How do you go about alerting via MS Teams?

[mickeyMoose]

Hi there,
I'm configuring Zabbix notifications using an MS Teams Workflow media type and I'm trying to understand how others handle the user/media relationship.

Scenario:
- Media type "MS Teams - Alerts" is configured to sends notifications to Teams chat.
- Above media type is used in Trigger Action which is set to send anything that is a Warning (or above) to "Cloud Team" (user group) via "MS Teams - Alerts" (media type)
- At least one user in "Cloud Team" needs to have a media type "MS Teams - Alerts" configured in their User Settings
* However, if more than one user has it configured, the notification is sent more than once
* Also, the fact that notifications are sent is dependent on one user (what if this account is deleted etc.?)

How do you handle this?
Do you create a dedicated account for alerts and attach all media types to it? If so, does the account need any specific permissions?
Also, I've noticed that there's a way to set media type during user provisioning based on SAML attribute, but that seems to cover email only (or not?)


Am I missing something here?

[rozols]

Hi,

Yes — create a dedicated service/notification account (not tied to any real person) and configure the MS Teams media only on that account. This solves both problems you raised:

• Only one account has the media configured, so no duplicate sends
• The notification path is not tied to any individual account existing or staying active

Permissions needed on that account:

• Role type "User" is enough — you do not need Admin or Super Admin
• It needs to be in a user group with read permission on the host groups your triggers belong to. Otherwise Zabbix wont notify a user, even with correct media configured, if they have no visibility into the host that raised the problem. Notification just silently does not happen — no error, it just never sends.

Worth pairing this with a dedicated trigger action (rather than reusing a default/catch-all action) that sends specifically to this account via this media type only. That way the notification path stays structurally isolated — nobody can accidentally break it later by adding their own Teams media to their personal account.

On your SAML question: media type mapping in JIT provisioning is not actually limited to email — you can map any SAML attribute to any media type. I confirmed this in a test lab (Zabbix 7.0 + Keycloak) — mapped a custom attribute to MS Teams Workflow media successfully, and severity/active-hours came through fully editable on the provisioned media rather than locked to 24/7-all-severities.

[mickeyMoose]

Thanks for confirming my suspicion regarding dedicated accounts

About SAML and provisioning, from what I see, you can map attribute to media type, e.g. map your email to email media type.
However, you cannot control which media type is set for user using the attributes, e.g. if user has attribute equal to X, assign media type X.

[rozols]

Hi,

If you meant value-based branching on a single attribute — confirmed, not possible. Tested it: same attribute, different values on two users, only "Send to" differed. Severity/hours/enabled stayed identical, since those come from the mapping row, not the value.

But per-profile automatic provisioning does work using separate attributes per profile:

• Mapped MS Teams Workflow to attribute teams_webhook with one severity/hours profile
• Added a second mapping row, same media type, different attribute teams_webhook2, different profile
• User with both attributes, got both media entries provisioned automatically on SAML login

Two issues found:

• Zabbix blocks two rows sharing the same (media type, attribute) — validation error on save
• If a user ends up with both attributes, they get notified twice, so exclusivity needs to be enforced