  url:    "/services/data/v67.0/connect/service-itsm-teams/graph-api/extensions",
  body:   { "siteUrlPathPrefixes": ["<来自GET /connect/communities的site urlPathPrefix>"] }
)

后续更新可使用：

text

mcp__headless-360__dispatch(
  method: "PATCH",
  url:    "/services/data/v67.0/connect/service-itsm-teams/graph-api/extensions/{extensionId}",
  body:   { "siteUrlPathPrefixes": ["<更新后的前缀列表>"] }
)

如果返回

400 UNKNOWN_EXCEPTION "...external credential \"MSTeamsSetupClientCredentialsEC\" might not exist"

，说明Azure/Entra步骤（注意事项）尚未完成——这并非调用本身的错误。

如果在外部凭据显示

authenticationStatus: "Configured"

后仍返回

AccessDenied

（或

400 UNKNOWN_EXCEPTION "Exception while creating Teams extension: Unable to fetch tenant ID"

），原因几乎总是Azure应用的Graph权限类型为_委派_而非_应用程序_（客户端凭据令牌流无法使用仅委派权限）。这是一个可修复的Azure/Entra配置错误，并非严格的许可证限制——本次会话已验证：在Azure端进行两项更改后，无需更改许可证，同一调用从

AccessDenied

变为

201 Success

（

com_sf_itsm_teams_config

）：

在Azure应用注册 → API权限中，确保Microsoft Graph权限为应用程序类型（而非委派），然后点击**"为租户授予管理员权限"**。
重新填充凭据（参见下文的“填充...”）——重新预配或任何功能重新启用可能会导致EC/身份验证提供程序为空；重试时需要确保
```
MSTeamsSetupClientCredentialsEC
```
已重新填充且显示
```
authenticationStatus: "Configured"
```
。

完成上述两项操作后重试步骤5。只有在确认应用程序类型Graph权限+管理员权限已授予且凭据已重新配置为

Configured

后调用仍失败时，才将其视为真正的组织许可证限制（下文的

MsTeamsAppApiFamily

注意事项）。

一旦您获取了Azure客户端ID和租户ID（聊天中提供）以及客户端密钥（从

TEAMS_ENTRA_CLIENT_SECRET

环境变量/密钥文件读取——绝不在聊天中索要；步骤4a），请自行完成Salesforce端的写入操作——不要让用户在Setup中输入值。完整的验证方案（填充

MSTeamsSetupClientCredentialsEC

、通过元数据API填充用于入站SSO的

microsoft_auth_provider

身份验证提供程序、将门户用户的

Username

与Microsoft UPN匹配以便

MsTeamsItsmSSOHandler

解析、为门户用户授予Teams Connect API的

ApiEnabled

权限）——包含精确的API请求体、AuthProvider MDAPI模板、Web与SPA回调约束及注意事项——可在以下文档中找到：

→
references/azure-credential-population.md

Completion contract — do NOT report Teams setup "complete" until all of these hold

完成契约——满足以下所有条件前，请勿报告Teams设置“完成”

The Go-feature enable (Steps 1–3) is necessary but not sufficient. The single most common failure mode is declaring Teams "configured/done/complete" after Step 3 while the Microsoft Entra app is still unregistered — which leaves in-Teams sign-in and the outbound Graph integration broken. Treat the Entra app registration as a blocking prerequisite of completion, never an optional tail. Report complete only when every item below is verified (not merely instructed):

Feature enabled —

service-cloud-itsm-teams-integration

reads

ENABLED

and

ITSMTeamsEnabled

reads

true

(Steps 1–3).

Microsoft Entra app registered — the user has completed Step 4a's Azure clicks and provided the Client ID and Tenant ID (in chat) with the Client Secret placed in the
```
TEAMS_ENTRA_CLIENT_SECRET
```
env var / secret file (never pasted in chat). Until they do, stop and wait — this is a hard gate; you cannot proceed past it, and you must not report completion around it.
Credentials populated (Salesforce-side, automated by this skill) —
```
MSTeamsSetupClientCredentialsEC
```
reads
```
authenticationStatus: "Configured"
```
and the
```
microsoft_auth_provider
```
Auth Provider is populated with the same values (see
```
references/azure-credential-population.md
```
). Populating only one leaves either outbound Graph or inbound SSO broken.
Admin consent granted — the user has clicked the static consent link in Step 4a item 3, signed in as a Microsoft tenant admin.
Preferred site registered — the Teams extension call in Step 5 returns success (or the user has explicitly deferred the employee-site half).

If any of 2–4 is pending, the correct status is "Blocked on Microsoft-admin action — Teams integration incomplete," with the exact next step called out. A partial state is not a success; do not soften it, and do not let a coordinator mark this feature

Done

Go功能启用（步骤1–3）是必要条件但不充分。最常见的失败模式是在步骤3后就宣称Teams“已配置/已完成/就绪”，而此时Microsoft Entra应用仍未注册——这会导致Teams内登录和出站Graph集成失效。请将Entra应用注册视为完成的阻塞前提条件，而非可选收尾步骤。仅当以下所有项目均已验证（而非仅指导用户执行）时，方可报告完成：

功能已启用——

service-cloud-itsm-teams-integration

状态为

ENABLED

且

ITSMTeamsEnabled

为

true

（步骤1–3）。

Microsoft Entra应用已注册——用户已完成步骤4a的Azure点击操作，并提供了客户端ID和租户ID（聊天中），且客户端密钥已放入
```
TEAMS_ENTRA_CLIENT_SECRET
```
环境变量/密钥文件（绝不在聊天中粘贴）。在此之前，请暂停并等待——这是硬性限制；您无法继续推进，也不得绕过此步骤报告完成。
凭据已填充（Salesforce端，由本技能自动化完成）——
```
MSTeamsSetupClientCredentialsEC
```
显示
```
authenticationStatus: "Configured"
```
且
```
microsoft_auth_provider
```
身份验证提供程序已填充相同的值（参见
```
references/azure-credential-population.md
```
）。仅填充其中一个会导致出站Graph或入站SSO失效。
管理员权限已授予——用户已点击步骤4a第3项中的静态权限链接，并以Microsoft租户管理员身份登录。
首选站点已注册——步骤5中的Teams扩展调用返回成功（或用户已明确延迟员工站点部分的配置）。

如果2–4中的任何一项未完成，正确的状态应为**"等待Microsoft管理员操作——Teams集成未完成"，并明确指出下一步操作。部分完成状态并非**成功；请勿淡化表述，也不得允许协调人员将此功能标记为

Done

。

Disabling (if requested)

禁用功能（如有请求）

text

mcp__headless-360__dispatch(
  method: "POST",
  url:    "/services/data/v67.0/connect/setup/discovery/feature/service-cloud-itsm-teams-integration/disable",
  body:   {}
)

Re-run Step 1/Step 3 afterward to confirm. Disabling

ITSMTeamsEnabled

's underlying provisioning (SSO handler, named/external credentials, PKCE OAuth client) may not be fully reversed by this call alone — verify with the user whether they also need those artifacts removed and treat that as a separate, manual Setup exercise.

text

mcp__headless-360__dispatch(
  method: "POST",
  url:    "/services/data/v67.0/connect/setup/discovery/feature/service-cloud-itsm-teams-integration/disable",
  body:   {}
)

之后重新运行步骤1/步骤3以确认。禁用

ITSMTeamsEnabled

的底层预配（SSO处理程序、命名/外部凭据、PKCE OAuth客户端）可能无法仅通过此调用完全撤销——请与用户确认是否还需要移除这些组件，并将其视为单独的手动Setup操作。

Related, separately-enabled preferences

Gotchas

注意事项

The verified, load-bearing pitfalls (direct-PATCH 401, empty Auth Provider, Azure Web-vs-SPA redirect, Username=UPN handler, portal API-Enabled, static consent link,

MsTeamsAppApiFamily

403 hard gate, version-prefix requirement, and more) are catalogued in

references/gotchas.md

. Read it before reporting a step as failed or retrying an enablement guess.

已验证的关键陷阱（直接PATCH 401错误、空身份验证提供程序、Azure Web与SPA重定向、Username=UPN处理程序、门户API启用、静态权限链接、

MsTeamsAppApiFamily

403硬性限制、版本前缀要求等）已整理在

references/gotchas.md

中。在报告步骤失败或重试启用操作前，请先阅读此文档。

Skill	When to use instead
`service-itsm-teams-itdesk-configure`	The "Set Up Salesforce IT Desk" checklist group (fulfiller side) — this skill delegates to it (see Step 4b)
`service-itsm-teams-itservice-configure`	The "Set Up Salesforce IT Service" checklist group (employee side) — this skill delegates to it (see Step 4b)
`service-itsm-teams-employee-agent-configure`	Making the embedded Agentforce agent reply in the Teams "Ask AI Agent" custom client ( `Teams_AgentForce` MIAW deployment) — this skill delegates to it (see Step 4c)
`service-itsm-swarming-configure`	Enabling the `service-cloud-swarming` Go feature for "Set Teams as Collaboration Tool for Swarming" — invoked by `service-itsm-teams-itdesk-configure` , not by this skill directly
Notification-channel preferences	Enabling the `Notifications` / `TeamsNotifications` preferences is a distinct concern from this feature (no dedicated child skill exists yet)
`experience-portal-create`	Creating the employee-service portal/site itself
`service-itsm-channels-coordinate`	Top-level menu across Teams, Slack, Swarming, Notifications, Portal

技能	替代使用场景
`service-itsm-teams-itdesk-configure`	"设置Salesforce IT服务台"检查清单组（处理人员端）——本技能会将其交由该子技能处理（参见步骤4b）
`service-itsm-teams-itservice-configure`	"设置Salesforce IT服务"检查清单组（员工端）——本技能会将其交由该子技能处理（参见步骤4b）
`service-itsm-teams-employee-agent-configure`	使嵌入式Agentforce代理在Teams“询问AI代理”自定义客户端中回复（ `Teams_AgentForce` MIAW部署）——本技能会将其交由该子技能处理（参见步骤4c）
`service-itsm-swarming-configure`	启用 `service-cloud-swarming` Go功能以“将Teams设置为Swarming协作工具”——由 `service-itsm-teams-itdesk-configure` 调用，而非直接由本技能调用
通知渠道偏好设置	启用 `Notifications` / `TeamsNotifications` 偏好设置是与本功能无关的独立事项（目前尚无专门的子技能）
`experience-portal-create`	创建员工服务门户/站点本身
`service-itsm-channels-coordinate`	Teams、Slack、Swarming、通知、门户的顶级菜单协调

service-itsm-teams-configure

Original

Translation

Enable Microsoft Teams for Employee Service (ITSM)

为员工服务（ITSM）启用Microsoft Teams

Scope

适用范围

The problem this skill solves

本技能解决的问题

Workflow

工作流程

Step 1 — Check current feature status

步骤1 — 检查当前功能状态

Step 2 — Enable the feature

步骤2 — 启用功能

Step 3 — Verify
`ITSMTeamsEnabled`
flipped

步骤3 — 验证
`ITSMTeamsEnabled`
已切换

Step 4 — Report interim status (setup is NOT complete yet)

步骤4 — 报告临时状态（设置尚未完成）

Step 4a — Follow the Go page's own order: Create Entra app → Configure Named Credentials → Grant consent

步骤4a — 遵循Go页面的既定顺序：创建Entra应用 → 配置命名凭据 → 授予权限

Step 4b — Delegate to the IT Desk / IT Service child skills

步骤4b — 交由IT服务台/IT服务子技能处理

Step 4c — Delegate the embedded Agentforce agent (Teams "Ask AI Agent")

步骤4c — 交由嵌入式Agentforce代理（Teams“询问AI代理”）处理

Step 5 — Register the preferred site (Teams extension), once the Azure credential exists

步骤5 — 注册首选站点（Teams扩展），前提是Azure凭据已存在

Completion contract — do NOT report Teams setup "complete" until all of these hold

完成契约——满足以下所有条件前，请勿报告Teams设置“完成”

Disabling (if requested)

禁用功能（如有请求）

Related, separately-enabled preferences

相关的独立启用偏好设置

Gotchas

注意事项

Related Skills

相关技能

service-itsm-teams-configure

Original

Translation

Enable Microsoft Teams for Employee Service (ITSM)

为员工服务（ITSM）启用Microsoft Teams

Scope

适用范围

The problem this skill solves

本技能解决的问题

Workflow

工作流程

Step 1 — Check current feature status

步骤1 — 检查当前功能状态

Step 2 — Enable the feature

步骤2 — 启用功能

Step 3 — Verify ITSMTeamsEnabled flipped

步骤3 — 验证ITSMTeamsEnabled已切换

Step 4 — Report interim status (setup is NOT complete yet)

步骤4 — 报告临时状态（设置尚未完成）

Step 4a — Follow the Go page's own order: Create Entra app → Configure Named Credentials → Grant consent

步骤4a — 遵循Go页面的既定顺序：创建Entra应用 → 配置命名凭据 → 授予权限

Step 4b — Delegate to the IT Desk / IT Service child skills

步骤4b — 交由IT服务台/IT服务子技能处理

Step 4c — Delegate the embedded Agentforce agent (Teams "Ask AI Agent")

步骤4c — 交由嵌入式Agentforce代理（Teams“询问AI代理”）处理

Step 5 — Register the preferred site (Teams extension), once the Azure credential exists

步骤5 — 注册首选站点（Teams扩展），前提是Azure凭据已存在

Completion contract — do NOT report Teams setup "complete" until all of these hold

完成契约——满足以下所有条件前，请勿报告Teams设置“完成”

Disabling (if requested)

禁用功能（如有请求）

Related, separately-enabled preferences

相关的独立启用偏好设置

Gotchas

注意事项

Related Skills

相关技能

Step 3 — Verify
`ITSMTeamsEnabled`
flipped

步骤3 — 验证
`ITSMTeamsEnabled`
已切换