Receive Alert Notifications via Microsoft Teams
Setup Microsoft Teams integration and receive alert notifications from Last9.
Getting started
Last9 can send alert notifications and resolutions to Microsoft Teams channels. This document provides step-by-step instructions on how to set up Microsoft Teams integration with Last9 and start receiving alert notifications.
Setting up an Incoming Webhook in Microsoft Teams
-
Open Microsoft Teams and navigate to the channel where you want to receive alerts
-
Click on the … (more options) next to the channel name
-
Select Connectors (or Workflows in newer versions)
-
Search for Incoming Webhook and click Configure
-
Configure your webhook:
- Enter a Name for the webhook (e.g., “Last9 Alerts”)
- Optionally, upload a custom Image for the webhook
-
Click Create
-
Copy the generated webhook URL. It will look like:
https://<tenant>.webhook.office.com/webhookb2/<unique-id>/IncomingWebhook/<another-id>/<guid>For newer Power Automate Workflows, the URL format is:
https://prod-xx.westus.logic.azure.com:443/workflows/...
Setting up a notification channel in Last9
-
In Notification Channels, click Add to create a new channel

-
Provide the following details:
- Channel Name: A descriptive name to easily identify the channel (e.g., “Teams Production Alerts”)
- Channel: Select Webhook from the dropdown
- Webhook URL: Paste the Microsoft Teams webhook URL copied from the previous step
- Send Resolved: Enable this option if you want to be notified when an alert has been resolved

-
Click Save to enable the channel
Assigning a notification channel to an alert group
-
Navigate to your Alert Group in Alert Studio
-
Click on the notification channel icon to configure notifications
-
Select your Microsoft Teams channel from the dropdown
Microsoft Teams Notification Format
Last9 sends notifications to Microsoft Teams using the MessageCard format. Each notification includes:
| Section | Description |
|---|---|
| Title | Event type (TRIGGER/RESOLVED) with severity icon and alert summary |
| Theme Color | Color-coded based on severity |
| Activity | ”Alert from Last9” with timestamp |
| Facts | Structured alert details (severity, component, class, custom details) |
| Actions | Buttons linking to Last9 dashboard |
Severity Colors and Icons
| Severity | Color | Icon |
|---|---|---|
| Critical/Breach | Red (#FF0000) | 🔴 |
| Warning/Threat | Orange (#FFA500) | 🟠 |
| Info | Blue (#0000FF) | ℹ️ |
| Resolved | Green (#00FF00) | ✅ |
Using Terraform
You can also create the Microsoft Teams notification channel using the Last9 Terraform Provider:
resource "last9_notification_channel" "teams" { name = "teams-production-alerts" type = "webhook" destination = "https://your-tenant.webhook.office.com/webhookb2/..." send_resolved = true}Troubleshooting
Notifications not appearing in Teams
- Verify the webhook URL is correct
- Check that the webhook connector is still active in your Teams channel settings
- Ensure the channel still exists and you have permission to post
Rate limiting (429 errors)
Microsoft Teams has rate limits for incoming webhooks. Last9 automatically handles rate limiting with retry logic (up to 3 retries with 5-second delays). If you’re sending a high volume of alerts:
- Consider consolidating alerts using alert grouping
- Use different channels for different severity levels
Messages not formatting correctly
- Ensure you selected Webhook as the channel type
- Verify the webhook URL is from Microsoft Teams and ends with
.webhook.office.com - For newer Workflows URLs (
logic.azure.com), the generic JSON payload format will be used
Webhook URL formats
Last9 auto-detects and formats MessageCard notifications for URLs ending in .webhook.office.com:
- Supported format:
https://<tenant>.webhook.office.com/webhookb2/...
For newer Power Automate Workflows URLs, the generic webhook JSON format is used:
- Workflows format:
https://prod-xx.westus.logic.azure.com:443/workflows/...
Please get in touch with us on Discord or Email if you have any questions.