# Microsoft Teams Notifications

Deliver Capsule policy-violation notifications straight into a Microsoft Teams channel, so your team sees AI agent and shadow-AI signals where they already work.

## Overview

When a policy you've linked is violated, Capsule posts an **Adaptive Card** into a Teams channel of your choice. The card summarizes the violation - severity, policy, affected entity - with a link back into the Capsule portal.

You can add more than one Teams channel and link each to different policies, so (for example) high-severity violations post to your incident channel while everything else goes to a routing channel.

Capsule delivers to Teams through a **Power Automate Workflow** that you create on the target channel. The workflow gives you an HTTP endpoint; Capsule posts to that endpoint, and the workflow renders the card into the channel.

```
Capsule policy violation
  → Capsule posts to your Power Automate workflow URL
  → Power Automate "Post card in a chat or channel" action
  → Adaptive Card appears in your Teams channel
```

> The legacy Office 365 **"Incoming Webhook" connector** is **retired by Microsoft and not supported**. Use the Power Automate Workflows path described below.


## Prerequisites

Before you begin, ensure you have:

- A **Microsoft Teams** account that can create **Power Automate Workflows** in the target team
- The **team and channel** where you want Capsule notifications to appear
- A **Capsule Security** account with admin access


## 1. Create the workflow webhook

Create the workflow from the channel where you want Capsule to post.

1. In Teams, open the target channel, click the **⋯** (more options) next to the channel name, and choose **Workflows**.
2. Select the template **"Post to a channel when a webhook request is received."** (You can also start from [make.powerautomate.com](https://make.powerautomate.com) and pick the same template.)
3. Confirm the **team** and **channel** the workflow will post to.
4. Click **Add workflow**.
5. Copy the generated **HTTP POST URL**. This is the value you'll paste into Capsule.


> **If the "Add workflow" button is greyed out** - this is a known issue with the Teams **desktop and PWA apps**, where the save/add button can stay disabled. Open Teams in a **normal browser tab** instead, or create the workflow directly at [make.powerautomate.com](https://make.powerautomate.com). Allow browser sign-in, cookies, and popups for `make.powerautomate.com`, `login.microsoftonline.com`, and `teams.microsoft.com`.


### Treat the URL as a secret

The workflow URL embeds a signature (`sig=…`) that authorizes posting to your channel. **Anyone who has the full URL can post to the channel**, so treat it like a credential:

- Capsule stores it securely and **never displays it again** after you save - the channel shows only a masked form (host plus the last few characters).
- To **rotate** it, regenerate the URL in Power Automate, then paste the new URL into Capsule via **Edit** on the channel (see below).


## 2. Configure the channel in Capsule

1. Log in to the **Capsule Security** portal.
2. Go to **Settings → Notifications**.
3. Click **Add channel** and choose **Microsoft Teams**.
4. Enter a **display name** (how this channel appears in Capsule) and paste the **workflow URL** from step 1.
5. Click **Save & Test**.


### What the test actually proves

A passing test means Power Automate **accepted** the request - it returns `202 Accepted` the moment it receives the POST. It does **not** guarantee the card was posted to Teams: the workflow's downstream **"Post card in a chat or channel"** action runs afterward and can still fail.

**So after a successful test, confirm the card actually appears in your Teams channel.** If it doesn't, open the workflow's **run history** in Power Automate - that is the authoritative log of what happened after the request was accepted, and it will show where the post failed.

## 3. Link the channel to policies

A Teams channel only receives notifications for the policies you link to it. On the **policy edit** screen, add the Teams channel to the policy's notification channels - the same way you link any other notification destination. Link as many policies as you want; a channel with no linked policies stays idle.

## Troubleshooting

**Test passes, but no card appears in the channel.** The test only confirms Power Automate accepted the request (`202`); the downstream "Post card in a chat or channel" action can still fail. Open the workflow's **run history** in Power Automate to see the failure. The most common cause is the workflow being edited so it no longer posts the Adaptive Card the way Capsule sends it - recreate the workflow from the **"Post to a channel when a webhook request is received"** template.

**The channel row shows an Error state.** Capsule flips a channel to **Error** when a delivery fails, and records a (secret-free) reason. The usual causes are the workflow being **deleted or disabled**, or its signature being **regenerated** so the old URL no longer authorizes. Fix the workflow in Power Automate, then **Edit** the channel in Capsule and paste the current URL. A successful delivery clears the error and returns the channel to Active.

**Duplicate URL rejected.** Capsule rejects a workflow URL that another Teams channel already uses - the same workflow always posts to the same destination, so two channels pointing at it would be redundant. This check ignores the signature, so re-adding the **same workflow with a regenerated signature** is also treated as a duplicate; to rotate the signature, **Edit** the existing channel rather than adding a new one. To notify a **different** channel, create a **separate** workflow on that channel and use its URL.

**Rate limiting or transient failures.** If Power Automate is briefly unavailable or rate-limits a request, Capsule **retries automatically** with backoff - you don't need to do anything. Persistent failures surface as an **Error** state on the channel row.

## Support

For help with this integration:

- **Email**: support@capsule.security
- **Include**: Your organization ID, the affected channel's display name, and any error shown on the channel row


## References

- [Create incoming webhooks with Workflows for Microsoft Teams (Microsoft Support)](https://support.microsoft.com/en-US/teams/apps-service/create-incoming-webhooks-with-workflows-for-microsoft-teams)
- [Create and send messages using incoming webhooks (Microsoft Learn)](https://learn.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/add-incoming-webhook)
- [Retirement of Office 365 connectors within Microsoft Teams](https://devblogs.microsoft.com/microsoft365dev/retirement-of-office-365-connectors-within-microsoft-teams/)
- [Adaptive Cards](https://adaptivecards.io/)