Skip to main content

Microsoft Teams

Posts an alert as a card into a Microsoft Teams channel.

Teams needs no app install, no admin consent, and no credentials stored in Willow. You create a Workflow on the channel in Teams, paste the URL it gives you into Willow, and you're done — roughly two minutes per channel.

Willow ──POST Adaptive Card──▶ Workflows URL ──▶ your Teams channel

Before you start​

The person doing this needs:

  • Permission to add a workflow to the target Teams channel (being a member is normally enough).
  • Power Automate available in the tenant. The seeded licence included with most Microsoft 365 plans covers the template used here, but a tenant admin can block the Workflows app entirely — if the menu item is missing, that's why.

Private and shared channels are supported.

Create the workflow in Teams​

  1. In Teams, open the channel you want alerts in.
  2. Select the channel's ··· menu → Workflows.
  3. Choose the template Post to a channel when a webhook request is received.
  4. Confirm the connection when prompted, then pick the team and channel. Give the flow a recognizable name, for example willow-security-alerts.
  5. Select Create flow.
  6. Copy the HTTP POST URL it shows you. It looks like https://prod-00.westeurope.logic.azure.com/workflows/… and is several hundred characters long.
Treat the URL like a password

Anyone holding that URL can post messages into the channel. It carries its own signature and needs no other credential. Don't paste it into a ticket or a shared doc.

Add it to Willow​

  1. Go to Security → Alerts → Channels.
  2. Under Destinations, select Teams channel.
  3. Give it a name — this is what you'll pick from when building rules, so name it after the channel, e.g. Security — Alerts.
  4. Paste the Workflow URL.
  5. Select Add, then Test on the new row to confirm a card lands in the channel.

Use it on a rule​

Teams posts to channels, not to people, so a rule delivery needs at least one Teams destination selected:

  1. Open or create a rule under Security → Alerts → Rules.
  2. On a delivery, turn on Microsoft Teams under How it reaches them.
  3. Pick one or more Teams channels.
  4. Save, then Test the delivery.

The delivery's audience is ignored for Teams. If you also want the people involved notified individually, add Email, Slack, or Willow Admin to the same delivery — the audience applies to those.

What the card looks like​

The card carries the notification title, the message, and a fact list: severity, which guard or scan detected it, the source, the skill or tool involved, who triggered it, the device, and the timestamp in UTC. A View alert button deep-links to the alert's detail panel in Willow.

Custom templates apply here, so the title and message are whatever you configured.

What Teams can't do​

These are Microsoft platform limits, not Willow ones:

Messages arrive from the Workflows bot. The sender shows as Teams' own Workflows (Flow bot) identity, not Willow, and the name and icon can't be customized for webhook-posted cards.

No direct messages. Willow can post to channels but can't DM people on Teams. Use Email or Slack to reach individuals.

No interactive buttons. A Workflows webhook has nothing behind it to receive a button press, so cards use link buttons only. This matters for New integration requested: on Slack you get working Approve/Reject buttons, whereas on Teams you get a link into Willow to decide there.

Timestamps are UTC. Teams has no per-viewer date rendering, so the card shows a fixed UTC time rather than each reader's local time.

If any of these are blockers, use Slack for the interactive and DM cases and keep Teams for channel visibility. The two can sit on the same delivery.

The simplest alternative: the channel's email address​

If you only need alerts visible in a Teams channel and the card formatting doesn't matter, you can skip this integration entirely. Every Teams channel has an email address:

  1. In Teams, open the channel's ··· menu → Get email address, and copy it.
  2. In Willow, on any rule delivery, turn on Email and paste the address into Extra addresses.

Alerts then arrive as emails in the channel. It needs no workflow and no destination, but the trade-offs are real: it renders as an email post rather than a card, a Teams admin can disable email integration tenant-wide (Teams admin center → Teams settings → Email integration), team owners can restrict which domains may send, and it isn't available on Government plans.

Use this to validate that people actually want alerts in Teams, then move to a Workflows destination for the better format.

Troubleshooting​

Test fails with an HTTP 400. The flow rejected the card. This is almost always a flow that was edited away from the default template — recreate it from Post to a channel when a webhook request is received without modifying the steps.

Test fails with 403 or 404. The workflow no longer exists, has been turned off, or its URL was regenerated. Recreate the workflow in Teams and paste the new URL into the destination.

Willow rejects the URL when you save it. Two URLs get pasted here by mistake:

  • A webhook.office.com URL is a retired Office 365 connector. Microsoft disabled those in May 2026; create a Workflows webhook instead.
  • A teams.microsoft.com URL is a link to the channel, not a webhook. Use the ··· menu → Workflows.

"Teams card is over the byte limit". Teams caps cards at about 28 KB. A template referencing a very large token can exceed it — shorten the message.

Cards stopped arriving after a while. Check the flow is still enabled in Power Automate. Flows in a trial or unlicensed environment can be suspended by Microsoft; the destination's Test button will show the failure.

Nothing arrives and there's no error. Confirm the rule delivery has this destination selected. A delivery with Teams turned on but no destination picked records a failure rather than sending.

On this page