Azure Sign-On and Activation Reference

Landing page token resolution, activation, webhook ingestion, and org binding are implemented in the product runtime.

Marketplace buyers can create a workspace, bind the purchase, and continue to deployment without internal ops handling.

The Teams finance tab exchanges native Teams SSO for Microsoft Graph and reads the signed-in user plus workspace metadata when tenant consent and secret configuration are present.

Power Automate finance workflows can call a shipped Decionis policy-check endpoint and register webhook triggers through the published connector spec before executing or resuming an action.

The shipped Teams package installs to a team by default: a team-scoped governance tab and a registered bot that posts auto-escalated actions into the team channel as interactive Approve/Reject cards. Channel routing binds automatically when Decionis is added to a channel, and gate-time escalations fan out a card with a signed Decision Dossier. The capability stays partial only until Microsoft completes bot/team-scope validation in the target tenant. SharePoint Framework remains a separate planned workload.

Business-app extensions remain a follow-on package track and are not required for the base marketplace offer.

Security evidence export is supported; direct productized Microsoft Security service integrations are tracked as a later workload.