Microsoft 365 SendToUser

Microsoft 365 SendToUser
Certified
Send an Adaptive Card to a user's chat

Resolves (creating if needed) the 1: 1 chat between the authenticated identity and a target user, then posts a Microsoft Adaptive Card to it via the Microsoft Graph API.

Sending a chat message requires DELEGATED (acting-as-user) authentication: set username and password so the task authenticates as a real user. App-only clientSecret (or pemCertificate) credentials are rejected by Microsoft Graph with an HTTP 403, since creating or posting to a 1: 1 chat is a restricted Graph capability under application permissions.

yaml
type: io.kestra.plugin.microsoft365.teams.adaptivecards.SendToUser

Examples

Send an Adaptive Card to a specific user's chat

yaml
id: notify_user_via_adaptive_card
namespace: company.team

tasks:
  - id: send_to_user
    type: io.kestra.plugin.microsoft365.teams.adaptivecards.SendToUser
    tenantId: "{{ secret('AZURE_TENANT_ID') }}"
    clientId: "{{ secret('AZURE_CLIENT_ID') }}"
    clientSecret: "{{ secret('AZURE_CLIENT_SECRET') }}"
    userEmail: "oncall@company.com"
    card: |
      {
        "$schema": "http://adaptivecards.io/schemas/adaptive-card.json",
        "type": "AdaptiveCard",
        "version": "1.4",
        "body": [
          {
            "type": "TextBlock",
            "text": "You have a pending approval for flow **{{ flow.id }}**.",
            "wrap": true
          }
        ],
        "actions": [
          {
            "type": "Action.OpenUrl",
            "title": "Review",
            "url": "{{ kestra.url }}/ui/executions/{{ flow.namespace }}/{{ flow.id }}/{{ execution.id }}"
          }
        ]
      }

Send an Adaptive Card by user ID instead of email

yaml
id: notify_user_by_id
namespace: company.team

tasks:
  - id: send_to_user
    type: io.kestra.plugin.microsoft365.teams.adaptivecards.SendToUser
    tenantId: "{{ secret('AZURE_TENANT_ID') }}"
    clientId: "{{ secret('AZURE_CLIENT_ID') }}"
    clientSecret: "{{ secret('AZURE_CLIENT_SECRET') }}"
    userId: "8b081ef6-4792-4def-b2c9-c363a1bf41d5"
    card: |
      {
        "$schema": "http://adaptivecards.io/schemas/adaptive-card.json",
        "type": "AdaptiveCard",
        "version": "1.4",
        "body": [
          {
            "type": "TextBlock",
            "text": "Flow {{ flow.id }} finished with status {{ execution.state.current }}.",
            "wrap": true
          }
        ]
      }

Send an Adaptive Card to a user's chat using delegated (username/password) authentication

yaml
id: notify_user_delegated
namespace: company.team

tasks:
  - id: send_to_user
    type: io.kestra.plugin.microsoft365.teams.adaptivecards.SendToUser
    tenantId: "{{ secret('AZURE_TENANT_ID') }}"
    clientId: "{{ secret('AZURE_CLIENT_ID') }}"
    username: "{{ secret('AZURE_USERNAME') }}"
    password: "{{ secret('AZURE_PASSWORD') }}"
    userEmail: "oncall@company.com"
    card: |
      {
        "$schema": "http://adaptivecards.io/schemas/adaptive-card.json",
        "type": "AdaptiveCard",
        "version": "1.4",
        "body": [
          {
            "type": "TextBlock",
            "text": "You have a pending approval for flow **{{ flow.id }}**.",
            "wrap": true
          }
        ]
      }

Properties

card *string

Adaptive Card payload

The Adaptive Card JSON payload, rendered as a Pebble template before being sent. See https://adaptivecards.io/explorer/ for the schema reference.

clientId string

Client ID

Client ID of the Azure service principal. If you don't have a service principal, refer to create a service principal with Azure CLI.

clientSecret string

Client Secret

Service principal client secret. Use this for Client Secret authentication. Provide clientId, tenantId, and clientSecret. Either clientSecret OR pemCertificate must be provided, not both.

password string

Password

Password of the delegated user, used together with username for Resource Owner Password Credentials (ROPC) authentication. Requires the Azure AD app registration to have "Allow public client flows" enabled and the relevant delegated Graph permission granted (e.g. ChannelMessage.Send or Chat.ReadWrite).

pemCertificate string

PEM Certificate

Alternative authentication method using certificate-based authentication.
Use this for Client Certificate authentication. Provide clientId, tenantId, and pemCertificate.
Either clientSecret OR pemCertificate must be provided, not both.

pluginDefaultsRef string

Reference (ref) of the pluginDefaults to apply to this task.

tenantId string

Tenant ID

userEmail string

Target user email

User principal name (email) of the user to message. Exactly one of userId or userEmail must be set.

userId string

Target user ID

Azure AD object ID of the user to message. Exactly one of userId or userEmail must be set. Must differ from the authenticated account: Microsoft Graph rejects a self-target given as userId as a duplicate chat member.

username string

Username

Username of the delegated user to authenticate as (Resource Owner Password Credentials flow). Set this together with password for delegated (acting-as-user) authentication instead of app-only clientSecret/pemCertificate credentials. This is required for operations Microsoft Graph rejects under app-only auth, such as sending Teams channel or chat messages. Requires the Azure AD app registration to have "Allow public client flows" enabled and the relevant delegated Graph permission granted (e.g. ChannelMessage.Send or Chat.ReadWrite).

Outputs

chatId string

Chat ID

Identifier of the 1: 1 chat with the target user

messageId string

Message ID

Identifier of the sent chat message