Skip to main content

​
Overview

ZeroPath posts scan notifications and vulnerability alerts into Microsoft Teams channels as Adaptive Cards. Each destination channel is registered separately, and notification rules choose which events go to which channels. ZeroPath delivers to a per-channel incoming webhook URL created through Teams Workflows. Each channel can use Webhook URL only, or Microsoft Entra ID authentication with its own tenant ID, application ID, and client secret. Entra authentication requires an app registration in the workflow’s tenant; Microsoft Graph permissions are not required.
Treat webhook URLs and client secrets like passwords. ZeroPath stores them encrypted and never displays them again after saving. For URL-only workflows, anyone holding the webhook URL can post to the channel.

​
Setup

​
1. Create the webhook in Teams

Do this once per channel you want alerts in.
  1. In Microsoft Teams, open the channel and choose … (More options) → Workflows.
  2. Select the “Post to a channel when a webhook request is received” template.
  3. Confirm the team and channel, then click Add workflow. Open the workflow’s When a Teams webhook request is received trigger and configure Who can trigger the flow?:
    • Anyone for URL-only delivery.
    • Specific users in my tenant for Entra authentication; follow the app registration steps below. Any user in my tenant also supports Entra authentication, but does not restrict the caller to one service principal.
  4. Save the workflow and copy its HTTP POST URL. Microsoft issues URLs on hosts such as *.logic.azure.com and *.powerplatform.com.

​
Set up Microsoft Entra authentication

  1. In the Microsoft Entra admin center, open App registrations → New registration. Register an application for your organization’s directory. Ask your tenant administrator if you cannot create app registrations.
  2. Copy the app’s Directory (tenant) ID and Application (client) ID from its overview.
  3. Under Certificates & secrets, create a client secret and copy its Value immediately. The secret ID is not the secret value. Record its expiry so you can rotate it before it expires.
  4. Open Enterprise applications, find the application using its client ID, and copy the enterprise application’s Object ID. This identifies the service principal; it is different from both the client ID and the app registration’s object ID.
  5. In the workflow trigger, choose Specific users in my tenant and put the service principal object ID in Allowed users. Save and copy the current webhook URL.
ZeroPath obtains and renews tokens automatically for the Power Automate service. You do not need to paste access tokens or grant Microsoft Graph permissions. Authentication currently supports Microsoft’s public cloud. See Microsoft’s workflow authentication documentation for allowed principals and tenant restrictions.
Creating a workflow requires permission to add workflows to that team. If the Workflows menu is missing, ask a team owner to create the workflow and send you the URL.

​
2. Register the channel in ZeroPath

  1. Navigate to Settings → Integrations in the ZeroPath dashboard.
  2. Click Add Integration, then Microsoft Teams.
  3. Enter a channel label — this is what appears in the notification-rule picker, so use the channel’s name (for example #appsec-alerts).
  4. Paste the HTTP POST URL from step 1.
  5. Select Webhook URL only for an Anyone workflow, or Microsoft Entra ID and enter the tenant ID, client ID, and client secret value.
  6. Save the channel. Saving stores the configuration; use Send a test message to verify delivery.
ZeroPath validates the URL host before accepting it; only Microsoft-issued webhook hosts (*.logic.azure.com, *.webhook.office.com, *.azure-apihub.net, *.powerplatform.com) over HTTPS are allowed. To add more channels later, select the Microsoft Teams integration in Settings → Integrations and use Add a channel.

​
3. Send a test message

In the Microsoft Teams integration panel, click the send icon next to a channel. ZeroPath posts a confirmation card using the same payload format real notifications use, so a successful test proves the channel accepts what ZeroPath actually sends — not merely that the URL resolves.

​
4. Route notifications to the channel

Teams channels receive nothing until a notification rule targets them.
  1. Navigate to Settings → Notifications.
  2. Create a rule (or edit an existing one) and select Microsoft Teams as a channel.
  3. Tick the Teams channels the rule should deliver to.
  4. Choose the event types, repository scope, and vulnerability score threshold.
A rule that selects Microsoft Teams must name at least one Teams channel, so a rule can never be enabled while delivering nowhere.

​
Notification Types

Any notification event ZeroPath supports can be routed to Teams, including: Set a vulnerability score threshold (0–100) on the rule to filter out low-severity noise: only findings scoring at or above the threshold are included.

​
Notification Format

New-vulnerability notifications render one card section per finding, showing:
  • Title — linked directly to the finding in the ZeroPath app
  • Severity — coloured badge with the composite score (for example 🔴 Critical (92))
  • Status — current finding status (Open, Patched, False positive, …)
  • Affected file — the file and line where the finding was detected
  • Pull request — the PR that triggered the scan, for PR scan notifications
  • Introduced by — the git-blame author who introduced the vulnerable lines, when available
  • Description excerpt — a short summary of the finding
Up to five findings appear per message, most severe first. When more findings than that exist, the card ends with a link to the full scan results in ZeroPath. Teams and Slack notifications are generated from the same event templates, so the two channels stay consistent in wording, truncation, and which findings they include.

​
Managing Channels

Select the Microsoft Teams integration in Settings → Integrations to manage destinations:
  • Send a test message — verifies the webhook still accepts posts.
  • Edit authentication — switch authentication modes, replace app credentials, or supply a replacement webhook URL without changing the channel’s notification rules. Leave the replacement URL empty to keep the saved URL. Entra updates require the client secret value each time; saved secrets are never prefilled.
  • Remove a channel — deletes the stored webhook URL. Notification rules that named it are updated: the channel is dropped from each rule, rules with no Teams channels left stop targeting Teams, and a rule left with no channels at all is disabled.
  • Disconnect Microsoft Teams — removes every registered channel and updates the rules that targeted them.
A channel shown as Paused is skipped at delivery time. ZeroPath pauses a channel when Microsoft permanently rejects its webhook or credentials. Update the configuration through Edit authentication, then send a test message. A successful test resumes delivery; saving alone does not reactivate a paused channel. To rotate a client secret, create a new secret in Entra, save its value through Edit authentication, and send a test message before retiring the old secret. If Microsoft changes the webhook URL when you switch authentication modes, supply that new URL in the same update.

​
Rate Limiting

Deliveries to each Teams channel are paced independently, and a channel that starts failing is backed off exponentially. One misbehaving destination therefore cannot slow deliveries to your other channels or to other integrations. Teams rejects oversized cards, so ZeroPath truncates titles, descriptions, and headlines to keep every card comfortably inside the limit.

​
Troubleshooting

Not receiving notifications
  • Confirm a notification rule selects Microsoft Teams and ticks the specific channel — registering a channel alone delivers nothing.
  • Check the rule is enabled and covers the repository and event type you expect.
  • Verify the score threshold isn’t filtering out every finding.
  • Send a test message to confirm the webhook still works.
“Invalid Microsoft Teams webhook URL”
  • The URL must be HTTPS and on a Microsoft webhook host. Copy the HTTP POST URL from the Teams workflow itself rather than a browser address bar, and paste it whole.
The channel shows as Paused
  • Check the workflow exists and is turned on. For authenticated channels, check the client secret has not expired and the service principal is allowed by the trigger. Update the configuration and send a test to resume delivery.
Authentication failed
  • Ensure the tenant ID and application ID belong to the workflow’s tenant, and use the client secret value, not its ID.
  • For Specific users in my tenant, use the service principal object ID from Enterprise applications in Allowed users.
  • Match ZeroPath’s authentication mode to the workflow: URL-only requires Anyone, while Entra requires an authenticated trigger. Microsoft rejects an Authorization header on an Anyone trigger.
  • Use Edit authentication to replace expired or revoked credentials. Token-service outages and throttling are retried without pausing the channel.
Teams shows a card with literal < or &amp;
  • Report this as a bug: notification text is translated from Slack’s markup dialect into the markdown Teams renders, and stray escapes indicate a template that bypassed that translation.