Service Itsm Slack Itservice Configure

Set Up Self Service for Employees on Slack (Employee Service / ITSM)

Complete the "Set Up Self Service for Employees on Slack" checklist group — the employee side of Employee Service (ITSM) on Slack, so employees can create and manage their own tickets from Slack. Every operation dispatches through headless-360.

Execute one step at a time. These are real state-changing writes — run one operation, confirm it succeeded, then proceed. Don't batch setup calls into one parallel block.

Step 1 is a blocking gate. The Slack↔Salesforce connection request is Slack-admin-side. Every run, display the Step 1 block and STOP until the user confirms the request was sent — no API call (not even reads) before that. If unconfirmed, Slack setup is not done.

Speak plainly; keep internals in reasoning. Never surface tooling names, raw error codes, internal endpoints, developer names, or record Ids — translate to plain language ("Slack for Employee Service is now on") and refer to users/sites by human-readable Name. Begin each user-facing summary with the stamp (via service-itsm-slack-itservice-configure).

Scope

• Automated (API): turn on EmployeeServiceSlackEnabled; assign all three core permsets — EmployeeSlackNotifications + ItsmPortalUelUserPermset + an API-Enabled permset — to each confirmed employee user; list the employee portal; set the Preferred Digital Experience Site (SLACK_PREFERRED_SITE). Also read connection status.
• Guided + delegated: Connect Agentforce to Slack (Step 6) — ensure the IT Service Employee Agent exists (delegate to service-itsm-agentic-setup-employee-agent-configure), read-check the connection, then guide the UI-only writes.
• Guided, UI-only: the connection request (Part 1, Step 1) + approve/activate (Parts 2 & 3, Step 2, only if the API read can't confirm) + mapping field; agent↔Slack connection + workspace install (Step 6).
• Out of scope: Slack notification preferences (on/off).

Prerequisite: the org must have Employee Service (ITSM) licensing/permission — EmployeeServiceSlackEnabled is only editable then (see Gotchas). An employee portal should exist or be created via experience-portal-create.

Workflow

Step 1 — Request the Slack↔Salesforce connection (Slack-admin-side) — BLOCKING GATE

Connecting the org to a Slack workspace starts Slack-admin-side — no Salesforce API. Hard gate: present only Part 1 (request) verbatim, then HALT and wait for the user to confirm ("ok" / "done"); make no API call yet, and if unconfirmed, Slack setup is not done. Don't front-load Salesforce-side approval — you try to confirm that yourself in Step 2.

Connecting the org to Slack starts with a Slack-admin-side request — there's no Salesforce API for
it, so I can't do it for you. Do Part 1 now; after that I'll check the Salesforce side myself.

── PART 1 — Request a Salesforce connection in Slack (Slack desktop app) ──
  1. Click your workspace name in the sidebar.
  2. Hover over Tools & settings, then click Manage Salesforce organisations.
  3. Click on Connect Salesforce org in the top-right corner.
  4. Enter your Salesforce org URL.
  5. Choose whether to use Email or SAML NameID for the Account mapping field. If you like,
     toggle Automatic account mapping off to manually map accounts.
  6. Click on Request connection, then click on OK. Your request will be sent to Salesforce for
     approval.

Full walkthrough (all three parts — request, Salesforce approval, Slack activation):
  https://slack.com/intl/en-in/help/articles/30754346665747-Connect-Salesforce-and-Slack

Once you've sent the "Request connection" (Part 1), reply "ok".

Step 2 — Confirm the connection (try API first), then turn on Slack for Employee Service

Don't send the user to Salesforce right away — try to confirm the connection yourself first, and only guide the Salesforce-side approve/activate if you can't. Then enable the Employee Service org preference.

2a. TRY TO READ the connection via API (headless users have no Setup UI, so read rather than send them there blind):

mcp__headless-360__dispatch_readonly(
  method: "GET",
  url:    "/services/data/v67.0/connect/slackbridge/connections"
)

Returns {team:{status, teamName, teamDomain, teamId}, currentUserMapping:{salesforceUserId, slackUserId}} (verified 200). Branch on team.status:

• CONNECTED → already approved and live. Name the workspace by teamName; skip Parts 2 & 3 and go straight to 2c (enable the preference). (A null currentUserMapping.salesforceUserId means this user isn't mapped to a Slack user yet — mention it; it doesn't block the connection.)
• team: null / not-connected / errors → you CANNOT confirm it yet. This endpoint is CONNECTED-only and blind to a pending/requested connection, so a null does not mean the request is absent. Never say it "didn't land" or "isn't on the Salesforce side". Say only that no activated connection shows via API yet, then 2b.

2b. Only if you couldn't confirm (team:null / pending), PASTE Part 2 and Part 3, then HALT. Part 2 is the Salesforce-side approval + mapping field (default Email; ask if the org uses SAML) — genuinely UI-only, so guide it, don't fake an approve API. Point the user at the pending view Setup → Manage Slack Connection (/lightning/setup/SlackWorkspaces/home). Wait for "ok" (approved + activated) before 2c.

── PART 2 — Approve the connection on the Salesforce side (guided) ──
  1. Go to Setup → Manage Slack Connection (/lightning/setup/SlackWorkspaces/home).
  2. Find the pending request and Approve it.
  3. Set the Account mapping field to Email (default) — or SAML NameID if your org uses SAML.

── PART 3 — Activate the connection back in Slack (Slack desktop app) ──
  Do this after the connection is approved on the Salesforce side. Owners / Salesforce-admin system
  role in Slack can activate:
  1. Click your workspace name in the sidebar.
  2. Hover over Tools & settings, then click Manage Salesforce organisations.
  3. Select the pending connection.
  4. Review the connection details, then click Activate.

Reply "ok" once the connection is approved and activated, and I'll continue with the Salesforce setup.

Read yes, approve no — do not fake it. Reading status is real; approving the connection and setting the mapping field are genuinely UI-only. Don't invent a /connect/slack… approve call or claim it approved. Details / API evidence: references/manage-slack-connection.md.

2c. Turn on Slack for Employee Service. A direct org-preference toggle (reachable via PATCH). Enable it yourself via API; don't ask the user to flip the Setup toggle. Read first (idempotent — skip the write if already enabled):

mcp__headless-360__dispatch_readonly(
  method: "GET",
  url:    "/services/data/v67.0/setup/org/preferences/EmployeeServiceSlackEnabled"
)

Expect 200 {"isPreferenceEnabled": <bool>}. If false, enable it:

mcp__headless-360__dispatch(
  method: "PATCH",
  url:    "/services/data/v67.0/setup/org/preferences/EmployeeServiceSlackEnabled",
  body:   { "desiredState": true }
)

Expect 200 {"isPreferenceEnabled": true}. Re-run the GET to confirm. Tell the user it's enabled — don't ask them to flip the toggle themselves.

Verified: the REST preference name is EmployeeServiceSlackEnabled (not the Metadata-API name enableEmployeeServiceSlack; guessed variants 404). See Gotchas for the write-access gate.

Step 3 — Enable / list the employee portal

Slack for Employee Service surfaces self-service through a Digital Experience portal. List the org's sites and confirm an employee portal exists (this list feeds the Preferred Site selection in Step 5):

mcp__headless-360__dispatch_readonly(
  method: "GET",
  url:    "/services/data/v67.0/connect/communities"
)

Each entry carries id (the Network Id, 0DB...), name, status, templateName, siteUrl. Present the list and identify the employee portal (templateName "Employee Portal" / "Agentforce Employee Center"). If no portal exists — or Digital Experiences isn't enabled (the call errors / returns nothing) — hand off to experience-portal-create (covers org-level enablement too), then return.

Step 4 — Manage User Access (assign the employee permission sets)

The Go page's "Manage User Access" step assigns permission sets to each confirmed employee user (never all active users — ask which user(s), then assign). Always assign all three core permsets to each confirmed user — don't ask the user to choose a "notifications-only" vs "full" scope; the three together are what makes Slack for Employee Service actually usable (notifications + record visibility + API access), and under-assigning silently breaks record access:

• EmployeeSlackNotifications — Slack notifications on ticket updates (the core of the step).
• ItsmPortalUelUserPermset ("ITSM Portal Uel User") — read/create/edit on Incident, Service Request, Case (self-service) — lets the employee see/work their own records.
• API Enabled — lets the Slack app call Connect APIs. Reuse any existing API-Enabled permset the org already has; else create a Slack-named one (PermissionSet, PermissionsApiEnabled = true, e.g. Name Slack_ApiAccess / label "Slack API Access"). See references/manage-user-access.md.

Agent access is separate and conditional — assign it only if the user opts into the Agentforce agent in Slack (Step 6): the per-agent Agent_Access permset (the agent's BotDefinition SetupEntityAccess); reverse-lookup, create if absent. Never Access_Agents (fails on an employee license). Mechanics: references/connect-agentforce-to-slack.md.

Warn the user before assigning — their email must match their Slack user's email. The permset grants only the ability to receive notifications; the Salesforce↔Slack link comes from the connection's account-mapping field (default Email): User.Email must equal the Slack-account email, or they map to no Slack user and notifications go nowhere. A null currentUserMapping.salesforceUserId from Step 2 means unmapped. (SAML NameID: same rule, that identifier.) Surface this before you assign, so the user can pick users whose emails match.

Flow: query active users (page ≤10), classify with the helper script (don't eyeball — early pages are full of system/integration accounts), ask which to grant, look up each permset Id fresh, POST one PermissionSetAssignment per user per permset, classify each response with the script.

→ references/manage-user-access.md — query + POST bodies, the classify-user-access.mjs contracts, the email-match + license gotchas, and the ItsmPortalUelUserPermset / API-Enabled / agent-access grants.

Step 5 — Select a Preferred Digital Experience Site to connect Slack with

Writes the org value SLACK_PREFERRED_SITE (shared, cross-feature — see Gotchas).

1. Use the site list from Step 3. Ask which site to connect Slack with; if they don't choose, pick one yourself (the only site, else the employee portal / most recent Live site) and tell them.
2. Read GET /services/data/v67.0/setup/org/values/SLACK_PREFERRED_SITE first (stringValue = current Network Id or "None"); skip the write if already the chosen site's Id.
3. Write via dispatch PATCH to the same path with body { "orgValue": "<site Network Id>" } — the site's Network Id (0DB... from connect/communities, not urlPathPrefix); re-read to confirm.

Step 5b — Verify the site is active, published, and the user is a member (BLOCKING — do before any success)

SLACK_PREFERRED_SITE and the Step-4 permset writes all return 200/201 even when the site can't serve the employee — a "success" summary is then wrong: IT Service lists come back empty / access-denied. Activation, membership, and publication are three distinct states — verify each; a failure of any is blocking — do not report setup complete. Remediation for any gap is programmatic (hand to experience-portal-create, which owns the activate/add-member/publish paths), UI as fallback — not UI-only:

1. Live (activation) — SELECT Status FROM Network WHERE Id = '<site Id>'; if != 'Live', hand off.
2. Member (per Step-4 user) — SELECT Id FROM NetworkMember WHERE NetworkId = '<site Id>' AND MemberId = '<user Id>'; 0 rows → hand off (add the profile/permset to Members).
3. Published — Network.Status = 'Live' does not prove the pages are published (a never-published site 404s); if it was only activated, hand off to publish.

→ references/site-membership-verification.md — exact queries, remediation, and the silent-success failure mode.