Share via

Does the sig parameter generated by "When a Teams webhook request is received" expire?

TW Th 20 Reputation points
2026-05-06T03:53:31.39+00:00

I am using the "When a Teams webhook request is received" trigger in Workflow inside Microsoft Teams.

After generating the webhook URL, I noticed that the URL contains a sig query parameter.

Example: https://.../invoke?api-version=...&sp=...&sv=...&sig=xxxxx

I would like to know:

  1. Does the sig parameter have an expiration date or validity period?
  2. If it expires, how can I check or determine the expiration time?
  3. Is the webhook URL intended to remain valid indefinitely unless manually regenerated/deleted, or should applications handle periodic renewal?

I checked the documentation but could not find clear information about the lifecycle of this generated signature.

Any clarification would be appreciated.

Microsoft Teams | Development
Microsoft Teams | Development

Building, integrating, or customizing apps and workflows within Microsoft Teams using developer tools and APIs

0 comments No comments

Answer accepted by question author

  1. Hani-Ng 10,575 Reputation points Microsoft External Staff Moderator
    2026-05-06T04:31:02.83+00:00

    Hi TW Th

    Based on your description, I would like to share some information from my research that I hope will be helpful.

    Does the sig parameter have an expiration date or validity period?

    There is no documented time‑based expiration for the sig parameter. The sig value is the Shared Access Signature (SAS) used to secure the request-based trigger endpoint in Logic Apps–based workflows. While the documentation explains the purpose and structure of this signature, it does not define any expiration time or validity window for it.

    If it expires, how can the expiration time be checked?

    Because no expiration or lifetime is documented, there is no supported way to check or determine an expiration time for the sig parameter. Unlike Azure Storage SAS tokens (which often include explicit expiry fields), the callback URL generated for request-based triggers does not expose expiration metadata.

    Is the webhook URL intended to remain valid indefinitely, or should applications handle renewal?

    Based on current documentation and platform behavior, the webhook URL is intended to remain valid indefinitely. There is no requirement for applications to perform periodic renewal of the webhook URL or the sig parameter.

    It remains valid unless one of the following occurs:

    • The trigger or workflow is deleted and recreated.
    • The callback URL is manually regenerated.
    • Access is restricted through security controls (for example: IP allowlists, API Management, or Microsoft Entra ID).

    Because the sig parameter does not have a documented expiration, it should be managed as a secure token. You can consider applying additional security controls for production scenarios, such as:

    • Restricting inbound IP address ranges.
    • Using Azure API Management in front of the workflow.
    • Using Microsoft Entra ID authentication where supported.

    For your reference: Secure access and data in workflows - Azure Logic Apps | Microsoft Learn

    I hope this information helps and if you have any further questions, please feel free to ask via comment section.


    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    1 person found this answer helpful.

0 additional answers

Sort by: Most helpful

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.