Skip to content

Microsoft Teams Webhook

Service Name: Microsoft Teams

Service Description: Microsoft Teams is a collaboration platform that combines workplace chat, video meetings, file storage, and application integration. Webhooks allow external systems to post messages to Teams channels.

Service Address: https://teams.microsoft.com/

Validation Type: -

IP Allow list: Does not exist

Secret Access Scope: Grants the ability to post messages to a specific Microsoft Teams channel

Secret Revokement URL: Does not exist

Secret Example: https://example.webhook.office.com/webhookb2/a1b2c3d4-e5f6-7890-a1b2-c3d4e5f67890@a1b2c3d4-e5f6-7890-a1b2-c3d4e5f67890/IncomingWebhook/1a2b3c4d5e6f7890abcdef1234567890/a1b2c3d4-e5f6-7890-a1b2-c3d4e5f67890

Suspicious Activity Investigation Instructions:

  • Review Microsoft Teams channel for unauthorized or suspicious messages
  • Check webhook activity logs in Microsoft Teams admin center
  • Examine source systems that might be using the webhook for unusual activity
  • Look for increased frequency or volume of messages being posted via the webhook

Mitigation Instructions:

  • Delete the existing webhook in Microsoft Teams channel settings
  • Create a new webhook with a different URL if the integration is still needed
  • Update all legitimate systems with the new webhook URL
  • Consider implementing IP restrictions on webhook access if available
  • Review and update access controls for systems authorized to use the webhook