Risk Automations: Set Up Microsoft Teams Credentials for User Risk Templates

• Overview
• Step 1: Copy the OAuth redirect URL
• Step 2: Create an Entra app registration
• Step 3: Assign permissions
• Step 4: Add the redirect URI
• Step 5: Generate a client secret
• Step 6: Add the credential to Risk Automations
• Replace the client secret before it expires

Overview

There are User Risk templates that message your users in Microsoft Teams (e.g. Notify users about a breach). In order to do this, Risk Automations first needs a Microsoft Teams Account credential that connects to its own Entra app registration.

Setup workflow:

• Copy the OAuth redirect URL from Risk Automations.
• Create an Entra app registration with permissions to message users, add the redirect URI, and generate a client secret.
• Enter the app registration’s values into the Microsoft Teams Account credential.

You’ll gather three values from Entra:

• Application (client) ID
• Directory (tenant) ID
• Client secret value

Step 1: Copy the OAuth redirect URL

1. Click the Risk Automations icon in UpGuard’s left-hand navigation panel.
2. Click Credentials.
3. Select Microsoft Teams Account.
4. Copy the OAuth Redirect URL.

Keep the URL handy, because you’ll add it to your Entra app registration in Step 4.

Step 2: Create an Entra app registration

❗Don’t reuse the registration you created for your User Risk directory integration. We recommend separate registrations for different purposes.

1. Open the Microsoft Entra admin center.
2. Go to Identity > Applications > App registrations.
3. Click New registration.
4. Enter a name (for example, UpGuard-Communicate-With-Users).
5. For Supported account types, select Single tenant.
6. Click Register.

Your app registration is now created.

To learn more, see Microsoft’s guide: Register an application in Microsoft Entra ID.

Step 3: Assign permissions

1. In your app registration, click API permissions.
2. Click Add a permission, then select Microsoft Graph.
3. Select Application permissions.
4. Select each permission in the table below.
5. Click Add permissions.
6. Click Grant admin consent for [your tenant name].
7. Check the Status column and confirm each permission shows Granted.

To learn more, see Microsoft’s guide: Configure app permissions for a web API.

Step 4: Add the redirect URI

1. In your app registration, click Authentication (Preview).
2. Click Add Redirect URI.
3. Select Web.
4. Paste the OAuth redirect URL you copied in Step 1.

Step 5: Generate a client secret

❗ When the secret expires, the credential can no longer authenticate to Entra and the workflow fails.

1. In your app registration, click Certificates & secrets, then Client secrets.
2. Click New client secret.
3. Enter a description that includes the expiry date (for example, UpGuard Risk Automations communicate with users, expires [month year]).
4. Select an expiry date.

• We recommend 12 months, but you can choose a shorter period if your security policy requires it. Entra caps a secret’s lifetime at 24 months.
• You can’t extend a secret. When it expires, you create a new one.
• Add the expiry date to your team’s calendar or ticketing system so you can replace the secret before it expires.

1. Click Add.
2. Copy the secret Value.

• Entra shows the secret value only once — if you miss it, create a new secret.

To learn more, see Microsoft’s guide: Add and manage application credentials in Microsoft Entra ID.

Step 6: Add the credential to Risk Automations

1. In the Entra admin center, go to your app registration’s Overview page.
2. Copy the Application (client) ID and the Directory (tenant) ID.
3. In UpGuard, navigate to Risk Automations > Credentials.
4. Select Microsoft Teams Account.
5. In Authorization URL, replace “common” with your Directory (tenant) ID.
6. In Access Token URL, replace “common” with your Directory (tenant) ID.
7. In Client ID, enter your Application (client) ID.
8. In Client Secret, enter the client secret value you copied in Step 5.
9. Scroll to the bottom of the modal and click Connect my account.
10. Save the credential.

Your Microsoft Teams Account credential is now saved in Risk Automations. Next: configure, test, and activate your workflow.

Replace the client secret before it expires

Replace the secret before its expiry date so the workflow keeps running.

1. In the Entra admin center, go to your app registration, then Certificates & secrets > Client secrets.
2. Create a new secret and copy its Value.
3. In UpGuard, navigate to Risk Automations > Credentials and open the Microsoft Teams Account credential.
4. Replace the Client Secret with the new value and save.
5. Run the workflow to confirm it still works.
6. Return to Entra and delete the old secret.