2.5 Webhooks, Service Hooks & Microsoft Teams ChatOps

2.5 Webhooks, Service Hooks & Microsoft Teams ChatOps

Documentation tells people what the system does; event-driven integration tells them what it just did. Azure DevOps service hooks and GitHub webhooks push lifecycle events to external consumers, and the Microsoft Teams apps turn those events into approvals and notifications engineers can act on without leaving chat.

Service Hooks, Webhooks & Event-Driven Collaboration

Service Hooks allow external services (such as Microsoft Teams, Slack, Azure Functions, or custom HTTP endpoints) to subscribe to events in Azure DevOps.

+--------------------+         +-----------------------+         +---------------------+
|   AZURE DEVOPS     |  Event  |      AZURE DEVOPS     |  JSON   |  EXTERNAL CONSUMER  |
|     PUBLISHER      | ------> |     SERVICE HOOK      | ------> |  (Teams / Webhook)  |
| (Pipelines/Boards) |         | (Generates HMAC Token)|         | (Validates Digest)  |
+--------------------+         +-----------------------+         +---------------------+

Service Hook Architecture

• Publishers: Azure DevOps services that generate events (Pipelines, Repos, Boards, Artifacts).
• Event Triggers: Specific actions that fire notifications:
  • git.push: Code pushed to a repository branch.
  • git.pullrequest.created / git.pullrequest.merged: PR lifecycle events.
  • build.complete: CI pipeline completed.
  • release.deployment.approval.pending: Release paused awaiting human approval.
  • workitem.created / workitem.updated: Work tracking updates.
• Consumers: Target endpoints that consume event payloads (Microsoft Teams, Slack, Azure Service Bus, Azure Functions, Webhooks).

Webhook Payloads and HMAC Signature Verification

When using generic Webhooks as the consumer, Azure DevOps sends an HTTP POST request containing a JSON payload. To prevent man-in-the-middle tampering, unauthorized payload injection, and replay attacks, Azure DevOps allows configuring a Secret Token.

1. Azure DevOps computes a Hash-based Message Authentication Code (HMAC) using SHA-1 or SHA-256 over the raw JSON payload with the shared secret token.
2. Azure DevOps places this signature in the HTTP request header (e.g., X-Hub-Signature).
3. The receiving external endpoint calculates its own HMAC digest over the incoming raw request body using the pre-shared secret.
4. If the computed digest matches the header signature, the payload is authentic and unaltered. If they mismatch, the receiving endpoint rejects the request with HTTP 401/403.

---

Microsoft Teams ChatOps for Azure DevOps

Microsoft Teams provides two first-party integrated apps for Azure DevOps ChatOps:

1. Azure Boards App for Microsoft Teams

• Channel Commands: Run slash commands directly in Teams channels:
  • @azure boards link [project-url]: Connects the Teams channel to an Azure Boards project.
  • @azure boards create: Launches an interactive modal card in Teams to create new User Stories, Bugs, or Tasks.
  • @azure boards query [query-name]: Executes a shared flat query and posts the results into the conversation.
• Interactive Work Item Cards: Displays rich Adaptive Cards when work item URLs are pasted. Users can update status, change assignees, and add discussion comments directly from Teams.

2. Azure Pipelines App for Microsoft Teams

• Channel Commands:
  • @azure pipelines subscribe [pipeline-url]: Subscribes the channel to pipeline build and deployment notifications.
  • @azure pipelines subscriptions: Displays active subscriptions with options to add branch or stage filters (e.g., filter notifications strictly to stageName = 'Production').
• Interactive Deployment Approvals: When a YAML pipeline deployment reaches an Environment with Approval Checks, the Azure Pipelines Teams app posts an interactive Adaptive Card into the channel.
• Seamless Approval Gate: Designated approvers can review the commit hash, pipeline run details, and release notes, and click Approve or Reject with optional comments directly inside Microsoft Teams. Azure Pipelines immediately resumes the deployment stage upon receiving the authenticated approval webhook.

---

Service Hook Triggers and Actions Reference Table

---

Webhook Security and Connection Governance

Webhook endpoints are unauthenticated HTTP listeners by default, so the exam expects three controls on every custom integration:

• Signature verification. GitHub signs each delivery with X-Hub-Signature-256, an HMAC-SHA256 of the raw body using the webhook secret. Compute the digest over the raw payload bytes before any JSON parsing, and compare with a constant-time function. Azure DevOps service hooks do not sign payloads, so protect those consumers with a Basic-auth header or a hard-to-guess URL path plus an IP allowlist.
• Replay protection. Persist the delivery GUID (X-GitHub-Delivery) and reject repeats. Service hooks retry on non-2xx responses, so a slow consumer that returns 500 will legitimately receive the same event several times.
• Least-privilege consumers. A webhook receiver that opens work items needs only the Azure Boards scope; do not reuse an organization-wide PAT.

Connection governance differs between the two Teams apps and the Boards-GitHub link:

Prefer the GitHub App installation for the Boards-GitHub connection: OAuth and PAT connections inherit a single human identity and break the AB# mention linking the moment that account is disabled.

---

AZ-400 Exam Pitfalls & Traps

1. Selecting Project Wiki When Versioning is Required:
   • Exam Trap: An exam question requires documentation that must branch alongside source code for versioned microservice releases.
   • Answer: Never select Project Wiki. You must select Publish Code as Wiki pointing to the repository's documentation directory.
2. Relying Exclusively on Client-Side Git Hooks for Commit Governance:
   • Exam Trap: Implementing Husky commit-msg hooks to enforce enterprise commit message standards.
   • Answer: Client-side hooks alone fail compliance audits because any developer can run git commit --no-verify. Enterprise enforcement requires Azure Repos PR status checks and build validation policies.
3. Ignoring Webhook Payload Authentication:
   • Exam Trap: Validating incoming Azure DevOps webhook payloads by checking the User-Agent header or basic IP allowlisting.
   • Answer: User-agent headers are easily spoofed. The cryptographically secure approach is HMAC signature verification using a pre-shared secret token.