Identity Risk Alert to Teams

Overview

FlowLibs - Identity Risk Alert to Teams is a scheduled cloud flow that polls Microsoft Entra Identity Protection for users currently in an "atRisk" state and posts an alert to a designated security Teams channel for every match that meets a configurable risk-level threshold. Each alert contains the user's display name, UPN, risk level, risk state, risk detail, last-updated timestamp, and a checklist of recommended remediation steps so the security team can triage immediately from inside Teams.

Use Case

Identity Protection surfaces sign-in and user-risk signals (atypical travel, anonymous IP, leaked credentials, anomalous activity, etc.), but those signals only deliver value if a human sees them and acts. This flow eliminates the "nobody checked the Entra portal today" gap — instead of relying on the security team to log into Entra, it pushes high-signal risk events into the channel they already live in. Every detection that crosses the configured severity floor becomes a Teams card with the exact context an analyst needs to confirm or dismiss the risk, reset the password, and revoke sessions.

This is a defense-in-depth pattern that complements (does not replace) Conditional Access. CA blocks risky sign-ins automatically; this flow ensures someone follows up on the user behind the block.

Flow Architecture

Environment Variables

Connectors & Connections

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Adjusting cadence

Change the Recurrence trigger's frequency and interval to match your team's tolerance for delay. For SOC environments, every 15 minutes (frequency: Minute, interval: 15) is more typical. Update flowlibs_RiskCheckIntervalHours in parallel so the env var stays in sync with reality.

Tuning severity

Update the flowlibs_RiskLevelMinimum env var value to low, medium, or high. The Compose Allowed Risk Levels expression rebuilds the inclusion array at every run — no flow edits required.

Targeting a different channel

Update flowlibs_TeamsGroupId and flowlibs_TeamsChannelId and re-authorize the Teams connection if it points to a different identity. The flow does not need to be edited.

Switching from app-only to delegated auth

Replace the HTTP action's ActiveDirectoryOAuth block with a ManagedServiceIdentity block (Azure-hosted scenarios) or migrate to the HTTP with Microsoft Entra ID (preauthorized) connector. The downstream Parse JSON / For Each / Teams steps stay unchanged.

Enriching the Teams card

Replace the HTML in body/messageBody with an Adaptive Card payload to add Approve / Dismiss buttons. Wire those buttons to a follow-up Wait for Adaptive Card response action, then call Graph PATCH /identityProtection/riskyUsers/confirmCompromised or dismiss to close the loop without leaving Teams.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

@if(equals(toLower(variables('varRiskLevelMinimum')),'low'),
    createArray('low','medium','high'),
    if(equals(toLower(variables('varRiskLevelMinimum')),'medium'),
        createArray('medium','high'),
        createArray('high')))

contains(outputs('Compose_Allowed_Risk_Levels'),
         toLower(string(items('For_Each_Risky_User')?['riskLevel'])))

@{concat(variables('varGraphApiEndpoint'), '/identityProtection/riskyUsers')}

@{items('For_Each_Risky_User')?['userPrincipalName']}
@{items('For_Each_Risky_User')?['riskLevel']}
@{items('For_Each_Risky_User')?['riskLastUpdatedDateTime']}