Microsoft Teams

Connect a customer-owned Azure Bot, install its Teams package, and select standard channels for policy-violation alerts.

App and Integration Model

Each Team Server integration stores one Entra tenant ID, application ID, and secret. An Azure Bot connects that application to Teams and forwards installation events. The generated notification-only Teams app can be installed in multiple teams.

An application ID belongs to one integration. Use separate applications when audiences need independent credentials or lifecycle ownership.

Prerequisites

• Operator or Administrator access to Team Server
• Public HTTPS settings.tenant.base_url with a publicly trusted certificate
• Permission to register a single-tenant Entra application and secret
• An active Azure subscription and permission to create an Azure Bot
• Permission to upload a custom Teams app, or administrator assistance
• Outbound HTTPS to Microsoft identity and Bot Framework endpoints; inbound Bot Framework HTTPS to Team Server
• Configured workers, preferably BackgroundAsync, and a pipeline or deployment reporting violations

Only Microsoft’s public commercial cloud is supported; government and sovereign clouds are unsupported.

Register the Application

Open Integrations > Notify > Teams and select Get Started or Create.

1. Register an Entra Application

1. In Microsoft Entra admin center > App registrations > New registration, name the application and choose Accounts in this organizational directory only (Single tenant). Select Register.
2. Copy Directory (tenant) ID and Application (client) ID from Overview.
3. Under Certificates & secrets > Client secrets > New client secret, create a secret and copy its Value immediately, not the Secret ID.

2. Create the Team Server Integration

Enter a unique integration name, tenant ID, application ID, and secret value; select Continue. Team Server validates a fresh client-credential exchange before saving.

Tenant and application IDs cannot be edited. Create a replacement integration if either is wrong.

Configure the Azure Bot

3. Create the Azure Bot Resource

1. In the Azure portal, choose Create a resource > Azure Bot > Create.
2. Select subscription and resource group; complete data residency, bot handle, and pricing.
3. Choose Single Tenant and Use existing app registration. Enter the exact application and tenant IDs shown by Team Server. Do not create another registration.
4. Select Review + create, then Create.

An Entra registration does not grant subscription access. If no subscription appears, switch to its owning directory or ask an Azure administrator.

4. Set the Messaging Endpoint

Copy the integration’s displayed endpoint into Azure Bot > Settings > Configuration > Messaging endpoint, then Apply:

https://team-server.example.com/api/integrations/teams/messages/<application-id>

The endpoint uses settings.tenant.base_url. Microsoft must reach it over public HTTPS with a trusted certificate; private-only or localhost endpoints cannot receive installation events.

5. Enable the Teams Channel

In Settings > Channels, select Teams, accept the terms, choose Public (commercial), and Apply. App installation is still required.

Install the Teams Package

6. Download the Package

Select Download Teams package in Team Server. Keep the ZIP intact; it contains this application’s manifest and icons.

7. Upload and Install the Package

1. In Teams, open Apps > Manage your apps > Upload an app. Some interfaces call Apps Store. Upload the ZIP.
2. Select Endura Security > Add, choose a team and standard channel, then Go.
3. Confirm About this bot identifies it as notification-only, without chat or @mentions.
4. Return to Team Server. After Microsoft’s signed installation event arrives, the page refreshes to show the team and channel settings.

Install the same package in additional teams as needed. If uploads are unavailable, ask a Teams administrator to permit them or install the app.

Configure Alerts

Select Standard Channels

Select channels from installed teams and save. Private and shared channels are unsupported. No selected channels mutes delivery.

Choose Outcomes

Post an alert when a violation is detected starts on; Also alert on observed violations starts off. Enable observed outcomes while testing observe-mode policies, preferably in a low-traffic channel.

Scope Pipelines and Deployments

New integrations select All Pipelines and All Deployments. Narrow scope before sending to busy channels. See shared delivery rules.

Test and Verify

Test Channel Connectivity

Select channels and Test. A verification card goes to every current selection, including unsaved selections. Success confirms credentials and posting, not scope, outcome settings, notification enablement, or workers. Authentication failure can mark the integration Inactive.

Test End-to-End Delivery

1. Confirm connected and Active status; enable notifications and save channels and scope.
2. Run an in-scope build with a controlled violation; enable observed outcomes for observe mode.
3. Confirm the grouped alert and its run link. Later batches can produce more alerts.

Manage Credentials and Installations

Rotate an Expiring Client Secret

Create a replacement secret in the same Entra application. Enter its Value under Rotate client secret and select Rotate. Validation succeeds before replacement and restores Active status. Keep the old secret until rotation succeeds.

Remove the App from a Team

Uninstall the app in Teams. After the removal event, Team Server removes that installation and its selected channels. With no installations left, it returns to disconnected setup. Delivery also removes stale installations or channels when Microsoft reports them missing.

Delete the Integration

Deletion removes only the Team Server record. Remove or disable the Teams app, Entra application, and Azure Bot separately when unused.

Troubleshooting

Setup Does Not Complete

Check the public tenant URL and certificate, exact messaging endpoint, matching application and tenant IDs, enabled Public (commercial) Teams channel, intact ZIP, completed Add > Go installation, and inbound Bot Framework access.

Teams Rejects the Package

Download and upload a fresh, unmodified ZIP; older downloads retain their old manifest after a Team Server update. If rejection persists, confirm custom-app policy and ask a Teams administrator to review the validation error.

Channels Are Missing

Confirm installation in the expected team. Only standard channels appear. Reload after adding or renaming channels; rotate the secret on authentication errors.

Alerts Are Not Arriving

Check connected and Active status, notification enablement, selected channels, scope, observed outcomes, and app installation. Run Test, then check workers and application logs.

Integration Is Inactive

Explicit Microsoft authentication rejection marks an integration Inactive. status_reconcile revalidates installed integrations; transient Microsoft/network failures retain status. Rotate a replacement secret, or recreate the integration if its tenant or application ID is wrong.

Microsoft API Errors