Microsoft Teams
Send Safeguard notifications to a Microsoft Teams channel. What each connection type needs, the current limits, and step-by-step setup.
Teams notifications need a Safeguard update
Microsoft is retiring Microsoft 365 Connectors (the old Teams incoming webhooks) in favor of webhooks created with the Workflows app. The dialog's Incoming Webhook (Send Only) option accepts only connector URLs (webhook.office.com), so a Workflows webhook URL is refused today. The Bot Framework (Full Access) option cannot be verified with app credentials today either (see below). Until Safeguard is updated, Teams notifications work only with an existing connector webhook that Microsoft still delivers to.
What it does
The Teams card sends Safeguard notifications (new findings, scan results and alerts) to a Microsoft Teams channel. When you save a webhook connection, Safeguard posts a test message to the channel. Find the card under Integrations on the Notification tab.
Public vs private
This does not apply to Teams: you always connect a channel in your own Microsoft 365 tenant.
Supported auth methods
| Method (dialog label) | Use it when | Notes |
|---|---|---|
| Incoming Webhook (Send Only) | You have a connector webhook URL for the channel | Only https://...webhook.office.com/... URLs are accepted today |
| Bot Framework (Full Access) | Not usable today | Asks for Microsoft Tenant ID, App ID (Client ID) and App Secret (Client Secret) of a Microsoft Entra app, then lists teams and channels |
Permissions required
Safeguard only posts messages. It never reads channel messages, files or members.
Incoming webhook
| Permission | Required? | What Safeguard uses it for |
|---|---|---|
| The webhook URL itself | Required | Posting notifications to the channel the webhook belongs to. The URL is the credential |
Bot Framework (Microsoft Entra app, application permissions)
What the dialog's Bot Framework option calls, and what Microsoft Graph requires for it:
| Microsoft Graph call | Required? | Permission Microsoft lists | Status |
|---|---|---|---|
Check the credentials (GET /me) | Required | Delegated sign-in only | /me needs a signed-in user, so app-only credentials fail this check |
List teams (GET /me/joinedTeams) | Required | Team.ReadBasic.All | Same /me problem |
Post to a channel (POST /teams/{team}/channels/{channel}/messages) | Required | Application: Teamwork.Migrate.All, for migration only | Microsoft does not support posting normal channel messages with application permissions |
Least privilege: an incoming webhook. It can only post to its one channel.
Token types
| Credential | Works? | Notes |
|---|---|---|
Microsoft 365 Connector incoming webhook URL (webhook.office.com) | Yes, while Microsoft still delivers to it | Microsoft is retiring connectors |
| Workflows webhook URL ("When a Teams webhook request is received") | Not yet | Refused by the dialog's URL check |
| Microsoft Entra app (client ID and secret) | Not yet | See the Bot Framework notes above |
| A user's password or a delegated token | No |
Expiry: connector webhook URLs do not expire; delete the connector to revoke one. Entra client secrets expire on the date you choose.
What we never need: ChannelMessage.Read.All, Group.ReadWrite.All, Directory.Read.All or any administrator role.
Step-by-step setup
Create the credential in Teams
If your channel still has a working connector webhook, copy its URL from the connector's settings in the channel. Do not plan on new connector webhooks: Microsoft says the creation of new connectors will soon be blocked.
For reference, Microsoft's replacement is a Workflows webhook: in Teams, open the channel's More options (...), select Workflows, choose a template such as Send webhook alerts to a channel, configure it, select Save, and copy the webhook link. Safeguard does not accept these URLs yet.
Or check it with curl
curl -s -H "Content-Type: application/json" -d '{"text":"Safeguard test"}' "<webhook-url>"Connect it in Safeguard
- Open Integrations and choose the Notification tab.
- Click Connect on the Teams card.
- Enter an Integration Name and, optionally, a description.
- Under Authentication Type, choose Incoming Webhook (Send Only) and paste the Webhook URL.
- Click Next. "Webhook configured successfully. Messages will be sent to the channel associated with the webhook URL." means the test message was accepted. Click Connect.
Webhooks and triggers
This card only sends messages to Teams; it does not receive Teams events. Safeguard posts when the events you subscribed to happen (for example a scan finishing or a new critical finding).
What we read and store
- Read: nothing from Teams for a webhook connection.
- Stored: the connection's name and the webhook URL (or, for Bot Framework, the tenant ID, app ID and app secret). Safeguard never shows the secret again in the dialog.
- Sent to Teams: notification text about your Safeguard projects and findings.
- No customer data from this integration is sent to third-party LLMs.
Troubleshooting
| Message you see | Cause | Fix |
|---|---|---|
Invalid webhook URL format. Must be an Office 365 webhook URL. | The URL is not a webhook.office.com connector URL, for example a Workflows URL | Use an existing connector webhook; Workflows URLs are not supported yet |
Webhook validation failed: ... | Teams refused the test message, often because the connector was removed or retired | Check the connector still exists in the channel |
MS Tenant ID, App ID, and App Secret are required for Bot Framework authentication | A Bot Framework field is empty | Fill in all three, though the option cannot be verified today |
Validation failed: 400 BAD_REQUEST (Bot Framework) | Microsoft Graph refuses /me for app-only credentials | Use an incoming webhook |
Failed to obtain access token | The tenant ID, app ID or secret is wrong, or the secret expired | Copy the values from the app registration again |
Rotation and disconnect
- Rotate: create a new webhook in the channel, open the Teams connection on the Notification tab, choose Update, paste the new URL and choose Save Changes. Then remove the old webhook in Teams.
- Disconnect: choose Delete on the connection, then remove the webhook (or workflow) from the channel.
Vendor references
- Create an Incoming Webhook (Microsoft Teams), checked 2026-10-16.
- Send chatMessage in a channel (Microsoft Graph), checked 2026-10-16.
- List joinedTeams (Microsoft Graph), checked 2026-10-16.