End-to-end autopilot orchestrator for setting up Microsoft Teams integration in Salesforce Service Cloud ITSM — runs the whole flow (enable the Teams for Employee Service Go feature, register the Microsoft Entra app, populate Named Credentials, configure the IT Desk and IT Service checklists, turn o

Microsoft Teams for ITSM — End to End Setup Autopilot Drive the complete Microsoft Teams for Employee Service (ITSM) setup as one continuous flow. Delegate each stage to its specialized child skill, but own the sequence yourself and keep going through every stage without stopping to ask permission between stages . Halt only at the points where a human genuinely must act — nowhere else. Goal Take the user from nothing to a working Teams ITSM integration (IT Desk + IT Service, Swarming, and — if they want it — the embedded Agentforce agent) in a single guided run. The child skills carry the verified API detail; this skill is the conductor that runs them in order and manages the handoffs. Core operating rule — run continuously, halt only where required Do everything with no midway stop unless the user must supply something or perform an off platform action. Do not re present a menu between stages, do not ask "shall I continue?" after each stage, and do not ask the user to click Setup toggles this skill's children can do via API. Move straight from one stage to the next, reporting progress as you go. There are exactly three mandatory halts and one branch in the whole flow: HALT 1 — Azure/Entra app (Stage 2): you give the user the app registration instructions and wait for them to register the app and provide the credentials. No Salesforce API can do this. The Client ID and Tenant ID are non secret identifiers and may be given in chat; the Client Secret is a confidential credential — NEVER ask for it in the conversation. The agent gives the user one exact copy paste command that writes the secret to a gitignored secret file ( ! umask 077; printf '%s' 'PASTE SECRET' <secret file && echo written ) and reads it from that file. Keep the leading ! — it runs the line in this session's Bash so the file persists. The agent never prints, echoes, or logs the value. HALT 2 — IT Desk app install (Stage 3): you give the Microsoft Marketplace link and wait for the user to reply "installed" . No API installs a Teams app into a tenant catalog. HALT 3 — IT Service app install (Stage 4): same as HALT 2, for the IT Service app. BRANCH — IT Service Agentforce agent (Stage 7): the IT Desk agent works automatically, but the IT Service embedded agent is pending work; ask the user whether to do it , and only run Stage 8 if they say yes. If the user goes silent at a halt, stop and wait — do not fabricate the value or skip ahead. Every other transition is automatic. Within each stage, execute one operation at a time. The child skills make real, state changing API calls; run a single operation, confirm it succeeded, then proceed — never batch state changing calls into one parallel block. "No midway stop" means no permission gate between stages, not firing writes in parallel. The flow (run in this order) Stage 1 — Enable the Teams for Employee Service Go feature Invoke service itsm teams configure for the feature enable half only (its Steps 1–3): enable service cloud itsm teams integration and confirm ITSMTeamsEnabled reads true . Report progress, then continue straight into Stage 2 — do not stop here. Stage 2 — Microsoft Entra app + Named Credentials ⟶ HALT 1 Still within service itsm teams configure (its Step 4a): give the user the exact Azure/Entra app registration clicks including the Microsoft Graph permissions it lists, and HALT until they provide the credentials. The Client ID and Tenant ID are non secret identifiers — accept them in chat. The Client Secret is confidential: never request it in the conversation. Give the user one exact copy paste command that writes it to a gitignored secret file ( ! umask 077; printf '%s' 'PASTE SECRET' <secret file && echo written ) and read it from that file. Keep the leading ! — it runs the line in this session's Bash so the file persists. Never print or echo it. The moment the identifiers are given and the secret is in the file: Write those values into the MSTeamsSetupClientCredentialsEC Named Credential and the microsoft auth provider Auth Provider yourself, via API — nothing manual (the child skill's Step 5 and its azure credential population reference carry the exact API bodies). Read the secret from the file at call time — do not inline the raw value into any logged text. Give the user the static Grant Admin Consent link and register the preferred site (child Step 5). Then continue to Stage 3 automatically. Stage 3 — Set up IT Desk (fulfiller side) ⟶ HALT 2 Invoke service itsm teams itdesk configure . Drive its whole checklist: Turn on the OrgHasITSMFulfillerTeams org preference (via API). Manage User Access — assign the fulfiller permission sets to the confirmed user(s): TeamsForITSrvcsUser + MicrosoftGraphAccess , plus the API Enabled login permission set (commonly Teams Employee ApiAccess ) — required for login, not optional. Turn on Swarming — this stage includes service itsm swarming configure (enables service cloud swarming and sets SWARM COLLABORATION TOOL = "Teams" ). Give the IT Desk Microsoft Marketplace link + help doc, tell the user the Azure account email must match the Salesforce user's email/Username (SSO resolves MS UPN → Username ), and HALT until the user replies "installed." Then continue to Stage 4. Stage 4 — Set up IT Service (employee side) ⟶ HALT 3 Invoke service itsm teams itservice configure . Drive its whole checklist: Turn on the OrgHasEmployeeServiceTeams org preference (via API). Manage User Access — assign the employee permission set to the confirmed UEL user(s): TeamsForEmployeeUser (the dialog assigns only this one — not MicrosoftGraphAccess ), plus the API Enabled login permission set the child's login prerequisites require. Select the Digital Experience Site ( SLACK PREFERRED SITE ) via API. Give the IT Service Microsoft Marketplace link + help doc, repeat the email must match note, and HALT until the user replies "installed." Then continue to Stage 5. Stage 5 — Ask the user to verify login Ask the user to open the IT Desk app in Teams and sign in with the fulfiller credentials, and the IT Service app with the UEL/employee credentials, and confirm both load. If either fails, route to service itsm teams debug for the pass/fail login diagnostic before proceeding. Stage 6 — Tell the user the IT Desk "Ask Agentforce" agent works automatically Once IT Desk login is confirmed, tell the user that IT Desk's Ask Agentforce works automatically — no further setup is needed on the fulfiller side. Stage 7 — Offer the IT Service Agentforce agent ⟶ BRANCH Tell the user the IT Service side has pending work: the embedded Agentforce agent ("Ask AI Agent") does not reply until its messaging channel + Key Set + Embedded Service Deployment are built. Ask whether they want to set it up now (use AskUserQuestion ). If no , go to the completion summary. If yes , run Stage 8. Stage 8 — Build the IT Service embedded agent (only if the user said yes) Invoke service itsm teams employee agent configure . It builds — 100% via API — the Web messaging channel with User Verification ON + a JWKS URL Key Set , the Teams AgentForce Embedded Service Deployment (publish), the routing flow, and the Agent Access permission set on the portal user. Then tell the user to retest from a brand new Teams chat to confirm the agent replies. After each stage Report the child's ACTUAL verdict — never assume "Done." A stage is complete only when its child skill explicitly reported success. If a child reports blocked (most commonly Stage 2 while the Entra app is unregistered, or a halt awaiting "installed"), keep that stage Blocked /waiting and hold at the halt — do not mark it done and do not skip ahead. Do not re present a menu. State what just finished and what you're doing next, then do it. Keep the report tight — summarize, don't transcribe. Report each stage as a one line status in the stage progress table plus at most a short sentence of context; do not paste the child skill's API request/response bodies, tool call logs, or step by step internals into the report — that detail lives in the child skill, and re narrating it here is the single biggest source of a bloated, low signal report. The reader needs what happened and what's next , not a replay of every call. Completion summary When the flow ends (Stage 7 "no", or Stage 8 done, or a hard block the user chose not to resolve), summarize each stage's real status. Header: all stages complete → Complete ; any stage still blocked/waiting → Incomplete (action required) with the exact next step; otherwise Finished . Rules ALWAYS show "(via service itsm teams coordinate)" in the setup header. Run the stages continuously ; the only interactive stops are HALT 1–3 and the Stage 7 branch. NEVER ask the user to click a Setup toggle a child skill can flip via API (feature enable, org prefs, permission set assignment, digital site, named credentials). NEVER fabricate a halt value (Azure creds, "installed") or a child's success — wait for the real reply. Delegate every stage to its child skill; never re implement a child's API logic inline here. Track progress across the conversation — do not re run a completed stage. Do not show Salesforce record IDs in any output — human readable names only. At Stages 3 and 4, always include the Azure email must match Salesforce email note with the marketplace link, since a mismatch is a common silent login failure. Verification checklist Before emitting any progress message or summary, confirm: [ ] The header line ends with (via service itsm teams coordinate) . [ ] The flow is running continuously — no permission gate was inserted between stages beyond the three defined halts and the Stage 7 branch. [ ] Each stage's status reflects the child's actual verdict ( In progress , Blocked /waiting, or Done ) — not a hard coded default. [ ] A stage waiting on a halt (Azure creds, "installed") is shown as waiting, never Done . [ ] Stages 3 and 4 each surfaced the marketplace link and the email must match note. [ ] The Stage 7 branch was offered as a yes/no question, and Stage 8 ran only on an explicit "yes." [ ] The next action delegates to a child skill; features are never configured inline here. [ ] No Salesforce record IDs appear in the output — human readable names only. Reference File Index File When to read examples/output templates.md Progress and completion summary text blocks

service-itsm-teams-coordinate