Microsoft Teams (Workflow)
Last updated 2025-02-03
WARNING
As announced, Microsoft has retired the Office 365 connectors within Microsoft Teams as of January 31, 2025. If you transitioned your previous Next-Gen WAF integration to the new URL structure prior to this date, it will continue to function until the deadline stated in the announcement. If you did not transition your integration or want to create a new integration, use this guide to create a Microsoft Teams (Workflow) integration.
IMPORTANT
This feature only applies to Next-Gen WAF customers with access to the Next-Gen WAF control panel. Corp integrations (account integrations) are not supported on the Essential platform.
Our Microsoft Teams (Workflow) integration allows you to be notified when certain activity occurs on the Next-Gen WAF.
Adding Teams integration
You can add Teams (Workflow) integration for both corps (also known as accounts) and sites (also known as workspaces).
Corp (account) integration
NOTE
Only Owners can create, edit, and delete corp integrations.
- Add a custom incoming webhook in Microsoft Teams
- Copy the Webhook URL of the new webhook.
- Log in to the Next-Gen WAF control panel.
- From the Corp Manage menu, select Corp Integrations.
- Click Add corp integration.
- Select the Microsoft Teams (Workflow) integration.
- In the Webhook URL field, enter the Webhook URL created in Slack.
- Select if you want to be alerted regarding All activity or Specific activity. If you selected Specific activity, then in the Activity menu choose the activity types that you want the integration to create alerts for.
- Click Create corp integration.
Site (workspace) integration
- Add a custom incoming webhook in Microsoft Teams
- Copy the Webhook URL of the new webhook.
- Log in to the Next-Gen WAF control panel.
- From the Sites menu, select a site if you have more than one site.
- From the Manage menu, select Site Integrations.
- Click Add site integration.
- Select the Microsoft Teams (Workflow) integration.
- In the Webhook URL field, enter the Webhook URL created in Slack.
- Select if you want to be alerted regarding All activity or Specific activity. If you selected Specific activity, then in the Activity menu choose the activity types that you want the integration to create alerts for.
- Click Create site integration.
Activity types
Corp (account) and site (workspace) integrations have the following separate activity types.
Corp (account)
| Activity type | Description |
|---|---|
releaseCreated | New release notifications |
featureAnnouncement | New feature announcements |
corpUpdated | Account timeout setting updated |
newSite | A new site (workspace) was created |
deleteSite | A site (workspace) was deleted |
enableSSO | SSO was enabled for the corp (account) |
disableSSO | SSO was disabled for the corp (account) |
corpUserInvited | A user was invited |
corpUserReinvited | A user was reinvited |
listCreated | A list was created |
listUpdated | A list was updated |
listDeleted | A list was removed |
customTagCreated | A custom signal created |
customTagDeleted | A custom signal updated |
customTagUpdated | A custom signal removed |
userAddedToCorp | A user was added to the corp (account) |
userMultiFactorAuthEnabled | A user enabled 2FA |
userMultiFactorAuthDisabled | A user disabled 2FA |
userMultiFactorAuthUpdated | A user updated 2FA secret |
userRegistered | A user was registered |
userRemovedCorp | A user was removed from the corp (account) |
userUpdated | A user was updated |
userUndeliverable | A user's email address bounced |
userUpdatePassword | A user updated their password |
accessTokenCreated | An API Access Token was created |
accessTokenDeleted | An API Access Token was deleted |
Site (workspace)
| Activity type | Description |
|---|---|
siteDisplayNameChanged | The display name of a site (workspace) was changed |
siteNameChanged | The short name of a site (workspace) was changed |
loggingModeChanged | The agent mode ("Blocking", "Not Blocking", "Off") was changed |
agentAnonModeChanged | The agent IP anonymization mode was changed |
flag | An IP address was flagged |
expireFlag | An IP address flag was manually expired |
createCustomRedaction | A custom redaction was created |
removeCustomRedaction | A custom redaction was removed |
updateCustomRedaction | A custom redaction was updated |
customTagCreated | A custom signal was created |
customTagUpdated | A custom signal was updated |
customTagDeleted | A custom signal was removed |
customAlertCreated | A custom alert was created |
customAlertUpdated | A custom alert was updated |
customAlertDeleted | A custom alert was removed |
detectionCreated | A templated rule was created |
detectionUpdated | A templated rule was updated |
detectionDeleted | A templated rule was removed |
listCreated | A list was created |
listUpdated | A list was updated |
listDeleted | A list was removed |
ruleCreated | A request rule was created |
ruleUpdated | A request rule was updated |
ruleDeleted | A request rule was deleted |
customDashboardCreated | A custom dashboard was created |
customDashboardUpdated | A custom dashboard was updated |
customDashboardReset | A custom dashboard was reset |
customDashboardDeleted | A custom dashboard was removed |
customDashboardWidgetCreated | A custom dashboard card was created |
customDashboardWidgetUpdated | A custom dashboard card was updated |
customDashboardWidgetDeleted | A custom dashboard card was removed |
agentAlert | An agent alert was triggered |
Do not use this form to send sensitive information. If you need assistance, contact support. This form is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
