Skip to main content

Microsoft Teams Integration

Post formatted incident alerts to Teams channels.

Microsoft Teams Integration

Post formatted incident alerts, status updates, and drill notifications directly to your Microsoft Teams channels. CrownSync sends Adaptive Card messages via incoming webhooks — no OAuth or app registration required.

No OAuth required

This integration uses Microsoft Teams webhooks via the Workflows app. You do not need to register an Azure AD application or grant any API permissions.

Teams connector changes

Microsoft deprecated the legacy Incoming Webhook connector in December 2025. New webhooks must be created using the Workflows app. Existing webhook.office.com URLs will continue to work until Microsoft completes the migration, but new integrations should use the Workflows method described below.

Setup Steps

In Microsoft Teams

  1. Open the Teams channel where you want to receive notifications.
  2. Click … (more options) next to the channel name, then select Workflows.
  3. Search for “Post to a channel when a webhook request is received” and select it.
  4. Name the workflow (e.g. “CrownSync Playbooks”) and confirm the channel.
  5. Click Add workflow and copy the webhook URL. The URL will be in the format https://….logic.azure.com/….

In CrownSync

  1. Go to Admin → Integrations → Channels.
  2. Click Add Teams Channel.
  3. Paste the webhook URL you copied from Teams.
  4. Give the channel a label (e.g. “SOC — Critical Alerts”).
  5. Select which event types should be sent to this channel.
  6. Click Save. CrownSync will send a test message to confirm the connection.

Message Format

CrownSync sends messages as Adaptive Cards, which render natively in Teams with rich formatting:

  • Header — incident title and severity badge with colour coding (critical = red, high = orange, medium = amber, low = blue)
  • Facts — incident reference, playbook name, declared by, and timestamp
  • Action buttons— “View Incident” links directly to the incident timeline in CrownSync

Supported Events

  • incident.created — new incident declared
  • incident.status_changed — status updated (e.g. containment, eradication)
  • incident.severity_changed — severity escalated or de-escalated
  • incident.resolved — incident closed
  • drill.completed — drill finished with summary results
  • playbook.published — new playbook version published
  • collaborator.invited — external collaborator added

Troubleshooting

  • Messages not appearing: Verify the webhook URL is correct and has not been regenerated in Teams. Workflows can be disabled by Teams administrators — check with your Microsoft 365 admin if workflows are blocked for your organisation.
  • 403 Forbidden: The webhook URL may have expired or been revoked. Create a new workflow in Teams and update the URL in CrownSync.
  • Formatting issues: Ensure your Teams client is up to date. Adaptive Cards require Teams desktop 1.5+ or the web client.
  • Rate limits: Microsoft Teams applies rate limits to webhook workflows. CrownSync batches rapid-fire events to stay within limits.

Multiple channels

You can configure multiple Teams channels with different event filters. For example, send critical incidents to a “Security Alerts” channel and drill completions to a “Training” channel.

Integration instructions last verified: April 2026

Was this page helpful?