Overview
This page is for administrators configuring a webhook, and for developers building the endpoint that receives it.
A webhook lets EasyLife 365 Identity call one of your own endpoints the moment a policy escalates, instead of your systems having to poll for changes. When an escalation is reached, EasyLife 365 Identity sends an HTTP POST with a JSON body describing the application, the rule that escalated, and the application's current policy state.
Webhooks are useful when an escalation should start something outside EasyLife 365 Identity: opening a ticket, notifying a team channel, or writing to a governance system of record.
When a webhook fires
A webhook is an escalation action, so it fires only when a rule escalates: the owners were reminded, the reminders ran out, and the application is still not compliant.
Every rule can send a webhook:
| Rule | Fires when |
|---|---|
| Minimum Application Owners | The application has fewer application owners than the policy requires. |
| Minimum Technical Owners | The application has fewer technical owners than the policy requires. |
| Minimum Business Owners | The application has fewer business owners than the policy requires. |
| Activity | The enterprise application has no qualifying sign-in within the configured window. |
| Baseline Configuration | The application no longer meets the configured baseline configuration. |
A webhook does not replace the email notification. Configure both on the same rule if you want an owner to be emailed and your own system to be called.
Configure a webhook
Webhooks are configured per rule, on the policy that governs the application.
- In EasyLife 365 Admin, go to Policies → the policy you want to change.
- Open the rule you want to escalate — for example Minimum Application Owners.
- Under the escalation settings, find Get notified via webhook.
- Enter the full URL EasyLife 365 Identity should call.
- Choose how EasyLife 365 Identity authenticates to it, using the selector at the end of the URL field.
- Save the policy.
Read more in Ownership rules, Activity rule, and Baseline Configuration rule.
Authentication
Three options are available.
| Option | What EasyLife 365 sends |
|---|---|
| No auth | Nothing. The request carries only the JSON body. |
| Code authentication | The value you supply is appended to the URL as a code query parameter, which is what an Azure Function key expects. |
| Entra ID | EasyLife 365 Identity acquires a token for the Entra ID application you name and sends it as a Bearer token. |
For Entra ID, enter the Application ID of the Entra ID application that represents your receiving endpoint. EasyLife 365 Identity authenticates to that application as itself and requests no permissions, so the token proves who is calling and nothing more. Your endpoint validates it like any other Entra ID token.
The Entra ID option must name your own application. EasyLife 365 Identity refuses to mint a token for a Microsoft first-party API such as Microsoft Graph, or for an EasyLife 365 application, and it discards any token that comes back carrying permissions. This prevents a webhook from being used to obtain a token that would grant access to something other than your endpoint.
URL requirements
The URL you enter must be reachable from the internet and is validated before it is saved and again before each call:
- It must use
https. - It must not point at a loopback, private, link-local, carrier-grade NAT, or IPv6 unique-local address.
A URL that does not meet these rules is rejected. This keeps a webhook from being pointed at infrastructure inside the EasyLife 365 service.
Delivery and retries
Each escalation is queued before it is sent, so a temporary failure at your endpoint does not lose the notification.
- EasyLife 365 Identity expects a 2xx response, and waits up to 30 seconds for it.
- Any other response, or no response, counts as a failure.
- A failed delivery is retried, for a total of 5 attempts roughly four minutes apart.
- After the last attempt, the notification is abandoned and is not delivered later.
Make your endpoint respond quickly and do the real work asynchronously. An endpoint that takes longer than 30 seconds is treated as failed and the escalation will be sent again.
Design your receiver to tolerate the same escalation arriving more than once. A retry happens whenever EasyLife 365 does not see a success, including when your endpoint did the work but answered too late.
Testing a webhook
To see the exact request without building an endpoint first, use https://webhook.site. It gives you a temporary public https URL that satisfies the rules above and shows every request it receives.
Keep the tab open while testing. Visiting https://webhook.site again creates a new, private endpoint.
What is in the body
Every Identity webhook carries the same payload shape, described in Escalations.