Microsoft Graph — Teams Notifications

Send notifications, reports, and alerts to Microsoft Teams channels via the Microsoft Graph API. Use this as an alternative or complement to Slack for organizations running Microsoft 365.

How to Call the Tools

The Microsoft Graph MCP server is invoked via npx with Azure AD credentials:

AZURE_TENANT_ID=$AZURE_TENANT_ID AZURE_CLIENT_ID=$AZURE_CLIENT_ID AZURE_CLIENT_SECRET=$AZURE_CLIENT_SECRET \
  python3 $MCP_CALL "npx -y @anthropic-ai/microsoft-graph-mcp" <tool-name> '<arguments-json>'

Available Operations

1. List Teams

AZURE_TENANT_ID=$AZURE_TENANT_ID AZURE_CLIENT_ID=$AZURE_CLIENT_ID AZURE_CLIENT_SECRET=$AZURE_CLIENT_SECRET \
  python3 $MCP_CALL "npx -y @anthropic-ai/microsoft-graph-mcp" graph_list_teams '{}'

2. List Channels in a Team

AZURE_TENANT_ID=$AZURE_TENANT_ID AZURE_CLIENT_ID=$AZURE_CLIENT_ID AZURE_CLIENT_SECRET=$AZURE_CLIENT_SECRET \
  python3 $MCP_CALL "npx -y @anthropic-ai/microsoft-graph-mcp" graph_list_channels '{"teamId":"<team-id>"}'

3. Send a Message to a Channel

AZURE_TENANT_ID=$AZURE_TENANT_ID AZURE_CLIENT_ID=$AZURE_CLIENT_ID AZURE_CLIENT_SECRET=$AZURE_CLIENT_SECRET \
  python3 $MCP_CALL "npx -y @anthropic-ai/microsoft-graph-mcp" graph_send_channel_message '{"teamId":"<team-id>","channelId":"<channel-id>","message":"<html-content>"}'

4. Reply to a Thread

AZURE_TENANT_ID=$AZURE_TENANT_ID AZURE_CLIENT_ID=$AZURE_CLIENT_ID AZURE_CLIENT_SECRET=$AZURE_CLIENT_SECRET \
  python3 $MCP_CALL "npx -y @anthropic-ai/microsoft-graph-mcp" graph_reply_to_message '{"teamId":"<team-id>","channelId":"<channel-id>","messageId":"<msg-id>","message":"<html-content>"}'

5. List Recent Messages

AZURE_TENANT_ID=$AZURE_TENANT_ID AZURE_CLIENT_ID=$AZURE_CLIENT_ID AZURE_CLIENT_SECRET=$AZURE_CLIENT_SECRET \
  python3 $MCP_CALL "npx -y @anthropic-ai/microsoft-graph-mcp" graph_list_channel_messages '{"teamId":"<team-id>","channelId":"<channel-id>"}'

Message Formats

Health Check Alert

<h3>Health Check Report — 2026-02-22</h3>
<table>
  <tr><th>Device</th><th>CPU</th><th>Memory</th><th>Status</th></tr>
  <tr><td>R1</td><td>23%</td><td>45%</td><td>HEALTHY</td></tr>
  <tr><td>SW1</td><td>82%</td><td>67%</td><td>WARNING</td></tr>
</table>
<p><strong>1 WARNING</strong> — SW1 CPU at 82% (threshold: 80%)</p>

Security Alert (Critical)

<h3>CRITICAL — CVE Exposure Detected</h3>
<p><strong>Device:</strong> R1 (IOS-XE 17.9.4a)</p>
<p><strong>CVE-2023-20198</strong> (CVSS 10.0) — Web UI privilege escalation</p>
<p><strong>Exposure:</strong> CONFIRMED — ip http server enabled</p>
<p><strong>Action Required:</strong> Disable ip http server or upgrade immediately</p>

Change Completion

<h3>Change Complete — CHG0012345</h3>
<p><strong>Target:</strong> R1 — Add Loopback99 (99.99.99.99/32)</p>
<p><strong>Status:</strong> SUCCESS — verified, CR closed</p>
<p><strong>GAIT Branch:</strong> config-r1-loopback99-2026-02-22</p>

Topology Diagram Share

<h3>Updated Network Topology</h3>
<p>Campus physical topology regenerated from CDP/LLDP discovery.</p>
<p><strong>Devices:</strong> 4 | <strong>Links:</strong> 6 | <strong>Changes:</strong> +1 new link (R2-SW2)</p>
<p><a href="https://contoso.sharepoint.com/sites/neteng/Topology/campus-physical-2026-02-22.vsdx">Open in Visio</a></p>

When to Use

Health alerts — Post health check results with severity-coded summaries
Security notifications — Alert on CVE exposure, failed security audits, or posture violations
Change updates — Notify the team when changes are completed, failed, or rolled back
Incident updates — Post investigation progress and resolution to incident channels
Report delivery — Share audit reports, reconciliation results, and compliance summaries
Diagram sharing — Post links to updated Visio topology diagrams on SharePoint

Channel Mapping

Map Teams channels to NetClaw notification types:

### Teams Channel Map (configure in TOOLS.md)
- #netclaw-alerts     → P1/P2 critical alerts, CVE exposure
- #netclaw-reports    → Health reports, audit results, reconciliation
- #netclaw-changes    → Change request updates, completion notices
- #network-general    → P3/P4 notifications, topology updates
- #incidents          → Active incident investigation threads

Integration with Other Skills

pyats-health-check — Post health check summaries to Teams
pyats-security — Alert on CVE exposure and failed security audits
netbox-reconcile — Post drift detection results to Teams
servicenow-change-workflow — Notify on CR creation, approval, completion
ise-incident-response — Post investigation progress to incident channels
msgraph-visio — Share Visio diagram links in Teams channels
msgraph-files — Reference SharePoint file links in Teams messages
gait-session-tracking — Record Teams notifications in audit trail

Rules

Never post credentials or secrets to Teams channels
Always include severity level in alert messages
Thread incident updates — reply to the original message, don't create new top-level posts
Respect channel purpose — alerts go to alert channels, reports go to report channels
Include actionable context — every alert should say what happened and what to do next

GAIT Audit Trail

Record Teams notifications in GAIT:

python3 $MCP_CALL "python3 -u $GAIT_MCP_SCRIPT" gait_record_turn '{"input":{"role":"assistant","content":"Posted fleet health report to Teams #netclaw-reports channel. 4 devices assessed: 3 HEALTHY, 1 WARNING (SW1 CPU 82%). Included table with CPU, memory, and interface status per device.","artifacts":[]}}'

msgraph-teams