Back to Details

service-itsm-teams-itdesk-configure

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Set Up Salesforce IT Desk (Microsoft Teams)

设置Salesforce IT Desk（Microsoft Teams）

Complete the "Set Up Salesforce IT Desk" checklist group on the Teams ITSM Go page (
service-cloud-itsm-teams-integration
's feature page) — the fulfiller/agent side of Teams ITSM integration, for IT agents to swarm on and resolve tickets from Teams. Every operation dispatches through headless-360.
完成Teams ITSM Go页面（
service-cloud-itsm-teams-integration
的功能页面）上的**「设置Salesforce IT Desk」清单组——这是Teams ITSM集成的处理人员/代理端，供IT代理在Teams上协作处理并解决工单。所有操作均通过headless-360**调度。

Scope

范围

  • In scope: Turning on the 
    OrgHasITSMFulfillerTeams
    preference; giving the user the exact Teams marketplace link + help doc for the IT Desk app install; assigning 
    TeamsForITSrvcsUser
    /
    MicrosoftGraphAccess
    permission sets to confirmed users; delegating "Set Teams as Collaboration Tool for Swarming" to 
    service-itsm-swarming-configure
    .
  • Out of scope: The base Teams Salesforce Go page toggle (
    ITSMTeamsEnabled
    ), Azure/Entra app registration, Named Credential population, and Teams extension/preferred-site registration — use 
    service-itsm-teams-configure
    (a prerequisite for this skill). The IT Service/employee half of the checklist — use 
    service-itsm-teams-itservice-configure
    . Enabling the 
    service-cloud-swarming
    Go feature itself — delegate to 
    service-itsm-swarming-configure
    .
Prerequisite: run 
service-itsm-teams-configure
first (or alongside) — this skill assumes the 
service-cloud-itsm-teams-integration
Go feature is already enabled.
Execute one step at a time. These steps make real, state-changing API calls. Run a single operation, show its result, confirm it succeeded, then proceed — do not batch multiple setup calls into one parallel block.
  • 包含内容：开启
    OrgHasITSMFulfillerTeams
    偏好设置；为用户提供IT Desk应用安装对应的Teams市场链接+帮助文档；为确认的用户分配
    TeamsForITSrvcsUser
    /
    MicrosoftGraphAccess
    权限集；将「设置Teams为Swarming协作工具」任务委托给
    service-itsm-swarming-configure
    。
  • 排除内容：基础Teams Salesforce Go页面切换（
    ITSMTeamsEnabled
    ）、Azure/Entra应用注册、命名凭证填充以及Teams扩展/首选站点注册——请使用
    service-itsm-teams-configure
    （本技能的前置条件）。清单中的IT服务/员工端部分——请使用
    service-itsm-teams-itservice-configure
    。启用
    service-cloud-swarming
    Go功能本身——委托给
    service-itsm-swarming-configure
    。
前置条件：先运行
service-itsm-teams-configure
（或同时运行）——本技能假设
service-cloud-itsm-teams-integration
Go功能已启用。
请分步执行。这些步骤会进行真实的、改变系统状态的API调用。执行单个操作，展示结果，确认成功后再继续——请勿将多个设置调用批量放入一个并行块中。

Workflow

工作流程

Step 1 — Turn on Salesforce IT Desk

步骤1 — 开启Salesforce IT Desk

This is a straight org-preference toggle (unlike 
ITSMTeamsEnabled
, this one supports direct 
PATCH
) — enable it yourself via API, do not ask the user to click the Setup toggle:
text
mcp__headless-360__dispatch(
  method: "PATCH",
  url:    "/services/data/v67.0/setup/org/preferences/OrgHasITSMFulfillerTeams",
  body:   { "desiredState": true }
)
Expect 
200 {"isPreferenceEnabled": true}
. Tell the user it's enabled — do not ask them to flip the toggle themselves.
这是一个直接的组织偏好设置开关（与
ITSMTeamsEnabled
不同，此开关支持直接
PATCH
）——请通过API自行启用，无需让用户点击设置开关：
text
mcp__headless-360__dispatch(
  method: "PATCH",
  url:    "/services/data/v67.0/setup/org/preferences/OrgHasITSMFulfillerTeams",
  body:   { "desiredState": true }
)
预期返回
200 {"isPreferenceEnabled": true}
。告知用户已启用——无需让用户自行切换开关。

Step 2 — Install Salesforce IT Desk App on Teams (user's responsibility)

步骤2 — 在Teams上安装Salesforce IT Desk应用（用户负责）

There is no Salesforce or Microsoft API this skill can call to install a Teams app into a tenant's app catalog — this always requires a human clicking "Add" in the Microsoft Teams admin center / AppSource, signed in with sufficient tenant permissions. Give the user the exact marketplace link and help doc; do not attempt to automate this step.
  • Marketplace (verified live from the Go page's "Go to Microsoft Marketplace" button):
    text
    https://marketplace.microsoft.com/en-us/product/teams-app/WA200009869?tab=Overview
  • Help doc: 
    https://help.salesforce.com/s/articleView?id=service.it_srvce_msteams_cnfig_fulfilerhub_app.htm&type=5
Print both together so the user has a self-service reference alongside the install link. Also tell the user that the Azure/Microsoft account email the fulfiller signs into Teams with must match that Salesforce user's email / 
Username
 — SSO resolves the Microsoft UPN to the Salesforce 
Username
, so a mismatch causes a silent login failure.
Then HALT and wait for the user to confirm the app is installed (they reply "installed"). This is a human-only action; do not proceed to Step 3's user-access assignment as if it were done, and do not fabricate the confirmation — wait for the real reply.
本技能无法调用任何Salesforce或Microsoft API将Teams应用安装到租户的应用目录中——这始终需要拥有足够租户权限的人员在Microsoft Teams管理中心/AppSource中点击「添加」。为用户提供准确的市场链接和帮助文档；请勿尝试自动化此步骤。
  • 市场链接（从Go页面的「前往Microsoft市场」按钮验证为有效）：
    text
    https://marketplace.microsoft.com/en-us/product/teams-app/WA200009869?tab=Overview
  • 帮助文档：
    https://help.salesforce.com/s/articleView?id=service.it_srvce_msteams_cnfig_fulfilerhub_app.htm&type=5
将两者一并提供，以便用户在安装链接旁拥有自助参考资料。同时告知用户，处理人员登录Teams所用的Azure/Microsoft账户邮箱必须与该Salesforce用户的邮箱/
Username
匹配——SSO会将Microsoft UPN解析为Salesforce
Username
，不匹配会导致静默登录失败。
然后暂停并等待用户确认应用已安装（用户回复**「已安装」**）。这是仅能由人工完成的操作；请勿假设操作已完成而直接进入步骤3的用户访问分配环节，也请勿伪造确认信息——等待真实回复。

Step 3 — Manage User Access

步骤3 — 管理用户访问

"Manage User Access" ("Manage" button on the Go page) assigns two permission sets — verified live from the "Manage Microsoft Teams for Employee Service User Access" dialog:
  • TeamsForITSrvcsUser
    (label "Microsoft Teams for IT Services", backed by PSL 
    TeamsForITSrvcsPsl
    )
  • MicrosoftGraphAccess
    (label "MicrosoftGraphAccess") — assigned alongside it in the same dialog.
Do not just assign every active user. Ask the user which specific user(s) should get access. If they want to see the list of users first (rather than naming them), page it — show at most 10 users per page, then ask "want to see more?" before showing the next page, since orgs can have hundreds or thousands of users:
text
mcp__headless-360__dispatch_readonly(
  method: "GET",
  url:    "/services/data/v67.0/query",
  queryParams: { "q": "SELECT Id, Name, Username, Email FROM User WHERE IsActive = true ORDER BY Name LIMIT 10 OFFSET <page * 10>" }
)
Verified gotcha: in scratch/test orgs (and possibly some real orgs), the first page(s) of this query are often dominated by non-employee system/integration accounts — e.g. 
Automated Process
, 
Bot User
, 
Insights Integration
, 
*.ext
integration users, 
ESW_*
/ 
*Site Guest User
guest users, and 
DigitalAgent.*
agent users. When presenting a page to the user, flag these as likely-not-employee accounts (don't silently filter them out of the list — the user may still want one assigned — but call out which rows look like system accounts so the user doesn't have to guess). If the user says a listed batch is "not employee users, skip," move on to the next page rather than assigning any of them.
Once the user confirms specific user(s), look up each permission set's 
Id
(they are stable per org but don't hardcode them — query fresh):
text
mcp__headless-360__dispatch_readonly(
  method: "GET",
  url:    "/services/data/v67.0/query",
  queryParams: { "q": "SELECT Id, Name FROM PermissionSet WHERE Name IN ('TeamsForITSrvcsUser','MicrosoftGraphAccess')" }
)
Then assign both permission sets to each confirmed user via 
PermissionSetAssignment
(one record per user/permset pair — batch with as many calls as needed, there is no bulk-assign endpoint exposed here):
text
mcp__headless-360__dispatch(
  method: "POST",
  url:    "/services/data/v67.0/sobjects/PermissionSetAssignment",
  body:   { "AssigneeId": "<user id>", "PermissionSetId": "<permission set id>" }
)
Verify by re-querying 
PermissionSetAssignment
for that 
AssigneeId
, or simply trust the 
201
from the assignment call plus a 
SELECT ... FROM PermissionSetAssignment WHERE AssigneeId = '<user id>' AND PermissionSetId = '<permset id>'
readback.
「管理用户访问」（Go页面上的「管理」按钮）会分配两个权限集——已从「管理Microsoft Teams员工服务用户访问」对话框中验证：
  • TeamsForITSrvcsUser
    （标签**「Microsoft Teams for IT Services」**，基于PSL 
    TeamsForITSrvcsPsl
    ）
  • MicrosoftGraphAccess
    （标签**「MicrosoftGraphAccess」**）——在同一对话框中一并分配。
请勿为所有活跃用户分配权限。询问用户应为哪些特定用户授予访问权限。如果用户希望先查看用户列表（而非直接指定），请分页展示——每页最多显示10个用户，然后询问「是否查看更多？」再展示下一页，因为组织可能拥有数百或数千名用户：
text
mcp__headless-360__dispatch_readonly(
  method: "GET",
  url:    "/services/data/v67.0/query",
  queryParams: { "q": "SELECT Id, Name, Username, Email FROM User WHERE IsActive = true ORDER BY Name LIMIT 10 OFFSET <page * 10>" }
)
已验证的注意事项：在临时/测试组织（可能部分真实组织）中，此查询的前几页通常以非员工的系统/集成账户为主——例如
Automated Process
、
Bot User
、
Insights Integration
、
*.ext
集成用户、
ESW_*
/ 
*Site Guest User
访客用户以及
DigitalAgent.*
代理用户。向用户展示页面时，需标记这些账户为非员工账户（请勿从列表中悄悄过滤——用户可能仍需为其中某些账户分配权限——但需指出哪些行看起来是系统账户，以免用户猜测）。如果用户表示列出的批次是「非员工用户，跳过」，则直接进入下一页，不为这些账户分配权限。
用户确认特定用户后，查询每个权限集的
Id
（每个组织中的
Id
是稳定的，但请勿硬编码——请实时查询）：
text
mcp__headless-360__dispatch_readonly(
  method: "GET",
  url:    "/services/data/v67.0/query",
  queryParams: { "q": "SELECT Id, Name FROM PermissionSet WHERE Name IN ('TeamsForITSrvcsUser','MicrosoftGraphAccess')" }
)
然后通过
PermissionSetAssignment
为每个确认的用户分配两个权限集（每个用户/权限集对应一条记录——根据需要批量调用，此处无批量分配端点）：
text
mcp__headless-360__dispatch(
  method: "POST",
  url:    "/services/data/v67.0/sobjects/PermissionSetAssignment",
  body:   { "AssigneeId": "<user id>", "PermissionSetId": "<permission set id>" }
)
可通过重新查询该
AssigneeId
对应的
PermissionSetAssignment
来验证，或直接信任分配调用返回的
201
状态码，再加上查询
SELECT ... FROM PermissionSetAssignment WHERE AssigneeId = '<user id>' AND PermissionSetId = '<permset id>'
的结果。

Login prerequisite — the two Manage-User-Access permsets are NOT enough to sign in (verified)

登录前置条件——两个管理用户访问的权限集不足以完成登录（已验证）

Assigning 
TeamsForITSrvcsUser
+ 
MicrosoftGraphAccess
provisions the IT Desk surface, but a fulfiller who opens the IT Desk app in Teams can still hit "server not reachable" on the login page. The verified root cause is the 
ServiceCloudMSTeamsEca
External Client App OAuth authorize being denied — 
LoginHistory
for the user shows 
Application = ServiceCloudMSTeamsEca
, 
Status = Failed: Not approved for access
(
LoginType = Remote Access 2.0
). Neither 
TeamsForITSrvcsUser
nor 
MicrosoftGraphAccess
clears this, because:
  1. They are not pre-authorized to the ECA. The ECA's policy is 
    AdminApprovedPreAuthorized
    (verified: 
    SELECT PermittedUsersPolicyType FROM ExtlClntAppOauthPlcyCnfg WHERE ExternalClientApplicationId = '<ecaId>'
    — Tooling), so only users holding a permission set explicitly pre-authorized on the ECA can complete OAuth. Check which permset that is: 
    SELECT ParentId, Parent.Name FROM SetupEntityAccess WHERE SetupEntityId = '<ecaId>'
    — in the verified org the sole authorized set was 
    Teams_Employee_ApiAccess
    , and the IT Desk agent did not hold it.
  2. They do not grant API Enabled. Both read 
    PermissionsApiEnabled = false
    ; the embedded app's Connect calls need the API Enabled system permission or they 403.
Fix (verified to resolve the login): also assign the fulfiller the 
Teams_Employee_ApiAccess
 permission set — it is simultaneously the ECA-pre-authorized set and carries 
PermissionsApiEnabled = true
, so it clears both blockers in one assignment:
text
mcp__headless-360__dispatch(
  method: "POST",
  url:    "/services/data/v67.0/sobjects/PermissionSetAssignment",
  body:   { "AssigneeId": "<user id>", "PermissionSetId": "<Teams_Employee_ApiAccess Id>" }
)
After assigning, have the user fully close and reopen the Teams app (the ECA authorize is cached client-side). Also confirm CORS Allowed Origins contains both 
https://teams.cloud.microsoft
and 
https://cdn.scs.static.lightning.force.com
(
SELECT UrlPattern FROM CorsWhitelistEntry
). If login still fails in a fresh session after the ECA-authorized permset is assigned, the remaining suspect is the "Allow OAuth for employees" profile checkbox (Setup-UI-only — no API write path). See 
service-itsm-teams-itservice-configure
's Login prerequisites and its Troubleshooting section D (ECA self-authorization) for the full pass/fail diagnostic chain — the same ECA gates both the fulfiller (IT Desk) and employee (IT Service) apps.
分配
TeamsForITSrvcsUser
+ 
MicrosoftGraphAccess
后，会配置IT Desk界面，但处理人员在Teams中打开IT Desk应用时仍可能在登录页面遇到**「服务器无法访问」问题。已验证的根本原因是
ServiceCloudMSTeamsEca
外部客户端应用OAuth授权被拒绝**——用户的
LoginHistory
显示
Application = ServiceCloudMSTeamsEca
，
Status = Failed: Not approved for access
（
LoginType = Remote Access 2.0
）。
TeamsForITSrvcsUser
和
MicrosoftGraphAccess
都无法解决此问题，原因如下：
  1. 它们未被预授权给ECA。ECA的策略为
    AdminApprovedPreAuthorized
    （已验证：
    SELECT PermittedUsersPolicyType FROM ExtlClntAppOauthPlcyCnfg WHERE ExternalClientApplicationId = '<ecaId>'
    ——工具查询），因此只有持有ECA上明确预授权的权限集的用户才能完成OAuth。请检查该权限集：
    SELECT ParentId, Parent.Name FROM SetupEntityAccess WHERE SetupEntityId = '<ecaId>'
    ——在已验证的组织中，唯一授权的权限集是**
    Teams_Employee_ApiAccess
    **，而IT Desk代理并未持有该权限集。
  2. 它们未授予API启用权限。两者的
    PermissionsApiEnabled = false
    ；嵌入应用的Connect调用需要API启用系统权限，否则会返回403错误。
修复方案（已验证可解决登录问题）：同时为处理人员分配**
Teams_Employee_ApiAccess
**权限集——它既是ECA预授权的权限集，又包含
PermissionsApiEnabled = true
，因此可一次性解决两个障碍：
text
mcp__headless-360__dispatch(
  method: "POST",
  url:    "/services/data/v67.0/sobjects/PermissionSetAssignment",
  body:   { "AssigneeId": "<user id>", "PermissionSetId": "<Teams_Employee_ApiAccess Id>" }
)
分配后，让用户完全关闭并重新打开Teams应用（ECA授权会在客户端缓存）。同时确认CORS允许的源包含
https://teams.cloud.microsoft
和
https://cdn.scs.static.lightning.force.com
（
SELECT UrlPattern FROM CorsWhitelistEntry
）。如果在分配ECA授权的权限集后，新会话中登录仍失败，则剩余可疑点是**「允许员工使用OAuth」**配置文件复选框（仅可通过设置UI操作——无API写入路径）。请查看
service-itsm-teams-itservice-configure
的登录前置条件及其故障排除部分D（ECA自授权）获取完整的诊断流程——同一ECA同时限制处理人员（IT Desk）和员工（IT Service）应用。

Step 4 — Set Teams as Collaboration Tool for Swarming (delegate)

步骤4 — 设置Teams为Swarming协作工具（委托）

This 4th checklist item requires the 
service-cloud-swarming
Go feature to be enabled first. Do not enable that feature inline here — invoke the dedicated 
service-itsm-swarming-configure
skill instead of duplicating feature-enablement logic:
text
Invoke the service-itsm-swarming-configure skill.
That skill enables 
service-cloud-swarming
and writes 
SWARM_COLLABORATION_TOOL
to 
"Teams"
via 
PATCH /services/data/v67.0/setup/org/values/SWARM_COLLABORATION_TOOL
— this checklist item is now fully automated end-to-end, no manual "Go to Feature Page" click required.
第4项清单需要先启用
service-cloud-swarming
Go功能。请勿在此处内联启用该功能——请调用专用的
service-itsm-swarming-configure
技能，而非重复实现功能启用逻辑：
text
Invoke the service-itsm-swarming-configure skill.
该技能会启用
service-cloud-swarming
，并通过
PATCH /services/data/v67.0/setup/org/values/SWARM_COLLABORATION_TOOL
将
SWARM_COLLABORATION_TOOL
设置为
"Teams"
——此清单项现已完全自动化，无需手动点击「前往功能页面」。

Gotchas

注意事项

IssueDetail
Requires the Teams Salesforce Go page feature first
OrgHasITSMFulfillerTeams
does not gate or depend on 
ITSMTeamsEnabled
directly, but the Go page checklist only appears once 
service-cloud-itsm-teams-integration
is enabled — run 
service-itsm-teams-configure
first.
OrgHasITSMFulfillerTeams
does not unblock 
ITSMTeamsEnabled
These are separate bits — enabling this preference does not itself unblock the Teams Salesforce Go page toggle preference, and vice versa.
"Set Teams as Collaboration Tool for Swarming" needs 
service-cloud-swarming
enabled first		Delegate to 
service-itsm-swarming-configure
rather than enabling that feature inline. That skill both enables the feature and writes 
SWARM_COLLABORATION_TOOL
to 
"Teams"
— the whole checklist item is API-reachable, not just the base feature enable.
Permission sets / PSLs
TeamsForITSrvcsUser
, 
MicrosoftGraphAccess
(permission sets) and PSL 
TeamsForITSrvcsPsl
auto-provisioned and were confirmed 
Active
(10 licenses) immediately after the feature-enable in this session — no manual PSL/permset creation needed once 
TeamsITSrvcsAddOn
+
IncidentManagementAddOn
are licensed.
Manage-User-Access permsets don't cover login — assign 
Teams_Employee_ApiAccess
too		Verified: after assigning 
TeamsForITSrvcsUser
+ 
MicrosoftGraphAccess
, the IT Desk agent still failed Teams login with "server not reachable"; 
LoginHistory
showed 
ServiceCloudMSTeamsEca
= "Failed: Not approved for access." The 
ServiceCloudMSTeamsEca
ECA is 
AdminApprovedPreAuthorized
and its only pre-authorized permset was 
Teams_Employee_ApiAccess
; neither Manage-User-Access set is authorized on the ECA, and both have 
PermissionsApiEnabled = false
. Assigning 
Teams_Employee_ApiAccess
(ECA-pre-authorized and grants API Enabled) resolved the login. See Step 3 → Login prerequisite.
Version prefix requiredheadless-360 
dispatch
/
dispatch_readonly
do not resolve API versions — always pass the full 
/services/data/vXX.0/...
prefix.
问题详情
需先启用Teams Salesforce Go页面功能
OrgHasITSMFulfillerTeams
并不直接管控或依赖
ITSMTeamsEnabled
，但只有在
service-cloud-itsm-teams-integration
启用后，Go页面清单才会显示——请先运行
service-itsm-teams-configure
。
OrgHasITSMFulfillerTeams
不会解除
ITSMTeamsEnabled
的限制		这是两个独立的设置——启用此偏好设置不会解除Teams Salesforce Go页面切换偏好设置的限制，反之亦然。
「设置Teams为Swarming协作工具」需先启用
service-cloud-swarming
请委托给
service-itsm-swarming-configure
，而非在此处内联启用该功能。该技能既会启用功能，又会将
SWARM_COLLABORATION_TOOL
设置为
"Teams"
——整个清单项均可通过API实现，而非仅基础功能启用。
权限集/PSLs
TeamsForITSrvcsUser
、
MicrosoftGraphAccess
（权限集）以及PSL 
TeamsForITSrvcsPsl
会在功能启用后自动配置，并在本次会话中确认处于「活跃」状态（10个许可证）——一旦
TeamsITSrvcsAddOn
+
IncidentManagementAddOn
获得许可，无需手动创建PSL/权限集。
管理用户访问的权限集无法满足登录需求——还需分配
Teams_Employee_ApiAccess
已验证：分配
TeamsForITSrvcsUser
+ 
MicrosoftGraphAccess
后，IT Desk代理仍无法登录Teams，显示**「服务器无法访问」**；
LoginHistory
显示
ServiceCloudMSTeamsEca
= 「Failed: Not approved for access.」。
ServiceCloudMSTeamsEca
ECA为
AdminApprovedPreAuthorized
，其唯一预授权的权限集是
Teams_Employee_ApiAccess
；管理用户访问的两个权限集均未获得ECA授权，且两者的
PermissionsApiEnabled = false
。分配
Teams_Employee_ApiAccess
（获ECA预授权且授予API启用权限）可解决登录问题。请查看步骤3 → 登录前置条件。
需指定版本前缀headless-360的
dispatch
/
dispatch_readonly
不会解析API版本——请始终传递完整的
/services/data/vXX.0/...
前缀。

Related Skills

相关技能

SkillWhen to use instead / alongside
service-itsm-teams-configure
Enabling the base Teams Salesforce Go page toggle, Azure/Entra app registration, Named Credential population, and Teams extension registration — a prerequisite for this skill
service-itsm-teams-itservice-configure
The IT Service/employee half of the checklist (Turn on IT Service, Install IT Service app, Manage User Access, Select a Digital Experience Site)
service-itsm-swarming-configure
Enabling the 
service-cloud-swarming
Go feature for "Set Teams as Collaboration Tool for Swarming" — this skill delegates to it rather than duplicating that logic
service-itsm-channels-coordinate
Top-level menu across Teams, Slack, Swarming, Notifications, Portal
技能替代/配合使用场景
service-itsm-teams-configure
启用基础Teams Salesforce Go页面切换、Azure/Entra应用注册、命名凭证填充以及Teams扩展注册——本技能的前置条件
service-itsm-teams-itservice-configure
清单中的IT服务/员工端部分（开启IT服务、安装IT服务应用、管理用户访问、选择数字体验站点）
service-itsm-swarming-configure
为「设置Teams为Swarming协作工具」启用
service-cloud-swarming
Go功能——本技能会委托给它，而非重复实现该逻辑
service-itsm-channels-coordinate
Teams、Slack、Swarming、通知、门户的顶级菜单