> ## Documentation Index
> Fetch the complete documentation index at: https://zeropath.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Teams Integration

> Receive scan notifications and vulnerability alerts in your Microsoft Teams channels

## Overview

ZeroPath posts scan notifications and vulnerability alerts into Microsoft Teams channels as [Adaptive Cards](https://adaptivecards.io/). Each destination channel is registered separately, and notification rules choose which events go to which channels.

There is **no Azure AD app registration, tenant-wide admin consent, or Microsoft Graph permission** to arrange. ZeroPath delivers to a per-channel *incoming webhook* URL that a channel owner creates from inside Teams, so a single channel owner can enable alerts for their own channel without involving your Microsoft 365 tenant administrators.

<Note>
  The webhook URL is the entire credential for posting to that channel. Treat it like a password: anyone holding it can post to the channel. ZeroPath stores it encrypted and never displays it again after you save it.
</Note>

## Setup

### 1. Create the webhook in Teams

Do this once per channel you want alerts in.

1. In Microsoft Teams, open the channel and choose **… (More options) → Workflows**.
2. Select the **"Post to a channel when a webhook request is received"** template.
3. Confirm the team and channel, then click **Add workflow**.
4. Copy the generated **HTTP POST URL**. It looks like `https://prod-12.westus.logic.azure.com/workflows/…?sig=…`.

<Note>
  Creating a workflow requires permission to add workflows to that team. If the Workflows menu is missing, ask a team owner to create the workflow and send you the URL.
</Note>

### 2. Register the channel in ZeroPath

1. Navigate to **Settings → Integrations** in the ZeroPath dashboard.
2. Click **Add Integration**, then **Microsoft Teams**.
3. Enter a **channel label** — this is what appears in the notification-rule picker, so use the channel's name (for example `#appsec-alerts`).
4. Paste the **HTTP POST URL** from step 1 and save.

ZeroPath validates the URL host before accepting it; only Microsoft-issued webhook hosts (`*.logic.azure.com`, `*.webhook.office.com`, `*.azure-apihub.net`, `*.powerplatform.com`) over HTTPS are allowed.

To add more channels later, select the **Microsoft Teams** integration in **Settings → Integrations** and use **Add a channel**.

### 3. Send a test message

In the Microsoft Teams integration panel, click the **send** icon next to a channel. ZeroPath posts a confirmation card using the same payload format real notifications use, so a successful test proves the channel accepts what ZeroPath actually sends — not merely that the URL resolves.

### 4. Route notifications to the channel

Teams channels receive nothing until a notification rule targets them.

1. Navigate to **Settings → Notifications**.
2. Create a rule (or edit an existing one) and select **Microsoft Teams** as a channel.
3. Tick the Teams channels the rule should deliver to.
4. Choose the event types, repository scope, and vulnerability score threshold.

A rule that selects Microsoft Teams must name at least one Teams channel, so a rule can never be enabled while delivering nowhere.

## Notification Types

Any notification event ZeroPath supports can be routed to Teams, including:

| Event                                                 | Description                                                                                       |
| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------- |
| **Repository added**                                  | A repository was connected to ZeroPath                                                            |
| **Scan started / complete / failed**                  | Full and scheduled scan lifecycle, including the automatic first scan of a newly added repository |
| **PR scan started / complete**                        | Pull request scan lifecycle                                                                       |
| **New vulnerabilities (full scan / PR)**              | Only fires when the scan found findings that are new                                              |
| **Vulnerability patched / reopened / status changed** | Triage and remediation activity                                                                   |
| **SCA and container findings**                        | New CVEs and new dependency or container image issues                                             |
| **SLA events**                                        | Findings aged past their SLA threshold, and high SLA burn rate                                    |

Set a **vulnerability score threshold** (0–100) on the rule to filter out low-severity noise: only findings scoring at or above the threshold are included.

### Notification Format

New-vulnerability notifications render one card section per finding, showing:

* **Title** — linked directly to the finding in the ZeroPath app
* **Severity** — coloured badge with the composite score (for example 🔴 Critical (92))
* **Status** — current finding status (Open, Patched, False positive, …)
* **Affected file** — the file and line where the finding was detected
* **Pull request** — the PR that triggered the scan, for PR scan notifications
* **Introduced by** — the git-blame author who introduced the vulnerable lines, when available
* **Description excerpt** — a short summary of the finding

Up to five findings appear per message, most severe first. When more findings than that exist, the card ends with a link to the full scan results in ZeroPath.

Teams and Slack notifications are generated from the same event templates, so the two channels stay consistent in wording, truncation, and which findings they include.

## Managing Channels

Select the **Microsoft Teams** integration in **Settings → Integrations** to manage destinations:

* **Send a test message** — verifies the webhook still accepts posts.
* **Remove a channel** — deletes the stored webhook URL. Notification rules that named it are updated: the channel is dropped from each rule, rules with no Teams channels left stop targeting Teams, and a rule left with no channels at all is disabled.
* **Disconnect Microsoft Teams** — removes every registered channel and updates the rules that targeted them.

A channel shown as **Paused** is skipped at delivery time. ZeroPath pauses a channel when Teams permanently rejects its webhook (for example the workflow was deleted or turned off); re-create the workflow in Teams and add the new URL as a channel.

Because the webhook URL is write-only, an existing channel cannot be edited — replace it by removing the channel and adding the new URL.

## Rate Limiting

Deliveries to each Teams channel are paced independently, and a channel that starts failing is backed off exponentially. One misbehaving destination therefore cannot slow deliveries to your other channels or to other integrations.

Teams rejects oversized cards, so ZeroPath truncates titles, descriptions, and headlines to keep every card comfortably inside the limit.

## Troubleshooting

**Not receiving notifications**

* Confirm a notification rule selects **Microsoft Teams** *and* ticks the specific channel — registering a channel alone delivers nothing.
* Check the rule is enabled and covers the repository and event type you expect.
* Verify the score threshold isn't filtering out every finding.
* Send a test message to confirm the webhook still works.

**"Invalid Microsoft Teams webhook URL"**

* The URL must be HTTPS and on a Microsoft webhook host. Copy the **HTTP POST URL** from the Teams workflow itself rather than a browser address bar, and paste it whole.

**The channel shows as Paused**

* Teams permanently rejected the webhook. Check the workflow still exists and is turned on in Teams; if it was deleted, create a new one and register the new URL.

**Teams shows a card with literal `<` or `&amp;`**

* Report this as a bug: notification text is translated from Slack's markup dialect into the markdown Teams renders, and stray escapes indicate a template that bypassed that translation.