Connectors
Microsoft Teams Channel
Microsoft Teams Channel
Updated 2026-08-16
Automation Guide for Bloo
1. Overview
Microsoft Teams is a collaborative workspace within Microsoft 365/Office 365 that is used for workplace conversations.
2. Configuration
| ⚠ Important: Webhook Method ChangeMicrosoft retired the Office 365 Connector-based incoming webhook method on May 22, 2026.Any existing webhook URLs created through the old Office 365 Connector method will no longer work.You must now create a webhook URL through the Workflows app inside Microsoft Teams.The payload format shown in this guide remains valid and works with the new Workflows webhook URL.Source: Microsoft Developer Blog — Retirement of Office 365 Connectors within Microsoft Teams (April 14, 2026). |
How to create a webhook using the Workflows app:
1. In your Microsoft Teams channel, click the three dots (...) next to the channel name.
2. Select Workflows from the menu.
3. Search for and select Post to a channel when a webhook request is received.
4. Configure the workflow and click Save.
5. Copy the webhook URL that is generated. Use this URL in the Bloo Configuration Box.
For step-by-step guidance, refer to: Create incoming webhooks with Workflows for Microsoft Teams — Microsoft Support
- In the Configuration Box, enter the Configuration Name to uniquely identify this configuration.
- Create a webhook for your Microsoft Teams channel using the Workflows app as described above. Refer to Add an incoming webhook — Microsoft Learn for additional details.
- Identify the content of headers and payload that you need to provide in the Configuration Box. Refer to Send messages in Teams using incoming webhooks — Microsoft Support for the payload format.

Below is an example of how you can leverage this integration to send alerts to your Microsoft Teams Channel.
Payload
{ "text":"Alert from Bloo – Found Suspicious Remote Desktop Activity on host DstIP"}
Microsoft Teams delivers the text mentioned in the Payload to your MS Teams channel.


In the above figure, a workbook named Suspicious Remote Desktop Network Activity is executed which contains the following blocks:
- SQL Block: Displays two suspicious Destination IPs on execution of the workbook.
- Signal Block: This will raise a signal on detecting the suspicious IPs.
- DQL Block with _trigger query: Using Webhook integration for Microsoft Teams Channel, an alert will be raised to the Teams channel with the message mentioned in the payload as displayed below:
3. Related Links
Related
Was this page helpful?