checkId: check.notify.teams.connectivity plugin: stellaops.doctor.notify severity: warn tags: [notify, teams, connectivity, network, air-gap]

Teams Connectivity

This Stella Ops Doctor diagnostic proves that Doctor can actually reach the configured Microsoft Teams webhook, not just that it is well-formed. It performs a live network probe and is therefore skipped in sealed/air-gapped deployments; configuration is validated separately by check.notify.teams.configured.

What It Checks

Verifies that the configured Microsoft Teams webhook endpoint is reachable. The check:

• Sends a minimal Adaptive Card payload to the webhook URL with a 10-second timeout.
• Passes if the response is successful (HTTP 2xx).
• Warns if an unexpected HTTP status is returned (invalid, expired, or revoked webhook).
• Fails on connection timeout or HTTP request exceptions.

The check only runs when Notify:Channels:Teams:WebhookUrl is set and is a valid absolute URL.

Air-Gap Behavior

When the deployment is sealed by AirGap policy, or STELLAOPS_DOCTOR_OFFLINE_PROFILE=true forces Doctor offline mode, this check returns Skip with airGapSealed=true instead of posting to Microsoft Teams. check.notify.teams.configured still runs because it only validates local configuration.

Use an internal notification bridge, queue export, or offline operator workflow for sealed deployments. Public Teams webhooks require egress and should remain disabled unless policy explicitly allows them.

Why It Matters

An unreachable Teams webhook means notifications silently fail to deliver. Operations teams will miss release alerts and security findings if the webhook is broken.

Common Causes

• Invalid or expired webhook URL
• Teams connector disabled or deleted
• Microsoft 365 tenant configuration changed
• Firewall blocking outbound HTTPS to webhook.office.com
• Proxy configuration required

How to Fix

Docker Compose

docker exec <notify-container> curl -v https://webhook.office.com/

Bare Metal / systemd

curl -v https://webhook.office.com/
curl -H 'Content-Type: application/json' \
  -d '{"text":"Doctor test"}' \
  'https://YOUR_TENANT.webhook.office.com/webhookb2/...'

Check Microsoft 365 service status at https://status.office.com.

Kubernetes / Helm

kubectl exec -it <notify-pod> -- curl -v https://webhook.office.com/

If the webhook is broken, recreate it from the Teams channel: Connectors → Incoming Webhook, then delete and re-create the connector to mint a fresh URL.

Verification

stella doctor run --check check.notify.teams.connectivity

Related Checks

• check.notify.teams.configured — verifies Teams webhook URL is set and valid
• check.notify.queue.health — verifies the notification delivery queue is healthy