Symptom

Cribl Stream notifications do not reach Microsoft Teams after migrating from an Office 365 Incoming Webhook Connector to a Microsoft Teams Workflow webhook.

A manual curl request to the new webhook URL succeeds from the Leader, but notifications sent through the Cribl Stream Webhook notification target do not appear in Teams.

Environment

• Product: Cribl Stream

• Feature: Notifications

• Target type: Webhook

• Destination: Microsoft Teams

• Integration: Microsoft Teams Workflows using the When a Teams webhook request is received trigger

Resolution

Microsoft Teams Workflows require a supported JSON message payload. Configure the Cribl Stream Webhook notification target to send the notification as an Adaptive Card.

1. In Cribl Stream, navigate to Manage > Notifications > Targets.

2. Edit the Webhook notification target used for Microsoft Teams.

3. Configure the target with the following settings:

   • Method: POST

   • Format: Custom

   • Content type: application/json

   • Compress: Disabled

4. In Source expression, enter a valid Adaptive Card payload.

Do not include Markdown backticks when pasting the expression into Cribl Stream.

Basic notification card

Use the following expression to send the notification message stored in _raw:

{"type":"message","attachments":[{"contentType":"application/vnd.microsoft.card.adaptive","contentUrl":null,"content":{"$schema":"http://adaptivecards.io/schemas/adaptive-card.json","type":"AdaptiveCard","version":"1.4","body":[{"type":"TextBlock","text":"${_raw}","wrap":true}]}}]}

5. Save the notification target.

6. Trigger a test notification.

7. Verify that the message appears in the expected Teams channel or chat.

Structured destination backpressure card

For Destination Backpressure notifications, use the following expression to display the Destination, Worker Group, timestamp, and complete notification message:

{"type":"message","attachments":[{"contentType":"application/vnd.microsoft.card.adaptive","contentUrl":null,"content":{"$schema":"http://adaptivecards.io/schemas/adaptive-card.json","type":"AdaptiveCard","version":"1.4","body":[{"type":"TextBlock","text":"Destination Backpressure","weight":"Bolder","size":"Large","color":"Warning"},{"type":"FactSet","facts":[{"title":"Output:","value":"${output}"},{"title":"Group:","value":"${__worker_group}"},{"title":"Time:","value":"${_time}"}]},{"type":"TextBlock","text":"${_raw}","wrap":true,"fontType":"Monospace","size":"Small"}]}}]}

The fields available to a Source expression depend on the notification type. Verify the supported fields and their values before adding conditional expressions.

Cause

Microsoft Teams Workflows use a different webhook payload structure from the retired Office 365 Incoming Webhook Connectors.

A legacy payload such as the following might not be accepted by the new Workflow:

{"text":"${_raw}"}

The notification can also fail when:

• The Webhook target is not configured to use the Custom format.

• The content type is not set to application/json.

• Compression is enabled.

• The Source expression contains malformed JSON.

• Markdown backticks or other formatting characters were copied into the Source expression.

• The Workflow webhook URL is incorrect, expired, or associated with a disabled or deleted Workflow.

Additional Information

• Treat the Microsoft Teams Workflow webhook URL as sensitive. Anyone with access to it might be able to post messages to the associated Workflow.

• Microsoft Teams Workflows are owned by individual users. Add appropriate co-owners to prevent the Workflow from becoming orphaned if its original owner leaves the organization.

• See Cribl Webhook Notification Targets for supported settings and Source expression fields.

• See Microsoft Teams connectors for the supported webhook request schemas.

• See Microsoft Teams webhooks and connectors for guidance on creating Teams Workflows that receive webhook requests.