Connectors

Microsoft Teams Channel

Microsoft Teams Channel

Updated 2026-08-16


Automation Guide for Bloo

1. Overview

Microsoft Teams is a collaborative workspace within Microsoft 365/Office 365 that is used for workplace conversations.

2. Configuration

⚠ Important: Webhook Method ChangeMicrosoft retired the Office 365 Connector-based incoming webhook method on May 22, 2026.Any existing webhook URLs created through the old Office 365 Connector method will no longer work.You must now create a webhook URL through the Workflows app inside Microsoft Teams.The payload format shown in this guide remains valid and works with the new Workflows webhook URL.Source: Microsoft Developer Blog — Retirement of Office 365 Connectors within Microsoft Teams (April 14, 2026).

How to create a webhook using the Workflows app:

1. In your Microsoft Teams channel, click the three dots (...) next to the channel name.

2. Select Workflows from the menu.

3. Search for and select Post to a channel when a webhook request is received.

4. Configure the workflow and click Save.

5. Copy the webhook URL that is generated. Use this URL in the Bloo Configuration Box.

For step-by-step guidance, refer to: Create incoming webhooks with Workflows for Microsoft Teams — Microsoft Support

![Microsoft Teams Channel automation configuration box showing headers and payload fields](images/MSTeams Channel-img1.png)

Below is an example of how you can leverage this integration to send alerts to your Microsoft Teams Channel.

Payload

{  "text":"Alert from Bloo – Found Suspicious Remote Desktop Activity on host DstIP"}

Microsoft Teams delivers the text mentioned in the Payload to your MS Teams channel.

![Workbook showing the SQL block displaying suspicious Destination IPs](images/MSTeams Channel-img3.png)

![Alert message delivered to the Microsoft Teams channel based on the configured payload](images/MSTeams Channel-img2.png)

In the above figure, a workbook named Suspicious Remote Desktop Network Activity is executed which contains the following blocks:

  • SQL Block: Displays two suspicious Destination IPs on execution of the workbook.
  • Signal Block: This will raise a signal on detecting the suspicious IPs.
  • DQL Block with _trigger query: Using Webhook integration for Microsoft Teams Channel, an alert will be raised to the Teams channel with the message mentioned in the payload as displayed below:

Related

Was this page helpful?

We use cookies to provide essential site functionality and, with your consent, to analyze site usage and enhance your experience. View our Privacy Policy