Microsoft Teams Notifications

Deliver Capsule policy-violation notifications straight into a Microsoft Teams channel, so your team sees AI agent and shadow-AI signals where they already work.

When a policy you've linked is violated, Capsule posts an Adaptive Card into a Teams channel of your choice. The card summarizes the violation - severity, policy, affected entity - with a link back into the Capsule portal.

You can add more than one Teams channel and link each to different policies, so (for example) high-severity violations post to your incident channel while everything else goes to a routing channel.

Capsule delivers to Teams through a Power Automate Workflow that you create on the target channel. The workflow gives you an HTTP endpoint; Capsule posts to that endpoint, and the workflow renders the card into the channel.

Capsule policy violation
  → Capsule posts to your Power Automate workflow URL
  → Power Automate "Post card in a chat or channel" action
  → Adaptive Card appears in your Teams channel

The legacy Office 365 "Incoming Webhook" connector is retired by Microsoft and not supported. Use the Power Automate Workflows path described below.

Before you begin, ensure you have:

• A Microsoft Teams account that can create Power Automate Workflows in the target team
• The team and channel where you want Capsule notifications to appear
• A Capsule Security account with admin access

Create the workflow from the channel where you want Capsule to post.

1. In Teams, open the target channel, click the ⋯ (more options) next to the channel name, and choose Workflows.
2. Select the template "Post to a channel when a webhook request is received." (You can also start from make.powerautomate.com and pick the same template.)
3. Confirm the team and channel the workflow will post to.
4. Click Add workflow.
5. Copy the generated HTTP POST URL. This is the value you'll paste into Capsule.

If the "Add workflow" button is greyed out - this is a known issue with the Teams desktop and PWA apps, where the save/add button can stay disabled. Open Teams in a normal browser tab instead, or create the workflow directly at make.powerautomate.com. Allow browser sign-in, cookies, and popups for make.powerautomate.com, login.microsoftonline.com, and teams.microsoft.com.

The workflow URL embeds a signature (sig=…) that authorizes posting to your channel. Anyone who has the full URL can post to the channel, so treat it like a credential:

• Capsule stores it securely and never displays it again after you save - the channel shows only a masked form (host plus the last few characters).
• To rotate it, regenerate the URL in Power Automate, then paste the new URL into Capsule via Edit on the channel (see below).

1. Log in to the Capsule Security portal.
2. Go to Settings → Notifications.
3. Click Add channel and choose Microsoft Teams.
4. Enter a display name (how this channel appears in Capsule) and paste the workflow URL from step 1.
5. Click Save & Test.

A passing test means Power Automate accepted the request - it returns 202 Accepted the moment it receives the POST. It does not guarantee the card was posted to Teams: the workflow's downstream "Post card in a chat or channel" action runs afterward and can still fail.

So after a successful test, confirm the card actually appears in your Teams channel. If it doesn't, open the workflow's run history in Power Automate - that is the authoritative log of what happened after the request was accepted, and it will show where the post failed.

A Teams channel only receives notifications for the policies you link to it. On the policy edit screen, add the Teams channel to the policy's notification channels - the same way you link any other notification destination. Link as many policies as you want; a channel with no linked policies stays idle.

Test passes, but no card appears in the channel. The test only confirms Power Automate accepted the request (202); the downstream "Post card in a chat or channel" action can still fail. Open the workflow's run history in Power Automate to see the failure. The most common cause is the workflow being edited so it no longer posts the Adaptive Card the way Capsule sends it - recreate the workflow from the "Post to a channel when a webhook request is received" template.

The channel row shows an Error state. Capsule flips a channel to Error when a delivery fails, and records a (secret-free) reason. The usual causes are the workflow being deleted or disabled, or its signature being regenerated so the old URL no longer authorizes. Fix the workflow in Power Automate, then Edit the channel in Capsule and paste the current URL. A successful delivery clears the error and returns the channel to Active.

Duplicate URL rejected. Capsule rejects a workflow URL that another Teams channel already uses - the same workflow always posts to the same destination, so two channels pointing at it would be redundant. This check ignores the signature, so re-adding the same workflow with a regenerated signature is also treated as a duplicate; to rotate the signature, Edit the existing channel rather than adding a new one. To notify a different channel, create a separate workflow on that channel and use its URL.

Rate limiting or transient failures. If Power Automate is briefly unavailable or rate-limits a request, Capsule retries automatically with backoff - you don't need to do anything. Persistent failures surface as an Error state on the channel row.

For help with this integration:

• Email: support@capsule.security
• Include: Your organization ID, the affected channel's display name, and any error shown on the channel row

• Create incoming webhooks with Workflows for Microsoft Teams (Microsoft Support)
• Create and send messages using incoming webhooks (Microsoft Learn)
• Retirement of Office 365 connectors within Microsoft Teams
• Adaptive Cards