@salesforce/afv-skills 1.40.0 → 1.41.0

package/skills/service-itsm-teams-coordinate/SKILL.md

@@ -0,0 +1,175 @@
+---
+name: service-itsm-teams-coordinate
+description: "End-to-end autopilot orchestrator for setting up Microsoft Teams integration in Salesforce Service Cloud ITSM — runs the whole flow (enable the Teams for Employee Service Go feature, register the Microsoft Entra app, populate Named Credentials, configure the IT Desk and IT Service checklists, turn on Swarming, and optionally embed the Agentforce agent) in one continuous pass, stopping only at the points a human must act. Use when the user asks to set up Microsoft Teams for ITSM end to end, 'set up teams for it service', 'do the whole teams itsm setup', 'configure microsoft teams for employee service', or wants a guided Teams ITSM walkthrough. Delegates each stage to a specialized child skill while driving the sequence itself. DO NOT TRIGGER when the user asks to enable Teams alone, configure just the IT Desk or IT Service checklist alone, or enable Swarming alone — delegate directly to the specific child skill in those cases."
+metadata:
+  version: "2.0"
+  domains: ["Service"]
+  relatedSkills:
+    - "service-itsm-swarming-configure"
+    - "service-itsm-teams-configure"
+    - "service-itsm-teams-debug"
+    - "service-itsm-teams-employee-agent-configure"
+    - "service-itsm-teams-itdesk-configure"
+    - "service-itsm-teams-itservice-configure"
+  # No accessCheck gate: this orchestrator's Stage 1 is what enables ITSMTeamsEnabled,
+  # so it must be invokable on a brand-new org before that preference exists. Downstream
+  # child skills retain their own accessCheck. Empty array = applies to any org.
+  accessCheck: []
+allowed-tools: Read AskUserQuestion
+---
+
+# Microsoft Teams for ITSM — End-to-End Setup Autopilot
+
+Drive the **complete** Microsoft Teams for Employee Service (ITSM) setup as one continuous flow.
+Delegate each stage to its specialized child skill, but own the **sequence** yourself and keep
+going through every stage **without stopping to ask permission between stages**. Halt only at the
+points where a human genuinely must act — nowhere else.
+
+## Goal
+
+Take the user from nothing to a working Teams ITSM integration (IT Desk + IT Service, Swarming, and
+— if they want it — the embedded Agentforce agent) in a single guided run. The child skills carry
+the verified API detail; this skill is the conductor that runs them in order and manages the handoffs.
+
+## Core operating rule — run continuously, halt only where required
+
+**Do everything with no midway stop unless the user must supply something or perform an off-platform
+action.** Do **not** re-present a menu between stages, do **not** ask "shall I continue?" after each
+stage, and do **not** ask the user to click Setup toggles this skill's children can do via API. Move
+straight from one stage to the next, reporting progress as you go.
+
+There are exactly **three mandatory halts** and **one branch** in the whole flow:
+
+- **HALT 1 — Azure/Entra app** (Stage 2): you give the user the app-registration instructions and
+  **wait** for them to register the app and provide the credentials. No Salesforce API can do this.
+  The **Client ID** and **Tenant ID** are non-secret identifiers and may be given in chat; the
+  **Client Secret is a confidential credential — NEVER ask for it in the conversation.** The user
+  places it in the `TEAMS_ENTRA_CLIENT_SECRET` environment variable (or a gitignored secret file the
+  agent is told the path to); the agent reads it from there and never prints, echoes, or logs it.
+- **HALT 2 — IT Desk app install** (Stage 3): you give the Microsoft Marketplace link and **wait**
+  for the user to reply **"installed"**. No API installs a Teams app into a tenant catalog.
+- **HALT 3 — IT Service app install** (Stage 4): same as HALT 2, for the IT Service app.
+- **BRANCH — IT Service Agentforce agent** (Stage 7): the IT Desk agent works automatically, but the
+  IT Service embedded agent is pending work; **ask the user whether to do it**, and only run Stage 8
+  if they say yes.
+
+If the user goes silent at a halt, stop and wait — do not fabricate the value or skip ahead. Every
+other transition is automatic.
+
+> **Within each stage, execute one operation at a time.** The child skills make real, state-changing
+> API calls; run a single operation, confirm it succeeded, then proceed — never batch state-changing
+> calls into one parallel block. "No midway stop" means no *permission gate* between stages, not
+> firing writes in parallel.
+
+## The flow (run in this order)
+
+### Stage 1 — Enable the Teams for Employee Service Go feature
+Invoke **`service-itsm-teams-configure`** for the feature-enable half only (its Steps 1–3): enable
+`service-cloud-itsm-teams-integration` and confirm `ITSMTeamsEnabled` reads `true`. Report progress,
+then continue straight into Stage 2 — do **not** stop here.
+
+### Stage 2 — Microsoft Entra app + Named Credentials  ⟶ HALT 1
+Still within **`service-itsm-teams-configure`** (its Step 4a): give the user the exact Azure/Entra
+app-registration clicks **including the Microsoft Graph Application permissions** it lists, and
+**HALT** until they provide the credentials. The **Client ID** and **Tenant ID** are non-secret
+identifiers — accept them in chat. The **Client Secret is confidential: never request it in the
+conversation.** Instruct the user to set it in the `TEAMS_ENTRA_CLIENT_SECRET` environment variable
+(or a gitignored secret file, and tell you the path); read it from there. Never print or echo it.
+The moment the identifiers are given and the secret is in the env/file:
+- Write those values into the `MSTeamsSetupClientCredentialsEC` Named Credential **and** the
+  `microsoft_auth_provider` Auth Provider **yourself, via API — nothing manual** (the child skill's
+  Step 5 and its azure-credential-population reference carry the exact API bodies). Reference the
+  secret by its env var / file path in the API call — do not inline the raw value into any logged text.
+- Give the user the static **Grant Admin Consent** link and register the preferred site (child Step 5).
+Then continue to Stage 3 automatically.
+
+### Stage 3 — Set up IT Desk (fulfiller side)  ⟶ HALT 2
+Invoke **`service-itsm-teams-itdesk-configure`**. Drive its whole checklist:
+- Turn on the `OrgHasITSMFulfillerTeams` org preference (via API).
+- **Manage User Access** — assign the fulfiller permission sets to the confirmed user(s):
+  `TeamsForITSrvcsUser` + `MicrosoftGraphAccess`, **plus `Teams_Employee_ApiAccess`** (the ECA-
+  pre-authorized set that also grants **API Enabled** — required for login, not optional).
+- **Turn on Swarming** — this stage includes `service-itsm-swarming-configure`
+  (enables `service-cloud-swarming` and sets `SWARM_COLLABORATION_TOOL = "Teams"`).
+- Give the **IT Desk Microsoft Marketplace link** + help doc, tell the user **the Azure account
+  email must match the Salesforce user's email/Username** (SSO resolves MS UPN → `Username`), and
+  **HALT** until the user replies **"installed."** Then continue to Stage 4.
+
+### Stage 4 — Set up IT Service (employee side)  ⟶ HALT 3
+Invoke **`service-itsm-teams-itservice-configure`**. Drive its whole checklist:
+- Turn on the `OrgHasEmployeeServiceTeams` org preference (via API).
+- **Manage User Access** — assign the employee permission sets to the confirmed UEL user(s):
+  `TeamsForEmployeeUser` + `MicrosoftGraphAccess`, **plus the API Enabled + ECA-authorized access**
+  the child's login prerequisites require.
+- **Select the Digital Experience Site** (`SLACK_PREFERRED_SITE`) via API.
+- Give the **IT Service Microsoft Marketplace link** + help doc, repeat the **email-must-match** note,
+  and **HALT** until the user replies **"installed."** Then continue to Stage 5.
+
+### Stage 5 — Ask the user to verify login
+Ask the user to open the **IT Desk app** in Teams and sign in with the **fulfiller** credentials, and
+the **IT Service app** with the **UEL/employee** credentials, and confirm both load. If either fails,
+route to **`service-itsm-teams-debug`** for the pass/fail login diagnostic before proceeding.
+
+### Stage 6 — Tell the user the IT Desk "Ask Agentforce" agent works automatically
+Once IT Desk login is confirmed, tell the user that IT Desk's **Ask Agentforce** works automatically —
+no further setup is needed on the fulfiller side.
+
+### Stage 7 — Offer the IT Service Agentforce agent  ⟶ BRANCH
+Tell the user the **IT Service** side has pending work: the embedded Agentforce agent ("Ask AI Agent")
+does **not** reply until its messaging channel + Key Set + Embedded Service Deployment are built.
+**Ask whether they want to set it up now** (use `AskUserQuestion`). If **no**, go to the completion
+summary. If **yes**, run Stage 8.
+
+### Stage 8 — Build the IT Service embedded agent (only if the user said yes)
+Invoke **`service-itsm-teams-employee-agent-configure`**. It builds — 100% via API — the Web
+messaging channel with **User Verification ON + a `JWKS_URL` Key Set**, the `Teams_AgentForce`
+Embedded Service Deployment (publish), the routing flow, and the Agent Access permission set on the
+portal user. Then tell the user to **retest from a brand-new Teams chat** to confirm the agent replies.
+
+## After each stage
+
+- **Report the child's ACTUAL verdict — never assume "Done."** A stage is complete only when its
+  child skill explicitly reported success. If a child reports **blocked** (most commonly Stage 2 while
+  the Entra app is unregistered, or a halt awaiting "installed"), keep that stage **`Blocked`/waiting**
+  and hold at the halt — do not mark it done and do not skip ahead.
+- Do not re-present a menu. State what just finished and what you're doing next, then do it.
+
+## Completion summary
+
+When the flow ends (Stage 7 "no", or Stage 8 done, or a hard block the user chose not to resolve),
+summarize each stage's real status. Header: all stages complete → **Complete**; any stage still
+blocked/waiting → **Incomplete (action required)** with the exact next step; otherwise **Finished**.
+
+## Rules
+
+- ALWAYS show "(via service-itsm-teams-coordinate)" in the setup header.
+- Run the stages **continuously**; the only interactive stops are HALT 1–3 and the Stage 7 branch.
+- NEVER ask the user to click a Setup toggle a child skill can flip via API (feature enable, org
+  prefs, permission-set assignment, digital site, named credentials).
+- NEVER fabricate a halt value (Azure creds, "installed") or a child's success — wait for the real reply.
+- Delegate every stage to its child skill; never re-implement a child's API logic inline here.
+- Track progress across the conversation — do not re-run a completed stage.
+- Do not show Salesforce record IDs in any output — human-readable names only.
+- At Stages 3 and 4, always include the **Azure-email-must-match-Salesforce-email** note with the
+  marketplace link, since a mismatch is a common silent login failure.
+
+## Verification checklist
+
+Before emitting any progress message or summary, confirm:
+
+- [ ] The header line ends with `(via service-itsm-teams-coordinate)`.
+- [ ] The flow is running continuously — no permission gate was inserted between stages beyond the
+      three defined halts and the Stage 7 branch.
+- [ ] Each stage's status reflects the child's actual verdict (`In progress`, `Blocked`/waiting, or
+      `Done`) — not a hard-coded default.
+- [ ] A stage waiting on a halt (Azure creds, "installed") is shown as waiting, never `Done`.
+- [ ] Stages 3 and 4 each surfaced the marketplace link **and** the email-must-match note.
+- [ ] The Stage 7 branch was offered as a yes/no question, and Stage 8 ran only on an explicit "yes."
+- [ ] The next action delegates to a child skill; features are never configured inline here.
+- [ ] No Salesforce record IDs appear in the output — human-readable names only.
+
+## Reference File Index
+
+| File | When to read |
+|------|--------------|
+| `examples/output-templates.md` | Progress and completion-summary text blocks |

package/skills/service-itsm-teams-coordinate/examples/output-templates.md

@@ -0,0 +1,85 @@
+# Output Templates — service-itsm-teams-coordinate
+
+This orchestrator runs the Teams ITSM setup as one continuous autopilot (Stages 1–8), stopping only
+at the three halts and the Stage 7 branch. Emit a **stage-progress** block as you move between
+stages, and a **completion summary** at the end. Do **not** emit a feature-selection menu — the flow
+is linear, not menu-driven.
+
+## Stage-progress block (emit as you move between stages)
+
+Report what just finished and what you're doing next, then keep going (no permission gate). Use the
+child skill's ACTUAL verdict — a stage holding at a halt is `Waiting`, never `Done`.
+
+```text
+Microsoft Teams for ITSM Setup (via service-itsm-teams-coordinate)
+
+┌───┬────────────────────────────────────────────┬──────────────────────┐
+│ # │ Stage                                      │ Status               │
+├───┼────────────────────────────────────────────┼──────────────────────┤
+│ 1 │ Enable Teams for Employee Service feature  │ Done                 │
+│ 2 │ Microsoft Entra app + Named Credentials    │ Waiting (Azure creds)│
+│ 3 │ IT Desk (pref, access, Swarming, install)  │ Not started          │
+│ 4 │ IT Service (pref, access, site, install)   │ Not started          │
+│ 5 │ Verify login (fulfiller + UEL)             │ Not started          │
+│ 6 │ IT Desk "Ask Agentforce" (automatic)       │ Not started          │
+│ 7 │ Offer IT Service Agentforce agent          │ Not started          │
+│ 8 │ Build IT Service embedded agent (optional) │ Not started          │
+└───┴────────────────────────────────────────────┴──────────────────────┘
+
+Next: send me the Azure app's Client ID and Tenant ID, and put the Client Secret in the
+TEAMS_ENTRA_CLIENT_SECRET environment variable (or a secret file — tell me the path). Don't paste
+the secret here. I'll read it from there and write everything into the Named Credential and Auth
+Provider automatically.
+```
+
+Status values: `Not started`, `In progress`, `Waiting (<what for>)`, `Blocked`, `Done`.
+
+## Halt messages
+
+- **HALT 1 (Stage 2 — Azure/Entra app):** deliver the child's app-registration instructions
+  (including the Microsoft Graph Application permissions) and end with: *"Send me the **Client ID**
+  and **Tenant ID** here, and put the **Client Secret** in the `TEAMS_ENTRA_CLIENT_SECRET`
+  environment variable (or a secret file — tell me the path). Please don't paste the secret in chat.
+  I'll read it from there and populate the Named Credential and Auth Provider automatically — no
+  manual Setup entry needed."* Then wait.
+- **HALT 2 / HALT 3 (Stages 3 & 4 — app install):** deliver the Microsoft Marketplace link + help
+  doc, then: *"Install the app in your Microsoft Teams admin center, then reply **installed** and
+  I'll continue. Note: the Azure/Microsoft email the user signs in with must match that Salesforce
+  user's email/Username, or login fails silently."* Then wait for `installed`.
+
+## Completion summary
+
+Fires at Stage 7 "no", after Stage 8 completes, or when the user stops. Substitute each stage's real
+tracked status — never hard-code `Done`.
+
+- Header: every stage `Done` → `Microsoft Teams for ITSM Setup — Complete`; any stage
+  `Blocked`/`Waiting` → `Microsoft Teams for ITSM Setup — Incomplete (action required)`; otherwise →
+  `Microsoft Teams for ITSM Setup — Finished`.
+- Closing line: all `Done` → `Your Microsoft Teams for ITSM setup is complete.`; any
+  `Blocked`/`Waiting` → `Setup is not complete — finish the outstanding step noted above (e.g. paste
+  the Azure credentials, or install the Teams app) and I'll resume.`; otherwise → `You've finished
+  the stages you chose. The IT Service embedded agent can be built later by re-invoking this
+  orchestrator.`
+- Never emit `Complete` while any stage is `Blocked`/`Waiting`.
+
+Example — user declined the IT Service agent at Stage 7:
+
+```text
+Microsoft Teams for ITSM Setup — Finished
+(via service-itsm-teams-coordinate)
+
+┌────────────────────────────────────────────┬─────────────┐
+│ Stage                                      │ Status      │
+├────────────────────────────────────────────┼─────────────┤
+│ Enable Teams for Employee Service feature  │ Done        │
+│ Microsoft Entra app + Named Credentials    │ Done        │
+│ IT Desk (pref, access, Swarming, install)  │ Done        │
+│ IT Service (pref, access, site, install)   │ Done        │
+│ Verify login (fulfiller + UEL)             │ Done        │
+│ IT Desk "Ask Agentforce" (automatic)       │ Done        │
+│ IT Service Agentforce agent                │ Declined    │
+└────────────────────────────────────────────┴─────────────┘
+
+You've finished the stages you chose. The IT Service embedded agent can be built later by
+re-invoking this orchestrator.
+```

package/skills/service-itsm-teams-debug/SKILL.md

@@ -0,0 +1,144 @@
+---
+name: service-itsm-teams-debug
+description: "Debug and diagnose Microsoft Teams for Employee Service (ITSM) configuration failures — run a pass/fail validation checklist against the org and report exact remediation. Use this for: 'IT Desk login not working in Teams', 'UEL/CCP user can't log in to IT Service', 'Teams feature not showing / not enabled', 'CI Hub / Service Catalog / My Assets tab not loading', 'Teams Agentforce agent not responding', 'Teams swarming not working', 'Teams SSO failing', or any request to troubleshoot a Teams ITSM setup. Routes the problem to the right checklist (login, feature enablement, tab loading, Agentforce, swarming, SSO) and checks the exact CORS, External Client App, feature toggle, PSL, profile, auth-provider, named-credential, and messaging-channel settings each requires. DO NOT TRIGGER for first-time enablement (service-itsm-teams-configure / -itservice-configure / -itdesk-configure) or building the embedded agent from scratch (service-itsm-teams-employee-agent-configure)."
+metadata:
+  version: "1.0"
+  domains: ["Service"]
+  minApiVersion: "62.0"
+  relatedSkills:
+    - "service-itsm-channels-coordinate"
+    - "service-itsm-teams-configure"
+    - "service-itsm-teams-employee-agent-configure"
+    - "service-itsm-teams-itdesk-configure"
+    - "service-itsm-teams-itservice-configure"
+  mcpTools:
+    headless-360:
+      tools: ["describe", "discover", "dispatch", "dispatch_readonly"]
+      semver: ">=1.0.0"
+  accessCheck:
+    - type: "orgPref"
+      value: "ITSMTeamsEnabled"
+allowed-tools: |
+  Read AskUserQuestion
+  mcp__headless-360__discover
+  mcp__headless-360__describe
+  mcp__headless-360__dispatch
+  mcp__headless-360__dispatch_readonly
+---
+
+# Troubleshoot Microsoft Teams for Employee Service (ITSM)
+
+When someone reports a **Microsoft Teams for Employee Service** failure — can't log in, a tab
+won't load, the feature isn't showing, the Agentforce agent won't reply, swarming or SSO is
+broken — this skill connects to the org, runs the **pass/fail checklist for that specific
+problem**, and reports each setting's actual value plus the exact Setup path to fix any that are
+wrong. It replaces "check every setting by hand" with a targeted, verified diagnosis.
+
+Every read dispatches through **headless-360** (`dispatch_readonly` for queries, `dispatch` only
+for the optional swarming-token clear). No org password is needed.
+
+## Scope
+
+- **In scope:** Diagnosing an already-attempted Teams ITSM setup that is failing. Routing the
+  reported symptom to the right checklist and checking the exact settings it requires (CORS,
+  External Client App, feature toggles, PSLs, profile session settings, auth provider, named
+  credentials, messaging channel, Agentforce agent).
+- **Out of scope:** First-time enablement (use `service-itsm-teams-configure` /
+  `-itservice-configure` / `-itdesk-configure`), building the embedded agent from scratch (use
+  `service-itsm-teams-employee-agent-configure`), and non-Teams Salesforce debugging.
+
+> **Read-only by default.** Every check is a `dispatch_readonly` query — running the full
+> checklist changes nothing. The only state-changing action is the optional swarming OAuth-token
+> clear at the very end, and only with explicit user confirmation.
+
+---
+
+## Step 1 — Identify the problem and collect inputs
+
+Ask the user for their **problem description** if not already given. Match it to a checklist using
+the **Feature Map** in [`references/configuration-checklists.md`](references/configuration-checklists.md).
+
+Some problems need extra inputs — ask for them up front:
+
+| Problem type | Extra input to collect |
+|---|---|
+| Generic "login" (no app named) | Ask **which app** — IT Desk or IT Service |
+| IT Desk login | End-user's Salesforce username (the person who can't log in) |
+| IT Service login | **CCP or UEL user?**, then that end-user's Salesforce username |
+| Agentforce not replying | Employee Experience Site URL |
+| Swarming | End-user's username; Azure AD **Tenant ID** (optional — enables the Azure app check) |
+| SSO | Azure AD **Tenant ID** (optional); optionally which app + end-user username |
+
+Do **not** run the agent-specific checks until you have the mandatory inputs for that checklist
+(e.g. don't skip asking for the end-user username on a login issue — the per-user checks are
+`MANUAL_CHECK_REQUIRED` without it).
+
+## Step 2 — Route to the checklist
+
+Pick the checklist from the Feature Map, then run its checks **in order** from
+[`references/configuration-checklists.md`](references/configuration-checklists.md):
+
+| Symptom | Checklist |
+|---|---|
+| IT Desk login | `LOGIN_DESK` |
+| IT Service login — UEL user | `LOGIN_SERVICE_UEL` |
+| IT Service login — CCP user | `LOGIN_SERVICE_CCP` |
+| Generic login (app unknown) | `LOGIN` (then ask which app) |
+| Feature not showing / not enabled | `MSTEAMS_CORE` |
+| Tab won't load (CI Hub, Service Catalog, Employee Enablement, My Assets) | `TAB_LOADING` |
+| Lightning app not embedding / blank tab | `LIGHTNING_OUT` |
+| Agentforce agent not replying | `AGENTFORCE` |
+| Swarming | `SWARMING` |
+| Single Sign-On | `SSO` (+ the app-specific login checklist if an app is named) |
+
+When an app is named for an SSO issue, run **both** the `SSO` checklist and the matching login
+checklist (`LOGIN_DESK` / `LOGIN_SERVICE_CCP` / `LOGIN_SERVICE_UEL`) — skip duplicate checks.
+
+## Step 3 — Run the checks
+
+Execute each check's query via `dispatch_readonly` (queries and API fields are spelled out in the
+reference). Record for each check: a **status** and the **configured value** actually read from
+the org.
+
+| Status | Render as | Meaning |
+|---|---|---|
+| `OK` | OK | Correctly configured |
+| `MISCONFIGURED` / `MISSING` / `DISABLED` / `ERROR` | FAIL | Needs fixing — include the exact Setup path from the reference |
+| `MANUAL_CHECK_REQUIRED` | MANUAL | Needs manual verification (or a missing optional input like Tenant ID/username) — never render this as FAIL |
+
+## Step 4 — Report
+
+Render a table with **all four columns** — `#`, `Check`, `Status`, **`Configured Value`** (never
+omit the configured value), plus an `Action Required` note carrying the remediation for any
+failed check. End with a one-line summary: `N passed | N failed | N require manual verification`.
+
+- **All passed:** tell the user the Salesforce backend is correctly configured; if the problem
+  persists, reload the Teams app (**⋯** on the IT Desk/IT Service app → **Reload app**).
+- **Any failed:** don't add the reload note — the per-check `Action Required` steps are the fix.
+
+The full report-rendering rules, special-case notes, the example report layout, and the optional
+swarming OAuth-token clear are in
+[`references/report-generation.md`](references/report-generation.md).
+
+---
+
+## Gotchas (verified)
+
+| Issue | Detail |
+|---|---|
+| The Teams ECA DeveloperName is `ServiceCloudTeamsEca` | The External Client App the login checks look for is `ServiceCloudTeamsEca`. (A per-org packaged instance may surface under a related name such as `ServiceCloudMSTeamsEca`; match on the ECA that backs the Teams login, and treat a missing app as "turn the feature off and on again.") |
+| "Allow OAuth for employees" is **Metadata-API-only** for reading, and **Setup-UI-only** to change | Read via SOAP `listMetadata(ProfileSessionSetting)` → `readMetadata` on the fullName containing `unified`; field `allowOauthForEmployees` (`true`=enabled, `false`=disabled, absent=never configured). It is **not** on `Profile` describe and **not** REST/Tooling-queryable. To set it, use Setup → Profiles → *(employee profile)* → Session Settings. **UEL users only.** |
+| CORS check reads `IsOauthCorsPolicyEnabled`, allowed origins read `CorsWhitelistEntry.UrlPattern` | Both `https://cdn.scs.static.lightning.force.com` **and** `https://teams.cloud.microsoft` must be present. |
+| Feature toggles are read via the FulfillerApp permissions Connect API | `GET /connect/it-service/permissions/FulfillerApp` returns the org/user feature flags; a `FUNCTIONALITY_NOT_ENABLED` error means the `IServiceItsmTeamsFamily` family is off at the org level. |
+| Agentforce user-verification fields need **SOAP v62+** | `MessagingChannel.embeddedConfig` (`authMode`, `messagingAuthorizations.*`) is silently omitted by SOAP v60 — use v62+. |
+| Version prefix required | headless-360 `dispatch`/`dispatch_readonly` don't resolve API versions — always pass the full `/services/data/vXX.0/...` prefix. |
+
+## Related Skills
+
+| Skill | When to use instead |
+|---|---|
+| `service-itsm-teams-configure` | First-time enablement of the base Teams Go page toggle, Azure/Entra app, Named Credential, extension registration |
+| `service-itsm-teams-itservice-configure` | Completing the IT Service (employee) enablement checklist |
+| `service-itsm-teams-itdesk-configure` | Completing the IT Desk (fulfiller) enablement checklist + Swarming collaboration tool |
+| `service-itsm-teams-employee-agent-configure` | Building the embedded Agentforce agent from scratch so it replies in Teams |
+| `service-itsm-channels-coordinate` | Top-level menu across Teams, Slack, Swarming, Notifications, Portal |