Configure Salesforce and Microsoft Teams Manually

Enable Microsoft Teams for Employee Service

1. From Setup menu, go to Salesforce Go > Feature Sets.
2. On the Deliver IT Services Across Channels card, select Set Up.
3. On the Microsoft Teams for Employee Service card, select Set Up.
4. On the Microsoft Teams for Employee Service page, select Get Started.
5. Turn on Microsoft Teams for Employee Service.
   When you enable Microsoft Teams for Employee Service, the External Client App, Auth Provider, External Credentials, and Named Credentials install automatically.

Configure SSO from Salesforce to Microsoft Teams

Configure Single Sign-On (SSO) for Microsoft Teams that allows employees and IT teams access to IT and HR service features in Microsoft Teams without repeated sign-ins. The SSO creates a secure trust relationship between Salesforce and Microsoft Azure to provide a seamless experience for managing support tickets and collaboration.

1. Create or reuse a Microsoft Entra ID application.
   1. Sign in to the Azure portal.
   2. On the Welcome to Azure dashboard, under Manage Microsoft Entra ID, click View. You can also search for Microsoft Entra ID in the top search bar.
   3. From the left navigation menu, under the Manage section, select App registrations.
   4. Select + New registration.
   5. For Name field, enter a descriptive name as Salesforce ITSM for Teams (Delegated Access).
   6. Under Supported account types, select Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant).
   7. Click Register.
   8. On the application overview page, click Add a certificate or secret.
   9. Select + New client secret.
   10. On the Add a client secret page, enter a description, and select an expiration duration.
   11. Click Add.
       Copy the client secret value and store it in a secure location. This value is hidden permanently after you leave this page. Use the value, not the secret ID.
   12. From the left navigation menu, select API permissions.
   13. Select + Add a permission.
   14. Select Microsoft Graph.
   15. Select Delegated permissions.
   16. Select these permissions for your integration.
       • Channel.Create
       • Channel.ReadBasic.All
       • ChannelMember.Read.All
       • ChannelMember.ReadWrite.All
       • ChannelMessage.Edit
       • ChannelMessage.Read.All
       • ChannelMessage.ReadWrite
       • ChannelMessage.Send
       • email
       • Group.Read.All
       • Group.ReadWrite.All
       • offline_access
       • openid
       • profile
       • Team.Create
       • Team.ReadBasic.All
       • User.Read
   17. Click Add permissions.
   18. To finalize the authorization, click Grant admin consent for your org to finalize the authorization.
2. Configure the MSTeamsClientCredentialsEC external credential with the Azure AD app's client ID and client secret. See Set up Named Credentials.
   If you have already configured the principal, delete it and reconfigure the client ID and client secret to apply the updated permissions.
3. Configure Microsoft Teams in Salesforce to improve collaboration and service delivery.
   1. From Setup, click Salesforce Go.
   2. Search for and select Microsoft Teams for Employee Service.
   3. Turn on the toggle for Microsoft Teams for Employee Service. If it’s already enabled, turn it off and then turn it on again. To apply the new automated SSO features, turn the toggle off and then turn it on again.
   4. Locate the Grant Azure Administrator Consent step and click Grant Consent. A pop-up window displays a unique authorization URL.
   5. Click Copy Link and share this URL with your Azure Tenant Administrator. If you are the Azure Administrator, open the link in a new browser tab to approve the application's request to access and read organizational data.
4. Register your Salesforce org and preferred Experience Cloud site URLs in Microsoft Entra ID by creating a Microsoft Graph organization extension.
   1. Open Microsoft Graph Explorer.
   2. Click the profile icon, select Sign In, and sign in with your Microsoft Entra Global Administrator credentials.
   3. Click the profile icon again, and select Consent to permissions.
   4. Search for Organization.ReadWrite.All.
   5. Select Consent for the permission, and approve the request.
   6. In Graph Explorer, set the HTTP method to POST.
   7. Enter this endpoint, replacing <your_tenant_id> with your Microsoft Entra tenant ID
      https://graph.microsoft.com/v1.0/organization/<your_tenant_id>/extensions
   8. In Request body, enter this JSON.

       
          "@odata.type": "#microsoft.graph.openTypeExtension",
          "extensionName": "com_sf_itsm_teams_config",
          "salesforceOrgUrls": ["<YOUR_ORG_URL>"],
          "salesforceSiteUrls": ["<PREFERRERD_SITE_URL>"],
          "id": "com_sf_itsm_teams_config"

   9. Replace <YOUR_ORG_URL> and <PREFERRERD_SITE_URL> with your Salesforce org and Experience Cloud site URLs.
   10. Click Run Query.
       A successful request returns the HTTP status 201 Created.
5. Configure the Auth. Provider for secure communication between Salesforce and Microsoft Teams.
   1. From Setup, in the Quick Find box, enter Auth Providers, and then select Auth Providers.
   2. On the Auth Providers page, find and open the microsoft_auth_provider Auth Provider.
   3. Click Edit.
   4. Set Registration Handler Type to Apex.
   5. In the Registration Handler, select MsTeamsItsmSSOHandler.
      If MsTeamsItsmSSOHandler isn’t available, go to Salesforce Go, turn off the Microsoft Teams toggle, and then turn it on again to refresh the latest configuration.
   6. Set Execute Registration As a user account with only the Manage Users permission to maintain security best practices.
   7. Save your changes.
6. Add the Callback URL to Microsoft Entra ID.
   1. From the Auth. Provider page in Microsoft Teams, copy the generated callback URL.
   2. In the Microsoft Azure portal, open the your app registration that you created earlier.
   3. In Select a platform to add redirect URI, under Web applications, select Web.
   4. On the Auth. Provider page in Microsoft Teams, copy the callback URL of the preferred site selected on the Salesforce Go page.
   5. In the same app registration, add the preferred site callback URL as a redirect URL, and set the platform type to Web.