Build a No-Code Azure Logic App That Pushes M365 Security Alerts Into Teams
TL;DR
- An Azure Logic App can pull security alerts from the Microsoft Graph Security API on a recurrence and post them to a Microsoft Teams channel with no PowerShell required.
- A 15-minute recurrence trigger costs roughly $1 per day in Azure consumption, based on testing.
- The Microsoft Graph Security API surfaces alerts spanning both Microsoft 365 and Azure in one place.
- Logic App output arrives as one block of text rather than tidy line items, so you may want a parallel branch to split alerts into separate messages.
If you want Microsoft 365 and Azure security alerts landing in a Teams channel and you would rather not maintain a script, an Azure Logic App is the path. Logic Apps let you chain triggers and actions across your customers' tenants, and Microsoft's addition of the Graph API to the connector list means you can pull security alerts on a timer and post them straight to Teams. This walkthrough builds that workflow, tells you what it costs, and is honest about where the output disappoints.
The Microsoft Graph Security API connects multiple security solutions to make it easier to correlate alerts, get rich contextual information, and simplify automation and investigations. The benefits for MSPs:
- Streamlined integration with security operations tools, workflows, and reporting.
- Security alerts spanning both Microsoft 365 and Azure.
- Reduced deployment and maintenance time and effort.
- Automated response to alerts by taking action on threats.
- Ability to deliver more value to customers.
- Real-time alerts in Microsoft Teams.
What this Logic App actually does, and what it costs
A Logic App is, at its core, a set of triggers that kick off workflows. In this build, the trigger fires every 15 minutes, pulls security alerts from the Microsoft Graph, and writes them to a designated Teams channel. A few things to weigh before you build it:
- Cost. You accumulate charges for the number of recurrences you set, but it is not much per month. Through testing, a 15-minute interval runs about $1 per day. If you want this for free instead, you can build a PowerShell webhook, covered in the companion guide on getting Microsoft security alerts in Teams.
- Workflows. It is easy to configure workflows across both internal and external applications. External apps cost more.
- Configuration. The output is not as configurable as we would like. It comes over as one blob of information rather than concise line items.
The upside is room to grow. You can build on top of the existing configuration easily, for example sending an end-of-day email summarizing all the alerts that occurred.
Build the Logic App step by step
Add the app
Sign in to the Azure portal (opens in new tab) with a global admin and search for Logic Apps.
Click Add and customize your settings.
Set the recurrence trigger
After the app is created, scroll down and select Recurrence to start the design.
Add a custom time frame. This build uses 15 minutes. Click New step.
Pull alerts from Microsoft Graph
Search for Microsoft Graph, then select Get Alerts after clicking the icon.
Click Add Parameter and select Top Alerts. You could also select the filter parameter here if you only want to see a certain severity level such as High.
After selecting Top Alerts, enter the number you want to see. Running every 15 minutes, this build only requests the top 2.
Post to Teams
Click New Step and search for Microsoft Teams, then choose Post new message.
Add your Teams channel, and in the message field choose which variables to include. We typically select Title, Description, Severity, EventDateTime, and RecommendedActions.
Run it
Select Save, then Run, and watch it work. View the message in your Teams channel.
Clean up the messy output
As noted, alerts come across a little jumbled. Add a parallel branch after the Microsoft Graph step to separate them into different messages.
Extend it further
We recommend experimenting with the other connectors available at no additional charge. You can continue the workflow if you want more actions to fire. The example below extends to Outlook for an email message. One use: set the recurrence to once a day so it populates the Teams channel with the day's alerts and also sends a summary email.
Frequently asked questions
How much does a security-alerts Logic App cost to run?
A recurrence trigger set to every 15 minutes ran about $1 per day in testing. Cost scales with the number of recurrences you configure. If you want a free alternative, a PowerShell webhook to Teams does the same job at no Azure cost.
Can I filter Logic App alerts by severity?
Yes. When you add the Get Alerts parameters in the Microsoft Graph step, you can use the filter parameter to return only a certain severity level such as High, instead of pulling everything.
Why do the Teams messages look jumbled?
The Get Alerts output comes over as a single blob rather than concise line items. Add a parallel branch after the Microsoft Graph step to separate the data into individual messages.
Catching alerts is good. Not generating them in the first place is better.
Most M365 security alerts trace back to a misconfiguration that drifted. CloudCapsule checks 250+ controls across every tenant you manage in about 60 seconds each, so you fix the gap before it becomes an alert in your Teams channel.
Run a free scan
Written by
Nick Ross
CEO · Microsoft MVP · Founder, T-Minus 365
Nick is not just a CEO, he's a respected thought leader and influencer in the MSP space. Tens of thousands of MSPs learn through his YouTube channel, T-Minus365. Nick has been honored as a three-time Microsoft MVP for his educational content; his expertise and influence are the backbone of our mission, ensuring that you are in the best hands when it comes to security.
Nick joined Pax8 in 2017, where he would ultimately oversee product management for PSA and Microsoft integrations. Following his tenure at Pax8, Nick has continued to demonstrate his leadership prowess as an executive at various MSPs, culminating in his most recent role at Sourcepass.
Nick holds a Bachelor's Degree in Business Management from Florida State University, as well as a Minor Degree in Entrepreneurship. In his free time, Nick is an avid hiker, reader, and fitness-junkie.
