# Receive Alert Notifications via Microsoft Teams

> Setup Microsoft Teams integration using Workflows webhooks and receive alert notifications from Last9.

Source: https://last9.io/docs/msteams-integration/

## Getting started

Last9 can send alert notifications and resolutions to Microsoft Teams channels using Teams Workflows (Power Automate) webhooks. This document provides step-by-step instructions on how to set up the integration and start receiving alert notifications.

:::tip
Last9 sends rich Adaptive Card notifications to Microsoft Teams with color-coded severity indicators, structured facts, and action buttons linking directly to your Last9 dashboard.
:::

:::caution
Microsoft retired Office 365 connectors in Teams in May 2026. Webhook URLs created through the legacy **Connectors** option (`*.webhook.office.com`) no longer work. Use the **Workflows** app as described below.
:::

## Creating an incoming webhook with Workflows

1. Open Microsoft Teams and navigate to the channel where you want to receive alerts

2. Click **...** (more options) next to the channel name and select **Workflows**

3. Choose the template **Send webhook alerts to a channel**

4. Give the workflow a name (e.g., "Last9 Alerts") and verify the Microsoft Teams connection shows a green check

5. Select the **Team** and **Channel** where alerts should be posted

6. Click **Add workflow** and copy the generated **HTTP POST URL**. It will look like one of:

   ```
   https://default<id>.<region>.environment.api.powerplatform.com/powerautomate/automations/direct/workflows/<workflow-id>/triggers/manual/paths/invoke?...
   ```

   ```
   https://prod-<nn>.<region>.logic.azure.com:443/workflows/<workflow-id>/triggers/manual/paths/invoke?...
   ```

:::note
Keep this webhook URL secure. Anyone with access to this URL can post messages to your Teams channel.
:::

:::note

- You must be a **member** of the team to create a workflow for it. Guest accounts from other organizations cannot authenticate the Teams connection — the dialog stays stuck on "Signing in".
- Workflows webhooks are included with Microsoft 365 licenses. The webhook templates use only standard connectors, so no Power Automate premium license is required.
- If you build the workflow from scratch instead of the template, use the trigger **When a Teams webhook request is received** with **Who can trigger the flow** set to **Anyone**, followed by the action **Post card in chat or channel**.

:::

## Setting up a notification channel in Last9

1. In [Notification Channels](https://app.last9.io/alerting/notification-channels/), click **Add** to create a new channel

   ![Notification channels list](../../../../../assets/content/docs/alerting/overviews/notification-channels-overview/notification-channel-1.png)

2. Provide the following details:

   - **Channel Name**: A descriptive name to easily identify the channel (e.g., "Teams Production Alerts")
   - **Channel**: Select **Webhook** from the dropdown
   - **Webhook URL**: Paste the Workflows HTTP POST URL copied from the previous step
   - **Send Resolved**: Enable this option if you want to be notified when an alert has been resolved

   ![Add webhook channel](../../../../../assets/content/docs/alerting/overviews/notification-channels-overview/webhook-channel-config.png)

3. Click **Save** to enable the channel

:::tip
Last9 automatically detects Microsoft Teams Workflows webhook URLs (hosts ending in `.api.powerplatform.com` or `.logic.azure.com`) and formats notifications as Adaptive Cards.
:::

## Assigning a notification channel to an alert group

1. Navigate to your Alert Group in [Alerting](https://app.last9.io/alerting/)

2. Click on the notification channel icon to configure notifications

3. Select your Microsoft Teams channel from the dropdown

:::tip
You can set different notification channels for `threat` and `breach` notifications depending on the severity of the alerts.
:::

## Microsoft Teams notification format

Last9 sends notifications to Microsoft Teams as Adaptive Cards. Each notification includes:

| Section | Description                                                                                 |
| ------- | ------------------------------------------------------------------------------------------- |
| Title   | Event type (TRIGGER/RESOLVED) with severity icon and alert summary, color-coded by severity |
| Facts   | Structured alert details (severity, component, annotations, custom details)                 |
| Actions | Buttons linking to Last9 dashboards and runbooks                                            |

### Severity colors and icons

| Severity        | Title Color | Icon |
| --------------- | ----------- | ---- |
| Critical/Breach | Red         | 🔴   |
| Warning/Threat  | Orange      | 🟠   |
| Info            | Blue        | ℹ️   |
| Resolved        | Green       | ✅   |

:::note
Messages are posted by the **Workflows** bot (Flow bot). Microsoft does not support custom bot names or icons for Workflows webhooks.
:::

---

## Using Terraform

You can also create the Microsoft Teams notification channel using the [Last9 Terraform Provider](/docs/terraform-provider/):

```hcl
resource "last9_notification_channel" "teams" {
  name          = "teams-production-alerts"
  type          = "webhook"
  destination   = "https://default<id>.<region>.environment.api.powerplatform.com/powerautomate/automations/direct/workflows/..."
  send_resolved = true
}
```

---

## Troubleshooting

### Notifications accepted but not appearing in Teams

The Workflows webhook returns `202 Accepted` as soon as the request is received — card posting happens asynchronously inside the workflow. If alerts are not appearing:

1. Open [Power Automate](https://make.powerautomate.com), select your workflow, and check the **28-day run history** for failed runs
2. Verify the workflow's Teams connection is still valid (re-authenticate if it shows an error)
3. Ensure the target team and channel still exist and the workflow owner still has access

### Workflow creation stuck on "Signing in"

The Microsoft Teams connection cannot be authenticated by guest accounts from other organizations. Ask a member of the team's own organization to create the workflow.

### Rate limiting (429 errors)

Microsoft Teams has rate limits for incoming webhooks. Last9 automatically handles rate limiting with retry logic (up to 3 retries with 5-second delays). If you're sending a high volume of alerts:

- Consider consolidating alerts using alert grouping
- Use different channels for different severity levels

### Messages not formatting correctly

1. Ensure you selected **Webhook** as the channel type
2. Verify the webhook URL host ends with `.api.powerplatform.com` or `.logic.azure.com`

Please get in touch with us on [Discord](https://discord.com/invite/Q3p2EEucx9) or [Email](mailto:support@last9.io) if you have any questions.