Skip to content
Last9
Book demo

Receive Alert Notifications via Microsoft Teams

Setup Microsoft Teams integration using Workflows webhooks and receive alert notifications from Last9.

Getting started

Last9 can send alert notifications and resolutions to Microsoft Teams channels using Teams Workflows (Power Automate) webhooks. This document provides step-by-step instructions on how to set up the integration and start receiving alert notifications.

Creating an incoming webhook with Workflows

  1. Open Microsoft Teams and navigate to the channel where you want to receive alerts

  2. Click (more options) next to the channel name and select Workflows

  3. Choose the template Send webhook alerts to a channel

  4. Give the workflow a name (e.g., “Last9 Alerts”) and verify the Microsoft Teams connection shows a green check

  5. Select the Team and Channel where alerts should be posted

  6. Click Add workflow and copy the generated HTTP POST URL. It will look like one of:

    https://default<id>.<region>.environment.api.powerplatform.com/powerautomate/automations/direct/workflows/<workflow-id>/triggers/manual/paths/invoke?...
    https://prod-<nn>.<region>.logic.azure.com:443/workflows/<workflow-id>/triggers/manual/paths/invoke?...

Setting up a notification channel in Last9

  1. In Notification Channels, click Add to create a new channel

    Notification channels list

  2. Provide the following details:

    • Channel Name: A descriptive name to easily identify the channel (e.g., “Teams Production Alerts”)
    • Channel: Select Webhook from the dropdown
    • Webhook URL: Paste the Workflows HTTP POST URL copied from the previous step
    • Send Resolved: Enable this option if you want to be notified when an alert has been resolved

    Add webhook channel

  3. Click Save to enable the channel

Assigning a notification channel to an alert group

  1. Navigate to your Alert Group in Alerting

  2. Click on the notification channel icon to configure notifications

  3. Select your Microsoft Teams channel from the dropdown

Microsoft Teams notification format

Last9 sends notifications to Microsoft Teams as Adaptive Cards. Each notification includes:

SectionDescription
TitleEvent type (TRIGGER/RESOLVED) with severity icon and alert summary, color-coded by severity
FactsStructured alert details (severity, component, annotations, custom details)
ActionsButtons linking to Last9 dashboards and runbooks

Severity colors and icons

SeverityTitle ColorIcon
Critical/BreachRed🔴
Warning/ThreatOrange🟠
InfoBlueℹ️
ResolvedGreen

Using Terraform

You can also create the Microsoft Teams notification channel using the Last9 Terraform Provider:

resource "last9_notification_channel" "teams" {
name = "teams-production-alerts"
type = "webhook"
destination = "https://default<id>.<region>.environment.api.powerplatform.com/powerautomate/automations/direct/workflows/..."
send_resolved = true
}

Troubleshooting

Notifications accepted but not appearing in Teams

The Workflows webhook returns 202 Accepted as soon as the request is received — card posting happens asynchronously inside the workflow. If alerts are not appearing:

  1. Open Power Automate, select your workflow, and check the 28-day run history for failed runs
  2. Verify the workflow’s Teams connection is still valid (re-authenticate if it shows an error)
  3. Ensure the target team and channel still exist and the workflow owner still has access

Workflow creation stuck on “Signing in”

The Microsoft Teams connection cannot be authenticated by guest accounts from other organizations. Ask a member of the team’s own organization to create the workflow.

Rate limiting (429 errors)

Microsoft Teams has rate limits for incoming webhooks. Last9 automatically handles rate limiting with retry logic (up to 3 retries with 5-second delays). If you’re sending a high volume of alerts:

  • Consider consolidating alerts using alert grouping
  • Use different channels for different severity levels

Messages not formatting correctly

  1. Ensure you selected Webhook as the channel type
  2. Verify the webhook URL host ends with .api.powerplatform.com or .logic.azure.com

Please get in touch with us on Discord or Email if you have any questions.