Skip to content

Conversation

@thinkst-tom
Copy link
Contributor

@thinkst-tom thinkst-tom commented Dec 11, 2025

Proposed changes

Microsoft deprecated the URL format that was previously being used and have recently begun requiring that a particular URL format be used for Teams webhooks: https://default_some_hash_.ac.environment.api.powerplatform.com:443/powerautomate/automations/direct/workflows/...

If a webhook notification is enabled for a Canarytoken that matches this new format, an alert will be posted to the Teams channel that the URL has been configured for.

The payload format has also been updated to the newer and recommended AdaptiveCard format.

Types of changes

What types of changes does your code introduce to this repository?
Put an x in the boxes that apply

  • Bugfix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Documentation Update

Checklist

Put an x in the boxes that apply. You can also fill these out after creating the PR. If you're unsure about any of them, don't hesitate to ask. We're here to help! This is simply a reminder of what we are going to look for before merging your code.

  • Lint and unit tests pass locally with my changes (if applicable)
  • I have run pre-commit (pre-commit in the repo)
  • I have added tests that prove my fix is effective or that my feature works
  • I have added necessary documentation (if appropriate)
  • Linked to the relevant github issue or github discussion

Further comments

The changes were tested by creating a Web Bug token and then triggering it, and manually creating a exposed key alert for a AWS API Key token. Each message was then checked on Teams to ensure it was being displayed correctly.

validate alert exposed

This is what the messages looked like before the change:

image

MsTeamsAction(
type="Action.OpenUrl",
title="Canarytokens.org",
url="https://canarytokens.org/nest/",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

might be best to make this URL a constant and then refer to it?

MsTeamsAction(
type="Action.OpenUrl",
title="Canarytokens.org",
url="https://canarytokens.org/nest/",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same here

MsTeamsAction(
type="Action.OpenUrl",
title="Canarytokens.org",
url="https://canarytokens.org/nest/",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same

@thinkst-tom thinkst-tom merged commit 92f6185 into master Jan 5, 2026
@thinkst-tom thinkst-tom deleted the T8593_update_ms_teams_webhook branch January 5, 2026 14:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants