Admin consent for IT admins
This page is for the Microsoft 365 administrator who approves Per My Last Webhook for your organization. It explains what the app does, what permissions it needs, and how to approve, audit, or remove it.
Granting consent installs the app for your organization. It does not give anyone permission to manage it, the consenting admin included: the second step is to assign the Connector Admin role to the people who will. Everyone else can still see the cards in Teams.
What the app does
Per My Last Webhook is a Teams app that receives webhooks from CI/CD and observability tools, normalizes them, and posts Adaptive Cards to Teams channels, DMs, or incoming-webhook URLs. It replaces the retired Office 365 Connectors for pipeline notifications.
The app includes a tabbed admin UI (subscriptions, approvals, audit log) and an optional Bot Framework integration for in-place card updates and direct messages.
Why admin consent is required
The app is multi-tenant: one shared Azure deployment serves many customer organizations. Microsoft Entra ID requires a tenant admin to grant consent before the app can:
- Sign users in with their existing Microsoft 365 identity (SSO via MSAL).
- Read basic profile information to attribute audit-log entries.
- Post messages to Teams on behalf of the installed bot (if you use channel or DM delivery).
Without consent, users see a sign-in or "not installed for this tenant" error. The in-app Diagnostics tab identifies which gate failed.
What we store
We store subscription configuration, encrypted delivery secrets, bot conversation references (if enabled), and a 90-day audit log. We do not persist CI webhook payloads after delivery. Full details: Privacy Policy.
How to approve the app
- A user in your tenant opens Teams → Apps → searches Per My Last Webhook → Add.
- Teams prompts for admin approval. An admin opens the link or goes to Microsoft Entra admin center → Enterprise applications and completes consent.
- Alternatively, use the admin consent URL from the app's install flow (shown when a non-admin tries to add it).
- After consent, assign the Connector Admin role to yourself and anyone else who will create subscriptions. Until then the Subscriptions tab answers "your account has not been given access yet".
Who can manage subscriptions
Management actions require both a valid Entra sign-in and the app's Connector Admin role assigned to the user. This is intentional — subscription changes affect where notifications are delivered and which webhook URLs are registered. Consent does not assign the role to anyone. To assign it:
- Microsoft Entra admin center → Enterprise applications → Per My Last Webhook.
- Users and groups → Add user/group.
- Pick the people, or a group, who will manage subscriptions. Under Select a role choose Connector Admin, then Assign.
- Each of them signs out of the app and back in.
Revoking access
To remove the app from your tenant:
- Microsoft Entra admin center → Enterprise applications → Per My Last Webhook → delete/remove.
- Remove the app from any Teams channels where the bot was added.
- Delete old webhook URLs in your CI/CD platforms so nothing keeps calling us.
Removing the app does not delete your data, and it does not cancel a paid plan. Your subscriptions and history are kept so that a reinstall picks up where you left off. If you are on a paid plan, cancel it from the app's Billing page before you remove the app. To have everything deleted, email hello@permylastwebhook.com from an admin account of the tenant; we complete deletion requests within 30 days. The Privacy Policy lists what is kept and for how long.
Questions
Security issues: security@permylastwebhook.com
General / procurement: hello@permylastwebhook.com
Data protection: privacy@permylastwebhook.com
Once you've approved the app, point your team to the getting-started guide.