service-itsm-teams-coordinate

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Microsoft Teams for ITSM — End-to-End Setup Autopilot

Microsoft Teams for ITSM — 端到端设置自动编排器

Drive the complete Microsoft Teams for Employee Service (ITSM) setup as one continuous flow. Delegate each stage to its specialized child skill, but own the sequence yourself and keep going through every stage without stopping to ask permission between stages. Halt only at the points where a human genuinely must act — nowhere else.

以连续流程驱动完整的Microsoft Teams for Employee Service（ITSM）设置。将每个阶段委托给对应的专业子技能，但自行掌控流程序列，持续推进每个阶段，不在阶段之间暂停请求许可。仅在确实需要人工操作的节点暂停——其他任何节点都不停止。

Goal

目标

Take the user from nothing to a working Teams ITSM integration (IT Desk + IT Service, Swarming, and — if they want it — the embedded Agentforce agent) in a single guided run. The child skills carry the verified API detail; this skill is the conductor that runs them in order and manages the handoffs.

通过一次引导式运行，帮助用户从无到有完成可用的Teams ITSM集成（IT Desk + IT Service、Swarming，以及——如果用户需要——嵌入式Agentforce代理）。子技能负责处理经过验证的API细节；本技能作为指挥者，按顺序运行子技能并管理阶段交接。

Core operating rule — run continuously, halt only where required

核心运行规则——持续运行，仅在必要时暂停

Do everything with no midway stop unless the user must supply something or perform an off-platform action. Do not re-present a menu between stages, do not ask "shall I continue?" after each stage, and do not ask the user to click Setup toggles this skill's children can do via API. Move straight from one stage to the next, reporting progress as you go.

There are exactly three mandatory halts and one branch in the whole flow:

HALT 1 — Azure/Entra app (Stage 2): you give the user the app-registration instructions and wait for them to register the app and provide the credentials. No Salesforce API can do this. The Client ID and Tenant ID are non-secret identifiers and may be given in chat; the Client Secret is a confidential credential — NEVER ask for it in the conversation. The user places it in the
```
TEAMS_ENTRA_CLIENT_SECRET
```
environment variable (or a gitignored secret file the agent is told the path to); the agent reads it from there and never prints, echoes, or logs it.
HALT 2 — IT Desk app install (Stage 3): you give the Microsoft Marketplace link and wait for the user to reply "installed". No API installs a Teams app into a tenant catalog.
HALT 3 — IT Service app install (Stage 4): same as HALT 2, for the IT Service app.
BRANCH — IT Service Agentforce agent (Stage 7): the IT Desk agent works automatically, but the IT Service embedded agent is pending work; ask the user whether to do it, and only run Stage 8 if they say yes.

If the user goes silent at a halt, stop and wait — do not fabricate the value or skip ahead. Every other transition is automatic.

Within each stage, execute one operation at a time. The child skills make real, state-changing API calls; run a single operation, confirm it succeeded, then proceed — never batch state-changing calls into one parallel block. "No midway stop" means no permission gate between stages, not firing writes in parallel.

除非用户必须提供信息或执行平台外操作，否则全程无中途停顿。不要在阶段之间重新展示菜单，不要在每个阶段结束后询问“是否继续？”，不要让用户点击本技能子技能可通过API完成的设置开关。直接从一个阶段推进到下一个阶段，并随时报告进度。

整个流程中共有3个强制暂停点和1个分支节点：

暂停点1 — Azure/Entra应用（阶段2）：向用户提供应用注册说明，等待用户完成应用注册并提供凭据。Salesforce API无法完成此操作。Client ID和Tenant ID是非保密标识符，可在聊天中接收；Client Secret是机密凭据——切勿在对话中索要。用户需将其存入
```
TEAMS_ENTRA_CLIENT_SECRET
```
环境变量（或代理已知路径的git忽略机密文件）；代理从该位置读取，绝不打印、回显或记录该值。
暂停点2 — IT Desk应用安装（阶段3）：向用户提供Microsoft Marketplace链接，等待用户回复**“已安装”**。没有API可以将Teams应用安装到租户目录中。
暂停点3 — IT Service应用安装（阶段4）：与暂停点2相同，针对IT Service应用。
分支节点 — IT Service Agentforce代理（阶段7）：IT Desk代理可自动运行，但IT Service嵌入式代理仍需后续配置；询问用户是否要现在进行设置，仅当用户同意时才运行阶段8。

如果用户在暂停点沉默，则停止等待——切勿编造值或跳过该步骤。其他所有阶段过渡均自动完成。

在每个阶段内，一次执行一个操作。子技能会进行真实的、改变状态的API调用；执行单个操作，确认成功后再继续——切勿将改变状态的调用批量并行执行。“无中途停顿”指的是阶段之间无权限验证关卡，而非并行触发写入操作。

The flow (run in this order)

流程（按以下顺序运行）

Stage 1 — Enable the Teams for Employee Service Go feature

阶段1 — 启用Teams for Employee Service Go功能

Invoke service-itsm-teams-configure
for the feature-enable half only (its Steps 1–3): enable

service-cloud-itsm-teams-integration

and confirm

ITSMTeamsEnabled

reads

true

. Report progress, then continue straight into Stage 2 — do not stop here.

调用**

service-itsm-teams-configure

**仅执行功能启用部分（其步骤1–3）：启用

service-cloud-itsm-teams-integration

并确认

ITSMTeamsEnabled

的值为

true

。报告进度后，直接进入阶段2——不要在此处暂停。

Stage 2 — Microsoft Entra app + Named Credentials ⟶ HALT 1

阶段2 — Microsoft Entra应用 + Named Credentials ⟶ 暂停点1

Still within service-itsm-teams-configure
(its Step 4a): give the user the exact Azure/Entra app-registration clicks including the Microsoft Graph Application permissions it lists, and HALT until they provide the credentials. The Client ID and Tenant ID are non-secret identifiers — accept them in chat. The Client Secret is confidential: never request it in the conversation. Instruct the user to set it in the

TEAMS_ENTRA_CLIENT_SECRET

environment variable (or a gitignored secret file, and tell you the path); read it from there. Never print or echo it. The moment the identifiers are given and the secret is in the env/file:

Write those values into the
```
MSTeamsSetupClientCredentialsEC
```
Named Credential and the
```
microsoft_auth_provider
```
Auth Provider yourself, via API — nothing manual (the child skill's Step 5 and its azure-credential-population reference carry the exact API bodies). Reference the secret by its env var / file path in the API call — do not inline the raw value into any logged text.
Give the user the static Grant Admin Consent link and register the preferred site (child Step 5). Then continue to Stage 3 automatically.

仍在**

service-itsm-teams-configure

中（其步骤4a）：向用户提供确切的Azure/Entra应用注册操作步骤包括Microsoft Graph应用权限**，并暂停直至用户提供凭据。Client ID和Tenant ID是非保密标识符——可在聊天中接收。Client Secret是机密信息：切勿在对话中请求。指导用户将其设置到

TEAMS_ENTRA_CLIENT_SECRET

环境变量（或git忽略的机密文件，并告知代理路径）；从该位置读取该值。绝不打印或回显该值。一旦用户提供标识符且机密信息已存入环境变量/文件：

通过API将这些值写入
```
MSTeamsSetupClientCredentialsEC
```
Named Credential 以及
```
microsoft_auth_provider
```
Auth Provider——全程无需手动操作（子技能的步骤5及其Azure凭据填充参考文档包含确切的API请求体）。在API调用中通过环境变量/文件路径引用机密信息——切勿将原始值内联到任何日志文本中。
向用户提供静态的Grant Admin Consent链接并注册首选站点（子技能步骤5）。然后自动推进到阶段3。

Stage 3 — Set up IT Desk (fulfiller side) ⟶ HALT 2

阶段3 — 设置IT Desk（执行者端） ⟶ 暂停点2

Invoke service-itsm-teams-itdesk-configure
. Drive its whole checklist:

Turn on the
```
OrgHasITSMFulfillerTeams
```
org preference (via API).
Manage User Access — assign the fulfiller permission sets to the confirmed user(s):
```
TeamsForITSrvcsUser
```
+
```
MicrosoftGraphAccess
```
, plus
Teams_Employee_ApiAccess
(the ECA- pre-authorized set that also grants API Enabled — required for login, not optional).

Turn on Swarming — this stage includes

service-itsm-swarming-configure

(enables

service-cloud-swarming

and sets

SWARM_COLLABORATION_TOOL = "Teams"

Give the IT Desk Microsoft Marketplace link + help doc, tell the user the Azure account email must match the Salesforce user's email/Username (SSO resolves MS UPN →
```
Username
```
), and HALT until the user replies "installed." Then continue to Stage 4.

调用**

service-itsm-teams-itdesk-configure

**。完成其整个检查表：

通过API开启
```
OrgHasITSMFulfillerTeams
```
组织偏好设置。
管理用户访问权限——为确认的用户分配执行者权限集：
```
TeamsForITSrvcsUser
```
+
```
MicrosoftGraphAccess
```
，以及
Teams_Employee_ApiAccess
（ECA预授权权限集，同时授予API Enabled——登录必需，不可选）。

开启Swarming——此阶段包含

service-itsm-swarming-configure

（启用

service-cloud-swarming

并设置

SWARM_COLLABORATION_TOOL = "Teams"

）。

提供IT Desk Microsoft Marketplace链接 + 帮助文档，告知用户Azure账户邮箱必须与Salesforce用户的邮箱/用户名匹配（SSO将MS UPN解析为
```
Username
```
），并暂停直至用户回复**“已安装”**。然后推进到阶段4。

Stage 4 — Set up IT Service (employee side) ⟶ HALT 3

阶段4 — 设置IT Service（员工端） ⟶ 暂停点3

Invoke service-itsm-teams-itservice-configure
. Drive its whole checklist:

Turn on the
```
OrgHasEmployeeServiceTeams
```
org preference (via API).
Manage User Access — assign the employee permission sets to the confirmed UEL user(s):
```
TeamsForEmployeeUser
```
+
```
MicrosoftGraphAccess
```
, plus the API Enabled + ECA-authorized access the child's login prerequisites require.
Select the Digital Experience Site (
```
SLACK_PREFERRED_SITE
```
) via API.
Give the IT Service Microsoft Marketplace link + help doc, repeat the email-must-match note, and HALT until the user replies "installed." Then continue to Stage 5.

调用**

service-itsm-teams-itservice-configure

**。完成其整个检查表：

通过API开启
```
OrgHasEmployeeServiceTeams
```
组织偏好设置。
管理用户访问权限——为确认的UEL用户分配员工权限集：
```
TeamsForEmployeeUser
```
+
```
MicrosoftGraphAccess
```
，以及子技能登录前提所需的API Enabled + ECA授权访问权限。
通过API选择Digital Experience站点（
```
SLACK_PREFERRED_SITE
```
）。
提供IT Service Microsoft Marketplace链接 + 帮助文档，重复邮箱必须匹配的提示，并暂停直至用户回复**“已安装”**。然后推进到阶段5。

Stage 5 — Ask the user to verify login

阶段5 — 请用户验证登录

Ask the user to open the IT Desk app in Teams and sign in with the fulfiller credentials, and the IT Service app with the UEL/employee credentials, and confirm both load. If either fails, route to service-itsm-teams-debug
for the pass/fail login diagnostic before proceeding.

请用户在Teams中打开IT Desk应用并使用执行者凭据登录，打开IT Service应用并使用UEL/员工凭据登录，确认两者均可加载。如果任一登录失败，引导至**

service-itsm-teams-debug

**进行登录诊断，然后再继续。

Stage 6 — Tell the user the IT Desk "Ask Agentforce" agent works automatically

阶段6 — 告知用户IT Desk的“Ask Agentforce”代理可自动运行

Once IT Desk login is confirmed, tell the user that IT Desk's Ask Agentforce works automatically — no further setup is needed on the fulfiller side.

确认IT Desk登录成功后，告知用户IT Desk的Ask Agentforce可自动运行——执行者端无需进一步设置。

Stage 7 — Offer the IT Service Agentforce agent ⟶ BRANCH

阶段7 — 提供IT Service Agentforce代理设置选项 ⟶ 分支节点

Tell the user the IT Service side has pending work: the embedded Agentforce agent ("Ask AI Agent") does not reply until its messaging channel + Key Set + Embedded Service Deployment are built. Ask whether they want to set it up now (use

AskUserQuestion

). If no, go to the completion summary. If yes, run Stage 8.

告知用户IT Service端仍有未完成的工作：嵌入式Agentforce代理（“Ask AI Agent”）在构建其消息通道 + Key Set + Embedded Service Deployment之前无法回复。询问用户是否要现在进行设置（使用

AskUserQuestion

）。如果用户选择否，进入完成总结环节。如果用户选择是，运行阶段8。

Stage 8 — Build the IT Service embedded agent (only if the user said yes)

阶段8 — 构建IT Service嵌入式代理（仅当用户同意时）

Invoke service-itsm-teams-employee-agent-configure
. It builds — 100% via API — the Web messaging channel with User Verification ON + a
JWKS_URL
Key Set, the

Teams_AgentForce

Embedded Service Deployment (publish), the routing flow, and the Agent Access permission set on the portal user. Then tell the user to retest from a brand-new Teams chat to confirm the agent replies.

调用**

service-itsm-teams-employee-agent-configure

。它将通过API 100%自动构建：开启用户验证的Web消息通道 +
JWKS_URL
Key Set、
Teams_AgentForce
Embedded Service Deployment（发布）、路由流，以及为门户用户分配Agent Access权限集。然后告知用户从全新的Teams聊天**重新测试，确认代理可回复。

After each stage

每个阶段结束后

Report the child's ACTUAL verdict — never assume "Done." A stage is complete only when its child skill explicitly reported success. If a child reports blocked (most commonly Stage 2 while the Entra app is unregistered, or a halt awaiting "installed"), keep that stage Blocked
/waiting and hold at the halt — do not mark it done and do not skip ahead.
Do not re-present a menu. State what just finished and what you're doing next, then do it.

报告子技能的实际结果——切勿假设“已完成”。只有当子技能明确报告成功时，阶段才算完成。如果子技能报告受阻（最常见于阶段2的Entra应用未注册，或等待“已安装”回复的暂停点），则保持该阶段为**“受阻”/等待状态**，停留在暂停点——切勿标记为已完成或跳过。
不要重新展示菜单。说明刚刚完成的内容和下一步要执行的操作，然后直接执行。

Completion summary

完成总结

When the flow ends (Stage 7 "no", or Stage 8 done, or a hard block the user chose not to resolve), summarize each stage's real status. Header: all stages complete → Complete; any stage still blocked/waiting → Incomplete (action required) with the exact next step; otherwise Finished.

当流程结束时（阶段7用户选择“否”、阶段8完成，或用户选择不解决的严重阻塞），总结每个阶段的实际状态。标题：所有阶段完成 → 已完成；任何阶段仍处于受阻/等待状态 → **未完成（需执行操作）**并说明确切的下一步；否则为 已完成。

Rules

规则

ALWAYS show "(via service-itsm-teams-coordinate)" in the setup header.
Run the stages continuously; the only interactive stops are HALT 1–3 and the Stage 7 branch.
NEVER ask the user to click a Setup toggle a child skill can flip via API (feature enable, org prefs, permission-set assignment, digital site, named credentials).
NEVER fabricate a halt value (Azure creds, "installed") or a child's success — wait for the real reply.
Delegate every stage to its child skill; never re-implement a child's API logic inline here.
Track progress across the conversation — do not re-run a completed stage.
Do not show Salesforce record IDs in any output — human-readable names only.
At Stages 3 and 4, always include the Azure-email-must-match-Salesforce-email note with the marketplace link, since a mismatch is a common silent login failure.

始终在设置标题中显示“(via service-itsm-teams-coordinate)”。
持续运行各个阶段；仅有的交互式停顿为暂停点1–3和阶段7的分支节点。
切勿让用户点击子技能可通过API切换的设置开关（功能启用、组织偏好、权限集分配、数字化站点、命名凭据）。
切勿编造暂停点的值（Azure凭据、“已安装”）或子技能的成功状态——等待真实回复。
将每个阶段委托给对应的子技能；切勿在此处重新实现子技能的API逻辑。
在对话中跟踪进度——不要重新运行已完成的阶段。
输出中不要显示Salesforce记录ID——仅使用人类可读的名称。
在阶段3和阶段4中，始终随Marketplace链接一起包含Azure邮箱必须与Salesforce邮箱匹配的提示，因为邮箱不匹配是常见的静默登录失败原因。

Verification checklist

验证检查表

Before emitting any progress message or summary, confirm:

The header line ends with
```
(via service-itsm-teams-coordinate)
```
.
The flow is running continuously — no permission gate was inserted between stages beyond the three defined halts and the Stage 7 branch.
Each stage's status reflects the child's actual verdict (
```
In progress
```
,
```
Blocked
```
/waiting, or
```
Done
```
) — not a hard-coded default.
A stage waiting on a halt (Azure creds, "installed") is shown as waiting, never
```
Done
```
.
Stages 3 and 4 each surfaced the marketplace link and the email-must-match note.
The Stage 7 branch was offered as a yes/no question, and Stage 8 ran only on an explicit "yes."
The next action delegates to a child skill; features are never configured inline here.
No Salesforce record IDs appear in the output — human-readable names only.

在发送任何进度消息或总结之前，确认：

标题行末尾包含
```
(via service-itsm-teams-coordinate)
```
。
流程持续运行——除了三个定义的暂停点和阶段7的分支节点外，阶段之间未插入权限验证关卡。
每个阶段的状态反映子技能的实际结果（“进行中”、“受阻”/等待、或“已完成”）——而非硬编码的默认值。
等待暂停点（Azure凭据、“已安装”）的阶段显示为等待状态，而非“已完成”。
阶段3和阶段4均提供了Marketplace链接以及邮箱必须匹配的提示。
阶段7的分支节点以是非问题形式呈现，且仅在用户明确回复“是”时才运行阶段8。
下一步操作委托给子技能；从未在此处内联配置功能。
输出中未显示Salesforce记录ID——仅使用人类可读的名称。

Reference File Index

参考文件索引

File	When to read
`examples/output-templates.md`	Progress and completion-summary text blocks

文件	阅读时机
`examples/output-templates.md`	进度和完成总结文本块