Real-Time Event-Driven

webhooks.ms

The complete guide to Microsoft Webhooks — connect services, automate workflows, and build event-driven integrations across Teams, SharePoint, Azure & beyond.

⚡ Try the Tester Explore Services →

scroll

// How It Works

The Webhook Flow

A webhook is a user-defined HTTP callback. When an event occurs, the source makes an HTTP POST to the registered URL — delivering real-time data with zero polling.

🎯

Event Occurs

A change happens in the source system (new message, file update, build completes).

→

📡

HTTP POST Sent

The source sends a JSON payload to your registered webhook endpoint URL.

→

🔐

Auth Verified

Your endpoint verifies the request via HMAC signature, header key, or query string.

→

⚙️

Action Triggered

Your service processes the payload — logging, alerting, transforming, or forwarding data.

// Microsoft Ecosystem

Webhooks Across Services

Microsoft supports webhooks across its entire cloud ecosystem. Each service has its own webhook capabilities and patterns.

💬

Microsoft Teams

Incoming Webhooks post messages with Adaptive Cards to channels. Outgoing Webhooks let users @mention a service and get real-time responses within 10 seconds.

IncomingOutgoingAdaptive CardsJSON Payload

📁

SharePoint Online

Subscribe to list and library changes with SharePoint webhooks. Notifications include the subscription ID, resource URL, and tenant ID — use GetChanges API for details.

List ChangesSubscriptionsDelta SyncREST API

🔧

Azure DevOps

Service hooks send JSON event payloads for work items, builds, releases, code pushes, and pull requests. Supports HTTPS endpoints with filtering and basic auth.

Service HooksCI/CDWork ItemsGit Events

⚡

Power Apps / Dataverse

Register webhooks as service endpoints to receive server event data. Supports HttpHeader, WebhookKey, and HttpQueryString authentication with 60-second timeouts.

Plug-in StepsEntity EventsHMAC AuthAzure Functions

☁️

Azure Automation

Trigger runbooks via webhook URLs for maintenance events, VM management, and scheduled tasks. Integrates with Event Grid for pre/post maintenance workflows.

RunbooksEvent GridPre/Post EventsPowerShell

🔮

Microsoft Graph

Subscribe to change notifications for users, messages, calendar events, drive items, and more. Uses delta queries for efficient state synchronization across tenants.

SubscriptionsChange NotificationsDelta QueryOAuth 2.0

// Interactive Playground

Webhook Tester

Simulate sending webhook payloads and see the response in real-time. Edit the JSON, choose a scenario, and fire away.

Live Tester

Request Payload

Response

WAITING
Awaiting webhook request...

// Quick Start

Code Examples

Get started with webhooks in your language of choice. Copy, paste, and deploy.

# Send a message to Teams via Incoming Webhook
curl -X POST "https://your-org.webhook.office.com/webhook/..." \
  -H "Content-Type: application/json" \
  -d '{
    "type": "message",
    "attachments": [{
      "contentType": "application/vnd.microsoft.card.adaptive",
      "content": {
        "type": "AdaptiveCard",
        "$schema": "http://adaptivecards.io/schemas/adaptive-card.json",
        "version": "1.4",
        "body": [{
          "type": "TextBlock",
          "text": "Build #142 deployed ✅",
          "weight": "Bolder",
          "size": "Medium"
        }]
      }
    }]
  }'

// Receive & verify a webhook in Express
const express = require('express');
const crypto = require('crypto');
const app = express();

app.use(express.json());

app.post('/api/webhook', (req, res) => {
  const signature = req.headers['x-hub-signature'];
  const hash = crypto
    .createHmac('sha256', process.env.WEBHOOK_SECRET)
    .update(JSON.stringify(req.body))
    .digest('hex');

  if (signature === `sha256=${hash}`) {
    console.log('✅ Verified:', req.body);
    res.status(200).send('OK');
  } else {
    res.status(403).send('Invalid signature');
  }
});

app.listen(3000);

# Flask webhook receiver with HMAC verification
import hmac, hashlib, json
from flask import Flask, request, jsonify

app = Flask(__name__)
SECRET = "your-webhook-secret"

@app.route("/api/webhook", methods=["POST"])
def handle_webhook():
    signature = request.headers.get("X-Hub-Signature")
    payload = request.get_data()

    expected = "sha256=" + hmac.new(
        SECRET.encode(), payload, hashlib.sha256
    ).hexdigest()

    if hmac.compare_digest(signature, expected):
        data = json.loads(payload)
        print("✅ Verified:", data)
        return jsonify({"status": "ok"}), 200
    return jsonify({"error": "forbidden"}), 403

// ASP.NET Core webhook controller
[ApiController]
[Route("api/[controller]")]
public class WebhookController : ControllerBase
{
    [HttpPost]
    public async Task<IActionResult> Receive()
    {
        using var reader = new StreamReader(Request.Body);
        var body = await reader.ReadToEndAsync();
        var secret = Configuration["WebhookSecret"];

        var signature = Request.Headers["X-Hub-Signature"];
        var hash = ComputeHmac(body, secret);

        if (signature == $"sha256={hash}")
        {
            var payload = JsonSerializer.Deserialize<object>(body);
            _logger.LogInformation("✅ Webhook verified");
            return Ok();
        }
        return Forbid();
    }
}

// Key Concepts

Webhook Fundamentals

Essential patterns and best practices when working with Microsoft webhooks.

🔁

Retry Logic

Implement exponential backoff. Microsoft services retry failed deliveries — return 2xx quickly to confirm receipt.

🔒

HMAC Verification

Always validate the signature header using a shared secret to ensure the payload is from a trusted source.

⏱️

Timeout Handling

Most Microsoft services enforce a 60-second timeout. Process webhooks async — acknowledge first, process later.

📦

Payload Size

Teams limits messages to 28KB. Dataverse strips properties when payloads exceed 256KB. Design compact payloads.

🚦

Rate Limiting

Teams throttles at 4 requests/second per connector. Azure DevOps may batch notifications. Monitor HTTP 429 responses.

🔗

Idempotency

Webhooks may be delivered more than once. Use unique event IDs to deduplicate and ensure safe reprocessing.

📋

Subscription Management

SharePoint and Graph subscriptions expire. Implement renewal logic before expiration to maintain continuity.

🌐

HTTPS Only

All Microsoft webhook endpoints must use HTTPS. HTTP endpoints will be rejected to prevent data leakage.

// Activity

Event Log

Real-time log of webhook activity from the tester above.

Webhook Events

--:--:-- SYS Webhook tester initialized. Ready to receive events. READY