Subscribe To Webhook - BlinkOps Documentation

Subscribe a webhook URL to a specific type of change notification. Each type of resource subscription has a different expiration time, which can be found in the reference. It is recommended that you use this action in a scheduled automation to refresh your webhook subscription. For a full list of resources, visit the Microsoft reference.

The provided connection must have access to the resource in order a create a webhook subscription.Some types of resources require an OAuth connection (delegated) or an application connection.Refer to the Microsoft documentation for a list of allowed permission types.

External DocumentationTo learn more, visit the Microsoft Defender XDR documentation.

Basic Parameters

Parameter	Description
Change Type	Indicate the type of change in the subscribed resource that will raise a change notification. The supported values are: `created`, `updated`, `deleted`. Note: Drive root item and list change notifications support only the `updated` changeType. User and group change notifications support `updated` and `deleted` changeType. Use `updated` to receive notifications when user or group is created, updated or soft deleted. Use `deleted` to receive notifications when user or group is permanently deleted.
Expiration	Specifies the date and time when the webhook subscription expires. The time is in UTC, and can be an amount of time from subscription creation that varies for the resource subscribed to. For the maximum supported subscription length of time, see the table on the Microsoft reference.
Resource	Specify the resource that will be monitored for changes. Do not include the base URL `https://graph.microsoft.com/v1.0/`. See the possible resource path values for each supported resource.
Webhook URL	The URL of the endpoint that will receive the change notifications. This URL must make use of the HTTPS protocol. Any query string parameter included in the `notificationUrl` property will be included in the HTTP POST request when Microsoft Graph sends the change notifications.

Advanced Parameters

Parameter	Description
Client State	Specifies the value of the `clientState` property sent by the service in each change notification. The maximum length is 128 characters. The client can check that the change notification came from the service by comparing the value of the `clientState` property sent with the subscription with the value of the `clientState` property received with each change notification.

Example Output

{
	"@odata.context": "https://graph.microsoft.com/beta/$metadata#subscriptions/$entity",
	"id": "5522bd62-7c96-4530-85b0-00b916f6151a",
	"resource": "users/622eaaff-0683-4862-9de4-f2ec83c2bd98/messages",
	"applicationId": "507c3b9a-67b8-463d-88a2-15a8cefb2111",
	"changeType": "created",
	"clientState": "secretClientState",
	"notificationUrl": "https://webhook.azurewebsites.net/api/send/myNotifyClient",
	"notificationQueryOptions": null,
	"notificationContentType": null,
	"lifecycleNotificationUrl": null,
	"expirationDateTime": "2022-01-01T21:42:18.2257768Z",
	"creatorId": "a4c7bd34-4f3b-46b7-a25d-b63c1e2a2842",
	"includeResourceData": null,
	"latestSupportedTlsVersion": "v1_2",
	"encryptionCertificate": null,
	"encryptionCertificateId": null,
	"notificationUrlAppId": null
}

Workflow Library Example

Subscribe to Webhook with Microsoft Defender Xdr and Send Results Via Email

Preview this Workflow on desktop

​Basic Parameters

​Advanced Parameters

​Example Output

​Workflow Library Example

Basic Parameters

Advanced Parameters

Example Output

Workflow Library Example