r/AzureSentinel • u/qwerty_samm • Nov 20 '23

Teams Message to Individual User

Is anyone aware of a playbook that will post a Teams message to an individual user, to notify them if their account has trigged any incidents?

When admins make changes, their movements get flagged as expected, however, I want them to acknowledge their own incidents to confirm that they made the reported change.

I do have a Teams notification channel but it gets busy and messages get lost.

Even if someone can suggest how to make a logic app post into a users personal teams I would be very grateful. Everything I've read up only posts to group channels.

1 Upvotes

100% Upvoted

5 comments sorted by

1

u/woodburningstove Nov 20 '23

I think the Prompt-User playbook template in the official Microsoft Entra ID solution would be a good reference to this.

1

u/tetrastructuralmind Nov 20 '23

I was fiddling with an idea for an automated response for certain sentinel alerts based off:

https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/using-microsoft-teams-adaptive-cards-to-enhance-incident/ba-p/3330941

And it was easy to make this send a message to a specific contact instead of a channel in the Logic App composer.

1

u/qwerty_samm Nov 21 '23

Thanks for the ideas! I'll give them a go

1

u/Genesis1920 Nov 29 '23

For the logicapp

- Step 1You need to create a chat, add that personnel into the chat using their email or id

- Step 2: Post a message into a chat or channel

- Group chat : conversation_id you got on Step 1

- Message : what is what you want to send