A Microsoft Sentinel playbook is triggered when a Defender for AI alert fires for 'Sensitive data exposed in AI response.' The playbook must automatically post a notification to a Microsoft Teams channel with the alert details. Which Logic App action step is required for this Teams notification?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because the Microsoft Teams Logic App connector includes a 'Post a message in a chat or channel' action that directly posts formatted messages to a specified Teams channel. This is the native, purpose-built integration for posting Teams notifications from Logic App playbooks and supports rich formatting with card content.
Full explanation below image
Full Explanation
B is correct because the Microsoft Teams Logic App connector includes a 'Post a message in a chat or channel' action that directly posts formatted messages to a specified Teams channel. This is the native, purpose-built integration for posting Teams notifications from Logic App playbooks and supports rich formatting with card content. A is incorrect because while an HTTP connector with a Teams incoming webhook URL is a functional approach, the native Microsoft Teams connector is the preferred method as it provides better authentication, richer formatting options, and direct channel addressing without requiring webhook URL management. C is incorrect because sending email to a Teams channel email address creates a Teams message from email, but this is slower, adds email routing complexity, and does not format as well as native Teams messages. D is incorrect because Azure Service Bus with a separate Teams application subscriber is an unnecessarily complex event-driven architecture when direct Teams connector integration is available.