Azure Sign-On and Activation Reference

Landing page token resolution, activation, webhook ingestion, and org binding are implemented in the product runtime.

Marketplace buyers can create a workspace, bind the purchase, and continue to deployment without internal ops handling.

The Teams finance tab now exchanges native Teams SSO for Graph and reads the signed-in reviewer plus bound team/channel metadata when tenant consent and secret configuration are present.

Power Automate finance workflows can call a shipped Decionis policy-check endpoint and register webhook triggers through the published connector spec before executing or resuming an action.

The shipped Microsoft 365 package now includes the operational Teams finance collaboration tab plus the hosted Teams, Outlook, and Microsoft 365 personal-app runtime that resolves tenant context automatically. Bot-backed interactive review cards remain runtime-ready but stay out of the public package until the Azure Bot registration and channel-scope validation are complete. SharePoint Framework remains a separate planned workload.

Business-app extensions remain a follow-on package track and are not required for the base marketplace offer.

Security evidence export is supported; direct productized Microsoft Security service integrations are tracked as a later workload.