Microsoft Teams Notifications

This channel provides notifications via Microsoft Teams. If this channel is active in a security system with Azure Active Directory, the messages are sent using the user’s External ID, which is linked via Azure Active Directory. If the External ID is not set (e.g. for local users) or if the Azure Active Directory is not configured, the user’s email address is used. If you enable this channel, you also need to:

Template

 1# Mail Channel for the 'default' Security System
 2# [engineDir]/configuration/ivy.yaml 
 3SecuritySystems:
 4  default:
 5    Notification:
 6      Channels:
 7        microsoft-teams:
 8          Name: microsoft-teams
 9          Enabled: true
10          Events:
11            AllKinds: enabled
12            Kinds:
13            - new-task
14          Config:
15            TenantId: 00000000-0000-0000-0000-000000000000
16            ClientId: 00000000-0000-0000-0000-000000000000
17            TechnicalUser:
18              Mail: example@example.com
19              Password: password
20            Proxy:
21              Url: https://proxy.local
22              UserName: proxyUser
23              Password: "${encrypt:abc}"

Reference

 1# The name of the channel
 2Name: microsoft-teams
 3# Whether the channel is enabled or not
 4Enabled: false
 5Events:
 6  # Whether all events are enabled or not (enabled for true)
 7  AllKinds: enabled
 8Config:
 9  # Azure AD Tenant ID
10  TenantId: 00000000-0000-0000-0000-000000000000
11  # Client ID provided by Azure AD when registering the application for sending messages
12  ClientId: 00000000-0000-0000-0000-000000000000
13  # The login credentials of the technical user used for sending messages
14  TechnicalUser:
15    Mail: example@example.com
16    Password: password
17  Proxy:
18    # Url of the forward proxy
19    Url: ""
20    # Username to authenticate against the forward proxy
21    UserName: ""
22    # Password to authenticate against the forward proxy
23    Password: ""

Technical User

Visit the Microsoft 365 admin center and create a new user by navigating to Users > Active users and clicking on Add a user. Give the user a display name that represents your Ivy Portal (e.g. “Ivy”). Other users will receive notifications in the form of chat messages by this user. Remove the checkmarks for Automatically create a password and Require this user to change their password when they first sign in. Provide the user with a secure password and keep note of it. Also, provide the user with a product license to be able to use Microsoft Teams.

Add a user - Set up the basics
Add a user - Assign product licenses

After creating the user, turn off multifactor authentication by clicking on the user and then Manage multifactor authentication. Make sure no other policies require the user to change their password regularly or prevent them from logging in for any other reasons.

Manage multifactor authentication

Add the mail address (TechnicalUser.Mail) and password (TechnicalUser.Password) of the technical user to the configuration of the Microsoft Teams Notification Channel.

Application

Visit the Microsoft Entra admin center and follow these instructions to register an application with the Microsoft identity platform. On step 5, choose Accounts in this organizational directory only.

Register an application

Navigate to Applications > Enterprise Applications and click on the newly registered application. Navigate to Properties in the section Manage. Set Assignment required? to Yes.

Application - Properties

Navigate to Users and Groups in the section Manage. Click on Add user/group > Users and groups and search for, select, and assign the technical user you created before. (See Technical User)

Application - Users and groups

Navigate to Applications > App registrations and click on the newly registered application. If you can not see it, make sure to change the selected tab to All applications. Navigate to Authentication in the section Manage. Set Allow public client flows to Yes.

Application - Authentication

Navigate to API permissions in the section Manage. Click on Add a permission > Microsoft Graph > Delegated permissions and search for, select, and add the following permissions:

  • Chat.Create

  • ChatMessage.Send

  • User.Read

Click on Grant admin consent for <tenant> above the table with the permissions and confirm the dialog.

Application - API permissions

Add the ID of your tenant (TenantId) and newly created application (ClientId) to the configuration of the Microsoft Teams Notification Channel.