---
title: Microsoft Teams Actions
description: "## Actions for Microsoft Teams - ***Post on Teams***. Sends a custom set of Lucidum data to Microsoft Teams. ## Use Cases Below are the possible use cases for the ***Post on Teams***action: - You can send messages about high-risk…"
url: "https://lucidum.io/docs/microsoft-teams-actions/"
updated: "2025-09-23"
category: Actions / List of Actions / M
---

# Microsoft Teams Actions

## Actions for Microsoft Teams

- ***Post on Teams***. Sends a custom set of Lucidum data to Microsoft Teams.

## Use Cases

Below are the possible use cases for the ***Post on Teams***action:

- You can send messages about high-risk alerts or incidents to specific Teams groups. For example, you could send a list of assets with a zero-day vulnerability to the SecOps slack channel for immediate attention.

## Prerequisites

Before you can execute the action ***Post on Teams***, you must:

- Enable incoming webhooks on Microsoft Teams and then copy the URL for incoming webhooks. For details, see [https://learn.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/add-incoming-webhook?tabs=dotnet#create-incoming-webhooks-1](https://learn.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/add-incoming-webhook?tabs=dotnet#create-incoming-webhooks-1).

## Workflows

- [Creating a new Configuration and a new Action](https://lucidum.io/docs/overview-of-actions#workflow_for_creating_configurations_and_actions_in_lucidum)
- [Cloning an Existing Action](https://lucidum.io/docs/overview-of-actions#workflow_using_clone_to_create_a_new_action)
- [Creating a new Action from the Location Results page](https://lucidum.io/docs/overview-of-actions#alternative_workflow_for_creating_an_action)
- [Editing a Configuration](https://lucidum.io/docs/overview-of-actions#workflow_for_editing_a_configuration)
- [Editing an Action](https://lucidum.io/docs/overview-of-actions#workflow_for_editing_an_action)
- [Viewing Information about an Action](https://lucidum.io/docs/overview-of-actions#viewing_information_about_an_existing_action_and_executing_an_action_on_demand)

## Microsoft Teams Configuration

![ms_teams_config.png](https://lucidum.cloud/docs/ms_teams_config.png)

- ***Configuration Name***. Identifier for the Configuration. This name will appear in the Lucidum Action Center.
- ***Webhook URL***. The URL on Teams that listens for webhooks from Lucidum. For details on generating a webhook URL, see [https://learn.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/add-incoming-webhook?tabs=dotnet#create-incoming-webhooks-1](https://learn.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/add-incoming-webhook?tabs=dotnet#create-incoming-webhooks-1) .

## Create or Edit an Action

To create an action for Microsoft Teams:

1. In the **Create a New Action** page, in the **General**step, enter:

   ![ms_teams_general_page.png](https://lucidum.cloud/docs/ms_teams_general_page.png)

   - ***Description***. After saving an Action, Lucidum uses the Luci LLM to populate this field automatically. You cannot edit the value in this field.
   - ***Business Value***. After saving an Action, Lucidum uses the Luci LLM to populate this field automatically. You cannot edit the value in this field.
   - ***Action Type***. Select from the list of possible action types. Select *Post on Teams*.
   - ***Configuration Name***. Select an action configuration from the pulldown options.
   - ***Action Name***. Identifier for the action. This name will appear in the Lucidum Action Center.
   - ***Author Comments***. Custom comments about the Action.
2. Click the **Next**(>) icon.
3. In the **Filters** page, click **Configure Filters**.

   ![ms_teams_action2.png](https://lucidum.cloud/docs/ms_teams_action2.png)
4. The **Build a Query**page appears.

   ![build_query1_updated.png](https://lucidum.cloud/docs/build_query1_updated.png)
5. In the **Build a Query**page, you define the query for the assets or users that the action will act upon.
6. Click **Next**.
7. In the **Build a Current Query**page, enter the fields, operators, and values for the query. For existing actions, the query is already loaded in this page.

   ![build_query2_updated.png](https://lucidum.cloud/docs/build_query2_updated.png)
8. For details on creating and editing queries in Lucidum, see the section on [Building Queries](https://lucidum.io/docs/building-queries).
   **NOTE**: To optimize performance, the default time range is *Current*. If you need to access historical data, contact Lucidum Custom Success for help on using historical data without affecting performance.
9. Click the **Apply** (page and pencil) icon.
10. Click the **Next**(>) icon.
11. In the **Schedule** step, enter:

    ![ms_teams_action4.png](https://lucidum.cloud/docs/ms_teams_action4.png)

    - ***Schedule Type***. Define the schedule for the action. Choices are:

      - ***Recurrence***. Specify a frequency for the recurring schedule.
      - ***After Data Ingestion***. The action is executed after data ingestion, which happens at least once every 24 hours and can also be triggered manually.
    - ***Do not trigger the action unless***. Specify the number of results from ***Filters*** as a prerequisite for executing the action.
12. Click the **Next**(>) icon.
13. In the **Details** step, enter the following:

    ![ms_teams_action5.png](https://lucidum.cloud/docs/ms_teams_action5.png)

    - ***Output Fields***. For the records selected with the ***Filters*** field, specify the columns to display. When creating or editing the query, you can select these fields in the **Query Results** page > **Edit Column**button.
    - ***Message***. This field includes JSON to build an AdaptiveCard object. AedaptiveCard is a platform-agnostic snippet of UI data. The object allows applications to easily share and integrate UI data with other user interfaces. When delivered to Teams, the content of the AdaptiveCard uses the Teams look-and-feel. The message in Teams will include a description of the Lucidum action, the name of the person who created the action, the number of query results in the action, and a message that says “Check detailed result in Lucidum Action Center.” The message also includes a link to [download the results of the latest execution of the action](https://lucidum.io/docs/overview-of-actions/#action_logs).