MS Teams (Graph API)¶

Robusta can post notifications to MS Teams channels with the Microsoft Graph API, as an Adaptive Card. Unlike the webhook based MS Teams sink, a single sink can post to any channel of any team the sending user belongs to, and route each notification to a channel based on labels and annotations.

How it authenticates¶

Microsoft Graph only allows posting channel messages with delegated permissions (on behalf of a user). The sink signs in as a dedicated service user with the OAuth2 Resource Owner Password Credentials (ROPC) flow, and messages are posted as that user.

1. In the Entra ID admin center, create an App registration (single tenant).

2. Under API permissions, add the Microsoft Graph delegated permission ChannelMessage.Send, and grant admin consent.

3. Under Certificates & secrets, create a client secret (or enable Allow public client flows under Authentication and leave client_secret empty).

4. Create a service user, for example robusta-alerts@yourcompany.onmicrosoft.com. ROPC does not support interactive MFA, so exclude this user from MFA / Conditional Access policies that require it. When creating it, uncheck Require this user to change their password when they first sign in. Otherwise the sign-in fails with AADSTS50055 (password expired).

5. Give the service user a Microsoft Teams license. Without one, Graph rejects every message with 403 Failed to get license information for the user.

   1. Open the Microsoft 365 admin center.

   2. Go to Users > Active users, and select the service user.

   3. Click Manage product licenses, and assign a license that includes Microsoft Teams.

   A new license can take a few minutes to take effect.

6. Add the service user as a member of every team Robusta should post to.

Get the team and channel ids¶

In Teams, click ... next to the channel, then Get link to channel. The link looks like:

https://teams.microsoft.com/l/channel/19%3Aabc123%40thread.tacv2/Alerts?groupId=<TEAM_ID>&tenantId=<TENANT_ID>

• groupId is the team id.

• The part after /channel/ is the channel id. It can be used as is (URL-encoded) or decoded (19:abc123@thread.tacv2).

Configuring the sink¶

sinksConfig:
- ms_teams_graph_sink:
    name: teams_graph_sink
    tenant_id: <TENANT_ID>
    client_id: <APP_CLIENT_ID>
    client_secret: "{{ env.TEAMS_CLIENT_SECRET }}"
    username: robusta-alerts@yourcompany.onmicrosoft.com
    password: "{{ env.TEAMS_PASSWORD }}"
    # where notifications go when no channel routing applies (see Dynamic Channel Routing)
    team_id: <TEAM_ID>
    channel_id: "19:abc123@thread.tacv2"

runner:
  additional_env_vars:
  - name: TEAMS_CLIENT_SECRET
    valueFrom:
      secretKeyRef:
        name: teams-graph-credentials
        key: client_secret
  - name: TEAMS_PASSWORD
    valueFrom:
      secretKeyRef:
        name: teams-graph-credentials
        key: password

Then do a Helm Upgrade.

Configuration parameters¶

Dynamic Channel Routing¶

The sink routes each notification with two optional override fields, evaluated in order:

1. namespace_channel_override — resolved against the Namespace object's labels and annotations, looked up by the finding's namespace. Skipped for findings without a namespace (e.g. node alerts).

2. channel_override — resolved against the finding's subject labels and annotations (for Prometheus alerts, the alert labels and annotations). Same behavior as Slack's channel_override.

If neither produces a channel, send_to_default_if_missing decides whether the notification goes to the default channel_id or is dropped.

The resolved value can be:

• a channel id (19:abc123@thread.tacv2, or URL-encoded), posted in team_id, or

• <team_id>/<channel_id>, to post in another team.

Both override fields use the same template syntax as Slack:

• cluster_name — the Robusta cluster name.

• labels.foo / $labels.foo — value of a label.

• annotations.bar / $annotations.bar — value of an annotation.

• ${labels.foo-bar} / ${annotations.example.com/teams-channel} — bracket form, required when the key contains characters other than letters, digits, or underscores (e.g. -, /, .).

• Composite patterns are allowed: "19:$labels.team@thread.tacv2".

Example — route by a namespace annotation, then by an alert label, drop if neither is set:

sinksConfig:
- ms_teams_graph_sink:
    name: teams_graph_sink
    # ... credentials, team_id and channel_id as above
    namespace_channel_override: "${annotations.example.com/teams-channel}"
    channel_override: "${labels.teams_channel}"
    send_to_default_if_missing: false

apiVersion: v1
kind: Namespace
metadata:
  name: payments
  annotations:
    example.com/teams-channel: "19:abc123@thread.tacv2"

Troubleshooting¶

Errors are logged by the Robusta runner.