Docs/Integrations/Microsoft Teams # Microsoft Teams
Connect a Microsoft Teams channel to a project to post governance alerts there as cards. Each project posts to one channel.
## What is posted
<div className="dv2-table-scroll"><table><thead><tr><th>Alert</th><th>How it is sent</th><th>Card</th></tr></thead><tbody><tr><td><strong>Unapproved model use</strong></td><td><strong>On demand</strong>: <strong>AI Agent Center</strong> > agent > <strong>Risk</strong> tab > <strong>Unapproved Models</strong>, then <strong>Send Compliance Notification</strong></td><td>"Compliance Alert": the agent, how many times it used unapproved models in the period, the models (up to 15, then "and *n* more"), a <strong>View Violation Traces</strong> button, and a reminder to approve the models</td></tr><tr><td><strong>Drift alerts</strong></td><td><strong>On demand</strong>: the <strong>Integrations</strong> column of a [drift alert](/docs/aigovernance/compliance/drift-alerts#send-an-alert-manually), then <strong>Send Drift Alert Notification</strong></td><td>"Governance Drift Alert": the agent and the alert description, the drift type, the severity, the declared and observed values, and a <strong>View Drift Alerts</strong> button</td></tr><tr><td><strong>Drift alerts</strong></td><td><strong>Automatic</strong>: the hourly drift check posts each new alert when [automatic drift notifications](#automatic-drift-alerts) are on</td><td>The same drift card</td></tr><tr><td><strong>Automation rules</strong></td><td><strong>Automatic</strong>: a <strong>Microsoft Teams</strong> action in an [automation rule](/docs/dashboards-automation/automations) posts when the rule's event happens, for example a guardrail violation or a Budget AI threshold. The <strong>Automations</strong> button on the Microsoft Teams page lists the rules that post to Teams.</td><td>The rule's title and message, the event, severity and rule, and an <strong>Open in ANTS</strong> button</td></tr></tbody></table></div>
Agent names, model names and drift text are shown as plain text in the card, never as links or formatting.
## Requirements
- A Teams channel where you can add a workflow, or an Incoming Webhook if your tenant still allows them.
- In ANTS Platform, the **Owner** role, or a [custom role](/docs/administration/custom-roles) with **Notification & analytics integrations** (under **Integrations & service accounts**) at **Read & Write**.
- The alerts come from [AI Agent Center](/docs/aigovernance/command-center) and [Drift Alerts](/docs/aigovernance/compliance/drift-alerts), which are Enterprise features.
## Create the webhook in Teams
ANTS Platform posts to a webhook URL that Teams gives you. Two kinds work:
- **Workflows** (recommended): a workflow built from the template **Post to a channel when a webhook request is received**.
- **Incoming Webhook**: the older Office 365 connector, if your tenant still allows it.
<Steps>
### Open Workflows in the channel
In Microsoft Teams, open the channel that should receive alerts, open its **More options** (**...**) menu and select **Workflows**.
### Choose the template
Select **Post to a channel when a webhook request is received**. Give the workflow a name, check the team and channel, and add the workflow.
### Copy the URL
Teams shows the workflow's webhook URL when the workflow is created. Copy it. Anyone who has this URL can post to the channel, so treat it as a secret.
</Steps>
ANTS Platform accepts only Microsoft webhook addresses over `https`:
<div className="dv2-table-scroll"><table><thead><tr><th>Host</th><th>Used by</th></tr></thead><tbody><tr><td><code>*.logic.azure.com</code></td><td>Workflows</td></tr><tr><td><code>*.api.powerplatform.com</code></td><td>Workflows</td></tr><tr><td><code>*.webhook.office.com</code></td><td>Incoming Webhooks</td></tr><tr><td><code>outlook.office.com</code></td><td>Incoming Webhooks</td></tr></tbody></table></div>
Any other host is refused when you save and again on every send. A URL with a user name or password in it is refused. On a self-hosted deployment, your administrator can allow more host names, for example for a sovereign cloud or a proxy. Private network and cloud metadata addresses are always refused.
## Connect the channel in ANTS Platform
<Steps>
### Open the integration
Go to **Project Settings > Integrations** and select **Configure** on the **Microsoft Teams** card. The **Microsoft Teams Integration** page shows the status as **Connected** or **Not connected**.
### Paste the URL
Select **Connect Microsoft Teams**, paste the URL into **Webhook URL** and select **Save**.
### Confirm it is you
If your deployment has [step-up verification](/docs/administration/authentication-and-security#step-up-verification) turned on, enter the code sent to your email. Connecting and replacing the URL ask for it, because they send data out of the platform. Disconnecting does not.
### Send a test message
Select **Send test message**. The card "ANTS Platform test message" should appear in the channel. If it does not, check that the workflow is turned on in Teams.
</Steps>
The URL is encrypted at rest and is never shown again, also not to the person who saved it. It does not appear in logs or in the [audit log](/docs/administration/audit-logs), which records only that Teams was connected, replaced or disconnected.
**Change the channel.** Select **Replace webhook URL** and paste the URL for the new channel. A project has one channel, so the new URL replaces the old one.
**Disconnect.** Select **Disconnect** and confirm. This deletes the stored URL, and alerts from this project are no longer posted to Teams. The workflow in Teams is not deleted. Turn it off or delete it in Teams if the URL may have been shared.
## Send alerts
Once Teams is connected, **Microsoft Teams** appears in the notify dialogs with the detail **Project channel**. It does not need a per-agent mapping.
**Unapproved model alerts.** In **AI Agent Center**, open an agent's **Risk** tab. In **Unapproved Models**, select the Teams icon (**Send to Microsoft Teams**), choose the destinations in **Send Compliance Notification** and select **Send Notification**. Nothing is sent if the agent has no unapproved model use in the period. See [Governance Notifications](/docs/aigovernance/notifications#unapproved-model-alerts).
**Drift alerts.** In the **Integrations** column of a drift alert, select the Teams icon, choose **Microsoft Teams** in **Send Drift Alert Notification** and send. An alert that was already posted to Teams is not posted again. See [Drift Alerts](/docs/aigovernance/compliance/drift-alerts#send-an-alert-manually).
### Automatic drift alerts
The hourly drift check also posts each new drift alert to the project's Teams channel when Teams is connected and automatic drift notifications are on. They are off by default and need both:
- background drift checks and automatic notifications turned on for your ANTS deployment (ask your ANTS administrator or support contact), and
- **Automatic drift incidents** turned on in **Organization Settings > Features**.
These are the same switches that open ServiceNow and PagerDuty incidents for drift. Teams needs no extra setting. See [Automatic notifications](/docs/aigovernance/compliance/drift-alerts#automatic-notifications).
## Permissions
<div className="dv2-table-scroll"><table><thead><tr><th>Action</th><th>Permission needed</th><th>Built-in roles</th></tr></thead><tbody><tr><td>View the Microsoft Teams settings</td><td><strong>Notification & analytics integrations</strong>, Read</td><td>Owner</td></tr><tr><td>Connect, replace the URL, send a test message, disconnect</td><td><strong>Notification & analytics integrations</strong>, Read & Write</td><td>Owner</td></tr><tr><td>Send unapproved model alerts</td><td><strong>AI Agent Center</strong></td><td>Owner, Department Admin, Security & Compliance, Cost Analyst</td></tr><tr><td>Send drift alerts</td><td><strong>Agent Profiles & Drift</strong></td><td>Owner, Department Admin, Security & Compliance, Auditor</td></tr></tbody></table></div>
Without write access the settings page shows "You need write access to notification integrations to change this." See [Members & Roles](/docs/administration/members-and-roles).
## Limits
- **One channel per project.** Alerts for every agent in the project go to the same channel. Per-agent channels are not supported.
- **Detection alerts through rules only.** The per-agent alerting on a detection policy goes to PagerDuty only. To post guardrail violations or other events to Teams, add a Microsoft Teams action to an [automation rule](/docs/dashboards-automation/automations).
- **No updates to a card.** Teams cards are not threaded or updated, so resolving a drift alert posts nothing.
- **Delivery is confirmed to the webhook, not to the channel.** A Workflows webhook accepts the card before its flow runs. If the flow fails later, for example because the channel was deleted or the workflow's connection expired, ANTS Platform still reports the alert as sent. Check the workflow's run history in Teams.
- **Shared automatic sends.** When the hourly drift check posts an alert to ServiceNow or PagerDuty and the Teams post fails in the same check, the alert counts as sent and Teams is not tried again. Send it again by hand from the drift alert.
- **Paused only when the endpoint fails.** When a Teams post from the hourly drift check fails because of the endpoint itself (a timeout or network error, a `5xx` or `429` after retries, a redirect, a `401`, `403`, `404` or `410`, or a URL that is not a Teams URL), the check skips Teams for that project for the rest of that run and tries again in the next hourly run. When Teams rejects one card as a bad request (for example `400`, `413` or `422`), only that alert skips Teams. It still goes to its other channels, and the remaining alerts are posted to Teams.
## Troubleshooting
<div className="dv2-table-scroll"><table><thead><tr><th>Problem</th><th>What to do</th></tr></thead><tbody><tr><td>"Use a Microsoft Teams webhook URL from a Workflows webhook or an Incoming Webhook." when saving</td><td>The URL is not on an allowed Microsoft host. Copy the URL again from the workflow.</td></tr><tr><td>"The webhook URL must start with https://." when saving</td><td>Use the <code>https</code> URL that Teams shows.</td></tr><tr><td>Test message sent, but no card in the channel</td><td>The workflow is turned off, or its flow failed after accepting the card. Open the workflow in Teams and check its run history.</td></tr><tr><td>"Teams webhook not found (status 404)" or "(status 410)"</td><td>The workflow or webhook was deleted or turned off. Turn it back on, or create a new one and select <strong>Replace webhook URL</strong>.</td></tr><tr><td>"Teams webhook unauthorized"</td><td>Teams refused the request. Create a new workflow and replace the URL.</td></tr><tr><td><strong>Microsoft Teams</strong> is missing from a notify dialog</td><td>Teams is not connected for this project. Connect it in <strong>Project Settings > Integrations</strong>.</td></tr></tbody></table></div>
## Related
<Cards>
<Card title="Governance Notifications" href="/docs/aigovernance/notifications" />
<Card title="Drift Alerts" href="/docs/aigovernance/compliance/drift-alerts" />
<Card title="Slack" href="/docs/integrations/slack" />
</Cards>