Service Itsm Teams Configure

Enable Microsoft Teams for Employee Service (ITSM)

Enable the Salesforce Go feature "Microsoft Teams for Employee Service" (service-cloud-itsm-teams-integration) — the feature that lets IT Desk and IT Service agents track tickets, request catalog items, and get Agentforce assistance from inside Microsoft Teams. Every operation dispatches through headless-360.

Execute one step at a time. These steps make real, state-changing API calls. Run a single operation, show its result, confirm it succeeded, then proceed — do not batch multiple setup calls into one parallel block.

Scope

• In scope: Enabling the service-cloud-itsm-teams-integration Go feature via its feature-enablement Connect API; verifying feature and ITSMTeamsEnabled preference state afterward; explaining why the direct org-preference PATCH route fails and why this route works instead; disabling the feature if requested; giving the user step-by-step instructions for the Azure/Entra app registration (Step 4a) since no Salesforce API can perform that part; once the user provides the resulting Client ID/Tenant ID (in chat) and the Client Secret (written to a gitignored secret file via the copy-paste command in Step 4a, never in chat), writing them directly into the MSTeamsSetupClientCredentialsEC Named Credential via API — this Salesforce-side write is always automated by this skill, never deferred back to the user; registering the Experience Cloud site as the Teams "preferred site" extension via /connect/service-itsm-teams/graph-api/extensions once that credential exists.
• Out of scope: Notification-channel preferences (Notifications, TeamsNotifications) — a separate concern from this feature. Enabling the service-cloud-swarming Go feature itself — delegate to service-itsm-swarming-configure. The IT Desk/fulfiller checklist group (Turn on IT Desk, Install IT Desk app, Manage User Access, Set Teams as Collaboration Tool for Swarming) — delegate to service-itsm-teams-itdesk-configure. The IT Service/employee checklist group (Turn on IT Service, Install IT Service app, Manage User Access, Select a Digital Experience Site) — delegate to service-itsm-teams-itservice-configure. Portal/site creation — use experience-portal-create. The actual Azure-side actions (clicking through the Azure portal, generating the client secret, granting Microsoft admin consent) must be performed by the user in the Microsoft admin center — no Salesforce API reaches Azure/Entra — but this skill still provides the exact instructions for those steps (see Gotchas and Step 4a) rather than treating them as someone else's problem.

The problem this skill solves

ITSMTeamsEnabled is the Salesforce Go page toggle preference gating Microsoft Teams ITSM integration. Its UDD definition (ServiceItsmTeams.settings.xml) declares orgAccess="always" but has no `editAccess` attribute — unlike working preferences such as Notifications/TeamsNotifications, which explicitly set editAccess="always". As a result, the direct Setup preferences Connect API route is blocked:

GET  /services/data/vXX.0/setup/org/preferences/ITSMTeamsEnabled
PATCH /services/data/vXX.0/setup/org/preferences/ITSMTeamsEnabled  body: {"desiredState": true}

Both return 401:

{"error_code":"API_ERROR","status_code":401,"body":"[{\"errorCode\":\"INSUFFICIENT_ACCESS\",\"message\":\"Cannot read data!\"}]"}

("Cannot update preference value!" on the PATCH). This is a real, code-level access gate (StandardMetadataChecker in setup-connect-impl relays an Aura NoAccessException — "bit(s) do not have READ/WRITE access" — for this preference specifically), not a version-prefix or routing mistake. Do not retry this route with different API versions or bodies.

*The verified working path is different: enable the Go feature, not the preference directly.* The Salesforce Go feature-enablement Connect API sits behind a different access check and, on enable, flips ITSMTeamsEnabled (and related feature state) as a side effect.

Workflow

Step 1 — Check current feature status

mcp__headless-360__dispatch(
  method: "POST",
  url:    "/services/data/v67.0/connect/setup/discovery/features/status",
  body:   { "featureApiNames": ["service-cloud-itsm-teams-integration"] }
)

Response shape:

{
  "items": [
    {
      "apiName": "service-cloud-itsm-teams-integration",
      "status": "ENABLED",          // or "NOT_ENABLED" / "DISABLED"
      "blockedByApexLock": false,
      "dependencyStatuses": [],
      "enableBlockedReasons": [],
      "disableBlockedReasons": []
    }
  ]
}

If status is already "ENABLED", skip to Step 3 (verification) — do not re-enable. If enableBlockedReasons is non-empty, surface those reasons to the user (typically a missing license/add-on) before attempting Step 2.

Step 2 — Enable the feature

mcp__headless-360__dispatch(
  method: "POST",
  url:    "/services/data/v67.0/connect/setup/discovery/feature/service-cloud-itsm-teams-integration/enable",
  body:   {}
)

Known gotcha (verified): this call can return 500 INTERNAL_ERROR even when the feature successfully ends up ENABLED. Do not treat a 500 here as a hard failure — always re-run Step 1 (features/status) and Step 3 (ITSMTeamsEnabled read) afterward to check actual state before reporting failure to the user. If status still shows NOT_ENABLED after retrying once, then report the failure with the raw error.

Step 3 — Verify ITSMTeamsEnabled flipped

mcp__headless-360__dispatch_readonly(
  method: "GET",
  url:    "/services/data/v67.0/setup/org/preferences/ITSMTeamsEnabled"
)

Expect 200 {"isPreferenceEnabled": true}. This confirms the underlying preference — otherwise inaccessible via direct PATCH — is now enabled as a side effect of the feature enable.

Step 4 — Report interim status (setup is NOT complete yet)

Report feature status and whether ITSMTeamsEnabled reads true — but frame this as progress, not completion. Enabling the Go feature is only the first half; the integration is not functional until the Microsoft Entra app is registered, its credentials are written into the Named Credential + Auth Provider, and admin consent is granted (Step 4a). Do not mark Teams "Done"/"complete" or hand back to a coordinator as done. State plainly: "The Salesforce feature is enabled; Teams integration is not yet complete — the Microsoft Entra app registration comes next." Then proceed into Step 4a. See the Completion contract below for what "complete" requires.

Step 4a — Follow the Go page's own order: Create Entra app → Configure Named Credentials → Grant consent

The Salesforce Go feature page (Setup → Salesforce Go → this feature, .../lightning/setup/page/feature/service-cloud-itsm-teams-integration/home?topic=SalesforceGo) renders a "Complete the Required Steps" → "Integrate Salesforce with Teams" checklist with exactly three items, in this order — verified from a live screenshot of the page. Follow this order; do not skip ahead to Named Credentials before the Entra app exists, and do not treat "Grant Azure Administrator Consent" as optional:

1. Create Microsoft Entra ID App ("Set Up Microsoft Entra ID App" button — opens portal.azure.com). There is no Salesforce API for this sub-step; give the user these exact clicks and wait for them to provide the resulting values:

• portal.azure.com → Microsoft Entra ID → App registrations → New registration. Name it something identifiable (e.g. Salesforce ITSM Teams Integration); single-tenant is fine unless the user's org spans multiple tenants. Leave the redirect URI blank at creation — the Delegated Graph permissions below require one, but it's added later as the Auth Provider