Microsoft Teams integration
Get Maskflare alerts in Microsoft Teams
- Request blocked, File blocked, Malicious file and Block spike
- Policy change proposed and Policy change decided, for approvers
- Device unprotected, API key expiring, Invitation pending and Issue reported
- Config changed, API key created and the Weekly digest
If your security and compliance teams work in Teams, alerts should land there. Maskflare has a Microsoft Teams destination type that sends each event as an Adaptive Card to a channel.
You create the webhook in Teams with a workflow, paste its URL into Maskflare, and choose the events. Each card shows the event, a short list of metadata fields and a button that opens it in the console.
What it does
- Request blocked, File blocked, Malicious file and Block spike
- Policy change proposed and Policy change decided, for approvers
- Device unprotected, API key expiring, Invitation pending and Issue reported
- Config changed, API key created and the Weekly digest
Set up Microsoft Teams with Maskflare
Maskflare posts an Adaptive Card to a Teams channel through a Workflows webhook URL. Cards show a fixed set of metadata fields and a link back to the console.
- In Microsoft Teams, open Workflows and choose a template that posts webhook alerts to a channel. Template names change, so look for one that starts from a webhook request. Select the team and channel and save the workflow.
- Because Maskflare sends no Microsoft sign-in, choose a template that accepts requests from anyone who has the URL, and keep the URL secret.
- Copy the webhook URL from the workflow's details page.
- In the Maskflare console, open Connections, then Integrations and select Add endpoint.
- Set Destination to Microsoft Teams and paste the URL. Add a Description, tick the events to send, then select Add endpoint and Done.
- Select Send test event on the endpoint row to check a card arrives in the channel.
What data is shared
- Each card shows the event title, your organization, a list of fields when they apply (environment, provider, model, outcome, reason, rule key, counts) and an Open in Maskflare button.
- Never sent: prompts, responses, file names or contents, detected values, the free-text description of an issue report, a person's email address or the details of a configuration change.
- Anyone who can see the Teams channel can see these fields.
Good to know
- Teams accepts the Request processed event, but it posts one card per AI request, which buries a channel. Use Splunk or an HTTPS endpoint for that feed.
- Treat the webhook URL as a secret. Maskflare stores it with the endpoint and never writes it to its logs.
- Each delivery is retried on failure, up to six attempts in all, and the Deliveries view shows recent attempts.
- Microsoft changes how Teams webhooks are created from time to time. If the steps differ from what you see, follow Microsoft's current instructions to get a webhook URL that accepts a message with an Adaptive Card attachment.
Vendor documentation
Frequently asked questions
Which kind of Teams webhook does Maskflare use?
A Teams Workflows webhook. The destination sends an Adaptive Card in a message envelope, which that kind of workflow accepts.
Do Teams cards contain prompts?
No. Cards contain a fixed list of metadata fields and counts and a link to the console. Prompts and detected values are never included.
Can approvers be alerted in Teams?
Yes. Tick Policy change proposed and Policy change decided, and the channel sees changes that need a second approver.
Other siem and alerting integrations
See it on your own data
Try Maskflare free.
Bring your hardest prompts.
28-day free trial or 10,000 requests, whichever comes first. Point one app at the gateway or enroll a few laptops,
and watch what gets masked. Or talk to us first.
- SOC 2 Type II: In progress
- ISO 27001: In progress
- EU hosting by default · on-premises available
- Prompts and files never stored
- Never used to train AI models
- GDPR · nDSG · DPA available
- Trust center →