Authorize Microsoft Teams in Incident Response

Select a Microsoft Teams channel and authorize the channel to collaborate with team members.

Before you begin

Ensure the Lightstep Incident Response app is included in Microsoft Teams permission policies.


If you do not use the same email address for Microsoft Teams and Lightstep Incident Response (LIR), then you must create a secondary email address in your LIR Profile, under Contact Methods, for the email address that you want to use for Microsoft Teams.

Role required: Lightstep Incident Response Administrator with Azure administrator privileges.


  1. Log in to Lightstep Incident Response.
  2. On the navigation pane, select Integrations.
    Collaboration integrations.
  3. Select Collaboration iconCollaboration integrations.
  4. Select the Microsoft Teams integration card.
    The Microsoft Teams integration page appears.

    Authorize Microsoft Teams

  5. Select Authorize.
    The Microsoft Teams Sign in page appears.
  6. Select your account.
    Note: If you created a secondary email address in your Profile, you can use those credentials instead of your primary email address to authorize.
  7. Enter your password, if it not already stored with your account.
  8. Accept the Terms of Service.
    Microsoft Teams is now integrated with Incident Response for all your Incident Response users and the Lightstep Incident Response channel is active.

    Reauthorize Microsoft Teams


    Any issues found during the authorization, even when it succeeds, are listed here and in Activity section of your Microsoft Teams Lightstep channel.

    If there is an issue with the authentication (auth) token or when the Microsoft Teams version gets upgraded, see Reauthorize an existing Microsoft Teams integration.

What to do next

Start or join a Microsoft Teams channel from any alert or incident. See Alert workspace or Incident workspace for detailed information.