How to migrate from MS Teams WebHooks to PowerAutomate?

[elektro-wolle]

Since Microsoft decided to remove WebHooks for posting messages to MS Teams, the migration path for teams notifier to PowerAutomate is not clear.

Probably some changes in the documentation and within elastalert/alerters/teams.py.

[nsano-rururu]

https://devblogs.microsoft.com/microsoft365dev/retirement-of-office-365-connectors-within-microsoft-teams/

Wave 1 – effective August 15th, 2024: All new Connector creation will be blocked within all clouds
Wave 2 – effective October 1st, 2024: All connectors within all clouds will stop working

https://blog.devplatform.techmatrix.jp/blog/teams_workflows_notification/
https://zenn.dev/blackmax/articles/c9c052e0c14358
https://qiita.com/fukasawah/items/896c3638c203a973c2f0
https://sasami-axis.hatenablog.com/entry/2024/07/10/215324

[nsano-rururu]

There is information that it is not possible to migrate as is. It is necessary to gather information. I think it is necessary to inform users that they will no longer be able to use Teams webhooks from October 1st, and to delete notifications from elastalert2 to Teams until the new one is available.

[nsano-rururu]

With the Incoming Webhook being discontinued, it looks like the following will be necessary:

Create a PowerAutomate workflow

(In the case of MessageCard format) Convert to AdaptiveCard format

Replace the Webhook URL

[nsano-rururu]

With the previous Office 365 connector, the behavior was the same regardless of who set it as the team owner. However, since it has changed to a workflow (actually a Power Automate cloud flow), it now operates with the permissions of the user who created the workflow. For this reason, it is expected that the Incoming Webhook will no longer work if the workflow creator no longer has permissions to access the team.

[nsano-rururu]

Changes from the previous Incoming Webhook
The display name and icon of the posting user can no longer be changed
The previous Incoming WebHook allowed you to set any icon and display name, so it was possible to use it to post anonymously to a channel.

The new Incoming WebHook will have a fixed icon and will display the name of the flow owner.

[jertel]

Thanks for the research. As many deadlines get pushed back we can leave the current implementation in for now.

I don't personally use MS Teams so we'll need a volunteer to step up and get a PR ready with any required adjustments.

[marssilva]

Hello, thinking about something like this: marssilva@76f17d2#diff-a60fb0ecdb0fd5c588f303beffd2917b038ea4f70d78832382a05aa8024 e6ace

[marssilva]

This flow only works with "Anyone"

[jertel]

This looks like a good start @marssilva, thanks for putting it together. Does it work well for your MS Teams instance?

Separately, as predicted:

Update 07/23/2024: We understand and appreciate the feedback that customers have shared with us regarding the timeline provided for the migration from Office 365 connectors. We have extended the retirement timeline through December 2025 to provide ample time to migrate to another solution such as Power Automate, an app within Microsoft Teams, or Microsoft Graph. Please see below for more information about the extension:

[marssilva]

Yes @jertel, follow the tests

piece of yaml

[jertel]

Excellent. Feel free to submit a PR. The contribution guidelines list all the things needed to get the PR included in the next release. I think the only two items remaining are doc and changelog updates.

[marssilva]

Hello @jertel , I hope you are well, I opened the PR with these changes, I apologize for the bad English, if there is something missing just let me know or change it.
#1505

[marssilva]

Hello @jertel , thank you for merging the PR. Do you have any ideas when we will have the new release with this new feature?

[jertel]

The next release will likely be in early September. However, the nightly version of ElastAlert 2 is always available as a Docker image. Use the jertel/elastalert2:latest tag if you need it before the next release.