Microsoft Teams incident alerts with actions

If your team lives in Microsoft Teams, an incident that only shows up in an email or a separate dashboard gets noticed late. What you want is a card in the channel people already watch, with buttons that change the real incident, and a card that stays current when someone else handles it.

ZipLogger has a Teams app with a bot that does that. This post walks through installing it, connecting it to your ZipLogger workspace, and linking each person's Teams account so the buttons act as them. It also covers what it does not do yet.

What you get

Each incident becomes one Adaptive Card in the channel or chat you choose. This is part of the card ZipLogger's code renders for a sample incident. The title block, the button styles and the fallbacks are left out, and the encrypted button data is shortened:

{ "type": "FactSet", "facts": [
    { "title": "Status", "value": "Triggered" },
    { "title": "Severity", "value": "high" },
    { "title": "Service", "value": "checkout-api" },
    { "title": "Environment", "value": "production" },
    { "title": "Assigned to", "value": "nobody yet" },
    { "title": "Triggered", "value": "{{DATE(2026-09-29T09:14:00Z, SHORT)}} {{TIME(2026-09-29T09:14:00Z)}}" } ] },
{ "type": "ActionSet", "actions": [
    { "type": "Action.Execute", "title": "Acknowledge", "verb": "acknowledge", "data": { "verb": "acknowledge", "v": "<encrypted>" } },
    { "type": "Action.Execute", "title": "Assign to me", "verb": "assign_to_me", "data": { "verb": "assign_to_me", "v": "<encrypted>" } },
    { "type": "Action.OpenUrl", "title": "Open in ZipLogger", "url": "https://app.ziplogger.ai/alerts/incidents/…" } ] }

The DATE and TIME functions make Teams show the trigger time in each reader's own time zone. The buttons are Universal Actions (Action.Execute), and each one carries an Action.Submit fallback for older Teams clients.

The buttons depend on the incident's state:

When the incident changes anywhere, ZipLogger edits the same card rather than posting a new one. That includes a change made in the ZipLogger UI or from a Slack message for the same incident.

Step 1: add the app to Teams

The ZipLogger app is not in the Teams store yet. Your Teams admin, or anyone allowed to upload custom apps, adds it from a package:

1. Download the Teams app package. It is a 9 KB zip with the app manifest and two icons. It contains no secrets.
2. To add it for yourself: in Teams, Apps → Manage your apps → Upload an app → Upload a custom app, choose the zip, then Add.
3. To add it to a team: See all your teams → ⋯ → Manage team → Apps → Upload an app, and choose the zip there. Use this path for a team. Adding it from Manage your apps installs it for you only, even if Teams then offers to pick a channel.

Both need "Upload custom apps" allowed in the Teams admin center (Teams apps → Setup policies). If your organisation doesn't allow that, an admin can upload the zip once to the org's own catalog (Teams admin center → Manage apps → Upload new app). After that, everyone finds it under Apps → Built for your org.

The app asks for no Microsoft Graph permissions. It does not read channel messages or the team roster. It posts cards, reads the channel list for the picker, and receives button clicks.

Step 2: connect it to your ZipLogger workspace

When the app arrives in a team or chat, the bot posts a welcome card titled "ZipLogger is installed" with a one-time code in the form ABCD-EFGH. The code is valid for 30 minutes.

A ZipLogger Admin pastes it under Settings → Integrations → Microsoft Teams and clicks Connect team. The welcome card then changes to "ZipLogger is connected".

This step exists on purpose. Nothing about who installed the app in Teams decides which ZipLogger workspace it belongs to. Only that code, used by a signed-in Admin, binds the two. The code is single-use and rate-limited. If it expires, remove the app from the team and add it again to get a fresh one.

One ZipLogger workspace can connect several teams and chats. They are listed under Connected teams on the same card, each with its own Disconnect.

Step 3: pick a channel

An Admin goes to Alerts → Delivery → Destinations, clicks + Connect a destination and sets Tool to Microsoft Teams. Pick the connected team, then one of its channels. The channel list comes live from Teams, and when you save, ZipLogger checks with Teams that the channel is really in that team.

For a group chat or a personal installation there is only one choice, the chat itself.

The routing fields are the same as for any destination: Minimum severity, an optional Service and Environment, and Send matching incidents automatically. Leave Acknowledging here acknowledges there and Resolving here resolves there ticked so the card follows the incident.

Step 4: each person links their account once

Teams tells ZipLogger which Microsoft identity clicked a button. It does not tell it which ZipLogger user that is. So everyone who wants to use the buttons links once:

1. In ZipLogger, open Settings → Integrations → Microsoft Teams and click Link my account. You get a code that is valid for 10 minutes.
2. In Teams, open a chat with the ZipLogger bot and send it, for example link ABCD-EFGH.
3. Back in the ZipLogger tab, the page shows which Teams account sent the code. Confirm only if it is you. If it isn't, click That's not me and nothing is linked.

Linking needs both halves. A leaked code links nothing unless the browser session that created it confirms. ZipLogger never matches people by email address or by Microsoft tenant.

Clicking a button

Clicks are applied while Teams waits. The card you clicked comes back already updated, and the incident timeline records the actor as Teams: followed by your name. If that first attempt fails, you see "ZipLogger is taking longer than usual. The card will refresh once the action is applied." and a background worker retries it.

What the person who clicked sees when it can't act:

A click is authorized by several facts together: the request is verified as coming from Microsoft's Bot Connector, the card data is encrypted by ZipLogger for that incident and destination, the team must be connected to the same workspace, the destination must really have posted that card there, and the Teams identity must be linked to an Admin or Editor. A Teams click that arrives twice is recorded once.

The personal chat

The bot also works one to one. In a personal chat you can:

• send link plus your code, as in step 4
• send help, or anything else, to get a short explanation of what the bot does
• receive incident cards, if an Admin connected that chat and chose it as a destination

A personal chat is a reasonable way to try the integration before adding it to a shared channel.

Removing it

Remove the app from the team, or click Disconnect in ZipLogger. Teams tells ZipLogger when the app is removed, and the installation is marked revoked. If Teams starts refusing posts to a conversation (for example the app was blocked), ZipLogger marks it as blocked and stops retrying. To come back, add the app again and use the new connect code.

What it does not do

• Not in the Teams store. Every install is a custom upload or your org's own catalog, so it depends on your Teams admin's app policies.
• No commands beyond link and help. You can't search logs or open incidents from Teams.
• No Teams sign-in. Linking attaches a Teams identity to an existing ZipLogger account. It is not a way to log in.
• No posts during planned silence. An incident opened inside a maintenance window, or during flood control, is recorded in ZipLogger and not posted.
• Not a pager. A card does not wake anyone. Keep an escalation policy for that, as described in on-call schedules and escalation.

The same steps, with the package link, are in the Microsoft Teams docs. To try it, create a free workspace, then open Settings → Integrations → Microsoft Teams.