Service Itsm Teams Coordinate

Microsoft Teams for ITSM — End-to-End Setup Autopilot

Drive the complete Microsoft Teams for Employee Service (ITSM) setup as one continuous flow. Delegate each stage to its specialized child skill, but own the sequence yourself and keep going through every stage without stopping to ask permission between stages. Halt only at the points where a human genuinely must act — nowhere else.

Goal

Take the user from nothing to a working Teams ITSM integration (IT Desk + IT Service, Swarming, and — if they want it — the embedded Agentforce agent) in a single guided run. The child skills carry the verified API detail; this skill is the conductor that runs them in order and manages the handoffs.

Core operating rule — run continuously, halt only where required

Do everything with no midway stop unless the user must supply something or perform an off-platform action. Do not re-present a menu between stages, do not ask "shall I continue?" after each stage, and do not ask the user to click Setup toggles this skill's children can do via API. Move straight from one stage to the next, reporting progress as you go.

There are exactly three mandatory halts and one branch in the whole flow:

• HALT 1 — Azure/Entra app (Stage 2): you give the user the app-registration instructions and wait for them to register the app and provide the credentials. No Salesforce API can do this. The Client ID and Tenant ID are non-secret identifiers and may be given in chat; the Client Secret is a confidential credential — NEVER ask for it in the conversation. The agent gives the user one exact copy-paste command that writes the secret to a gitignored secret file (! umask 077; printf '%s' 'PASTE-SECRET' > <secret-file> && echo written) and reads it from that file. Keep the leading ! — it runs the line in this session's Bash so the file persists. The agent never prints, echoes, or logs the value.
• HALT 2 — IT Desk app install (Stage 3): you give the Microsoft Marketplace link and wait for the user to reply "installed". No API installs a Teams app into a tenant catalog.
• HALT 3 — IT Service app install (Stage 4): same as HALT 2, for the IT Service app.
• BRANCH — IT Service Agentforce agent (Stage 7): the IT Desk agent works automatically, but the IT Service embedded agent is pending work; ask the user whether to do it, and only run Stage 8 if they say yes.

If the user goes silent at a halt, stop and wait — do not fabricate the value or skip ahead. Every other transition is automatic.

Within each stage, execute one operation at a time. The child skills make real, state-changing API calls; run a single operation, confirm it succeeded, then proceed — never batch state-changing calls into one parallel block. "No midway stop" means no permission gate between stages, not firing writes in parallel.

The flow (run in this order)

Stage 1 — Enable the Teams for Employee Service Go feature

Invoke `service-itsm-teams-configure` for the feature-enable half only (its Steps 1–3): enable service-cloud-itsm-teams-integration and confirm ITSMTeamsEnabled reads true. Report progress, then continue straight into Stage 2 — do not stop here.

Stage 2 — Microsoft Entra app + Named Credentials ⟶ HALT 1

Still within `service-itsm-teams-configure` (its Step 4a): give the user the exact Azure/Entra app-registration clicks including the Microsoft Graph permissions it lists, and HALT until they provide the credentials. The Client ID and Tenant ID are non-secret identifiers — accept them in chat. The Client Secret is confidential: never request it in the conversation. Give the user one exact copy-paste command that writes it to a gitignored secret file (! umask 077; printf '%s' 'PASTE-SECRET' > <secret-file> && echo written) and read it from that file. Keep the leading ! — it runs the line in this session's Bash so the file persists. Never print or echo it. The moment the identifiers are given and the secret is in the file:

• Write those values into the MSTeamsSetupClientCredentialsEC Named Credential and the microsoft_auth_provider Auth Provider yourself, via API — nothing manual (the child skill's Step 5 and its azure-credential-population reference carry the exact API bodies). Read the secret from the file at call time — do not inline the raw value into any logged text.
• Give the user the static Grant Admin Consent link and register the preferred site (child Step 5).

Then continue to Stage 3 automatically.

Stage 3 — Set up IT Desk (fulfiller side) ⟶ HALT 2

Invoke `service-itsm-teams-itdesk-configure`. Drive its whole checklist:

• Turn on the OrgHasITSMFulfillerTeams org preference (via API).
• Manage User Access — assign the fulfiller permission sets to the confirmed user(s): TeamsForITSrvcsUser + MicrosoftGraphAccess, plus the API Enabled login permission set (commonly Teams_Employee_ApiAccess) — required for login, not optional.
• Turn on Swarming — this stage includes service-itsm-swarming-configure (enables service-cloud-swarming and sets SWARM_COLLABORATION_TOOL = "Teams").
• Give the IT Desk Microsoft Marketplace link + help doc, tell the user the Azure account email must match the Salesforce user's email/Username (SSO resolves MS UPN → Username), and HALT until the user replies "installed." Then continue to Stage 4.

Stage 4 — Set up IT Service (employee side) ⟶ HALT 3

Invoke `service-itsm-teams-itservice-configure`. Drive its whole checklist:

• Turn on the OrgHasEmployeeServiceTeams org preference (via API).
• Manage User Access — assign the employee permission set to the confirmed UEL user(s): TeamsForEmployeeUser (the dialog assigns only this one — not MicrosoftGraphAccess), plus the API Enabled login permission set the child's login prerequisites require.
• Select the Digital Experience Site (SLACK_PREFERRED_SITE) via API.
• Give the IT Service Microsoft Marketplace link + help doc, repeat the email-must-match note, and HALT until the user replies "installed." Then continue to Stage 5.

Stage 5 — Ask the user to verify login

Ask the user to open the IT Desk app in Teams and sign in with the fulfiller credentials, and the IT Service app with the UEL/employee credentials, and confirm both load. If either fails, route to `service-itsm-teams-debug` for the pass/fail login diagnostic before proceeding.

Stage 6 — Tell the user the IT Desk "Ask Agentforce" agent works automatically

Once IT Desk login is confirmed, tell the user that IT Desk's Ask Agentforce works automatically — no further setup is needed on the fulfiller side.

Stage 7 — Offer the IT Service Agentforce agent ⟶ BRANCH

Tell the user the IT Service side has pending work: the embedded Agentforce agent ("Ask AI Agent") does not reply until its messaging channel + Key Set + Embedded Service Deployment are built. Ask whether they want to set it up now (use AskUserQuestion). If no, go to the completion summary. If yes, run Stage 8.

Stage 8 — Build the IT Service embedded agent (only if the user said yes)

Invoke `service-itsm-teams-employee-agent-configure`. It builds — 100% via API — the Web messaging channel with User Verification ON + a `JWKS_URL` Key Set, the Teams_AgentForce Embedded Service Deployment (publish), the routing flow, and the Agent Access permission set on the portal user. Then tell the user to retest from a brand-new Teams chat to confirm the agent replies.

After each stage

• Report the child's ACTUAL verdict — never assume "Done." A stage is complete only when its child skill explicitly reported success. If a child reports blocked (most commonly Stage 2 while