---
schema_version: "1"
id: 0770f0467b74d9a57b02834c3bfe700ee85436508989eec34a906db09c5bbd34
title: Configure Salesforce and Microsoft Teams Manually
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/service/264-0-0/it_srvcs_msteams_cnct_sf_and_teams_manual.md
canonical_url: https://help.salesforce.com/s/articleView?id=service.it_srvcs_msteams_cnct_sf_and_teams_manual.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: cbca9092ed28cc64b78f70f52790ea4946dd8241453c8821acd227e7d96b4a6d
description: Configure the Salesforce and Microsoft Teams integration manually, including single sign-on, external credentials, the authentication provider, and Microsoft Entra ID callback URLs.
products:
  - Service Cloud
  - Agentforce IT Service
release: "264"
---
# Configure Salesforce and Microsoft Teams Manually

Configure the Salesforce and Microsoft Teams integration manually, including single sign-on, external credentials, the authentication provider, and Microsoft Entra ID callback URLs.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Enterprise</strong>, <strong>Performance</strong>, and <strong>Unlimited</strong> Editions with Agentforce IT Service.</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d95039e72">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d95039e72 ">To connect Salesforce and Microsoft Teams:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d95039e72 ">System Administrator Profile</td>

          </tr>
        </tbody>
      </table>

Make sure your org has the Teams IT Services Add-on, Teams Employee Add-on, Incident Management Add-on, and Service Cloud Employee Hub HR Standard Add-on licenses provisioned.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-it_service-264-0-0-production-enus/0a574a10-4c7a-4681-aacf-0767f8beaad4/images/icon_note.png)

Note If you configure the Salesforce and Microsoft Teams integration manually, don’t perform the steps in [Set Up Automated Microsoft Entra ID App Configuration for Microsoft Teams Integration](https://help.salesforce.com/s/articleView?id=service.it_srvcs_msteams_config_simplify_setup.htm&type=5&language=en_US).

## Enable Microsoft Teams for Employee Service

1. From Setup menu, go to **Salesforce Go** > **Feature Sets**.
2. On the Deliver IT Services Across Channels card, select **Set Up**.
3. On the Microsoft Teams for Employee Service card, select **Set Up**.
4. On the Microsoft Teams for Employee Service page, select **Get Started**.
5. Turn on Microsoft Teams for Employee Service.
    
    When you enable Microsoft Teams for Employee Service, the External Client App, Auth Provider, External Credentials, and Named Credentials install automatically.

## Configure SSO from Salesforce to Microsoft Teams

Configure Single Sign-On (SSO) for Microsoft Teams that allows employees and IT teams access to IT and HR service features in Microsoft Teams without repeated sign-ins. The SSO creates a secure trust relationship between Salesforce and Microsoft Azure to provide a seamless experience for managing support tickets and collaboration.

1. Create or reuse a Microsoft Entra ID application.
    1. Sign in to the [Azure portal](https://portal.azure.com).
    2. On the Welcome to Azure dashboard, under Manage Microsoft Entra ID, click **View**. You can also search for Microsoft Entra ID in the top search bar.
    3. From the left navigation menu, under the Manage section, select **App registrations**.
    4. Select **\+ New registration**.
    5. For Name field, enter a descriptive name as Salesforce ITSM for Teams (Delegated Access).
    6. Under Supported account types, select **Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant)**.
    7. Click **Register**.
    8. On the application overview page, click **Add a certificate or secret**.
    9. Select **\+ New client secret**.
    10. On the Add a client secret page, enter a description, and select an expiration duration.
    11. Click **Add**.
        
        Copy the client secret value and store it in a secure location. This value is hidden permanently after you leave this page. Use the value, not the secret ID.
    12. From the left navigation menu, select **API permissions**.
    13. Select **\+ Add a permission**.
    14. Select **Microsoft Graph**.
    15. Select **Delegated permissions**.
    16. Select these permissions for your integration.
        
        - Channel.Create
        - Channel.ReadBasic.All
        - ChannelMember.Read.All
        - ChannelMember.ReadWrite.All
        - ChannelMessage.Edit
        - ChannelMessage.Read.All
        - ChannelMessage.ReadWrite
        - ChannelMessage.Send
        - email
        - Group.Read.All
        - Group.ReadWrite.All
        - offline\_access
        - openid
        - profile
        - Team.Create
        - Team.ReadBasic.All
        - User.Read
    17. Click **Add permissions**.
    18. To finalize the authorization, click **Grant admin consent for your org to finalize the authorization**.
2. Configure the MSTeamsClientCredentialsEC external credential with the Azure AD app's client ID and client secret. See [Set up Named Credentials](https://help.salesforce.com/s/articleView?id=service.it_srvcs_msteams_config_notifications.htm&type=5&language=en_US).
    
    If you have already configured the principal, delete it and reconfigure the client ID and client secret to apply the updated permissions.
3. Configure Microsoft Teams in Salesforce to improve collaboration and service delivery.
    1. From Setup, click **Salesforce Go**.
    2. Search for and select **Microsoft Teams for Employee Service**.
    3. Turn on the toggle for Microsoft Teams for Employee Service. If it’s already enabled, turn it off and then turn it on again. To apply the new automated SSO features, turn the toggle off and then turn it on again.
    4. Locate the Grant Azure Administrator Consent step and click **Grant Consent**. A pop-up window displays a unique authorization URL.
    5. Click Copy Link and share this URL with your Azure Tenant Administrator. If you are the Azure Administrator, open the link in a new browser tab to approve the application's request to access and read organizational data.
4. Register your Salesforce org and preferred Experience Cloud site URLs in Microsoft Entra ID by creating a Microsoft Graph organization extension.
    1. Open Microsoft Graph Explorer.
    2. Click the profile icon, select **Sign In**, and sign in with your Microsoft Entra Global Administrator credentials.
    3. Click the profile icon again, and select **Consent to permissions**.
    4. Search for Organization.ReadWrite.All.
    5. Select **Consent** for the permission, and approve the request.
    6. In Graph Explorer, set the HTTP method to POST.
    7. Enter this endpoint, replacing <your\_tenant\_id> with your Microsoft Entra tenant ID
        
        https://graph.microsoft.com/v1.0/organization/<your\_tenant\_id>/extensions
    8. In Request body, enter this JSON.
        
        ```
         
            "@odata.type": "#microsoft.graph.openTypeExtension",
            "extensionName": "com_sf_itsm_teams_config",
            "salesforceOrgUrls": ["<YOUR_ORG_URL>"],
            "salesforceSiteUrls": ["<PREFERRERD_SITE_URL>"],
            "id": "com_sf_itsm_teams_config"
        ```
    9. Replace <YOUR\_ORG\_URL> and <PREFERRERD\_SITE\_URL> with your Salesforce org and Experience Cloud site URLs.
    10. Click **Run Query**.
        
        A successful request returns the HTTP status 201 Created.
5. Configure the Auth. Provider for secure communication between Salesforce and Microsoft Teams.
    1. From Setup, in the Quick Find box, enter Auth Providers, and then select **Auth Providers**.
    2. On the Auth Providers page, find and open the **microsoft\_auth\_provider** Auth Provider.
    3. Click **Edit**.
    4. Set Registration Handler Type to **Apex**.
    5. In the Registration Handler, select **MsTeamsItsmSSOHandler**.
        
        If MsTeamsItsmSSOHandler isn’t available, go to Salesforce Go, turn off the Microsoft Teams toggle, and then turn it on again to refresh the latest configuration.
    6. Set Execute Registration As a user account with only the Manage Users permission to maintain security best practices.
    7. Save your changes.
6. Add the Callback URL to Microsoft Entra ID.
    1. From the Auth. Provider page in Microsoft Teams, copy the generated callback URL.
    2. In the Microsoft Azure portal, open the your app registration that you created earlier.
    3. In Select a platform to add redirect URI, under Web applications, select **Web**.
    4. On the Auth. Provider page in Microsoft Teams, copy the callback URL of the preferred site selected on the Salesforce Go page.
    5. In the same app registration, add the preferred site callback URL as a redirect URL, and set the platform type to **Web**.