Microsoft Graph Webhooks

Microsoft Graph delivers change notifications (webhooks) when a resource you subscribe to — Outlook messages, Teams chatMessages, OneDrive/SharePoint driveItems, users, groups, presence, and more — is created, updated, or deleted. There is no HMAC signature and it does not follow the Standard Webhooks spec. Instead, Graph uses a three-part validation model.

When to Use This Skill

• How do I receive Microsoft Graph webhooks / change notifications?
• How do I respond to the validationToken endpoint validation handshake?
• How do I validate the clientState on a Microsoft Graph notification?
• How do I create/renew a Microsoft Graph subscription (they expire fast)?
• How do I decrypt rich notifications with includeResourceData: true?
• How do I handle lifecycle notifications (reauthorizationRequired, subscriptionRemoved, missed)?
• Why is my Microsoft Graph subscription creation failing validation?

The Three-Part Validation Model