How to Send ServiceNow Incident Alerts to Microsoft Teams Using Power Automate

What We Are Building

This tutorial focuses on a common IT operations workflow: a ServiceNow report is generated on a schedule and delivered to an Outlook mailbox as a CSV attachment.

The traditional process requires an operations engineer to manually open the report, identify high-priority incidents, read the important fields, and then post the relevant information into Microsoft Teams.

The manual process typically looks like this:

1. Receive the scheduled ServiceNow incident report by email.
2. Open the CSV attachment.
3. Search for high-priority incidents.
4. Review incident information such as number, priority, short description, assignment group, status, caller, and description.
5. Copy the relevant information.
6. Open the appropriate Microsoft Teams conversation or channel.
7. Manually post the incident information for the operations team.

This is exactly the type of repetitive workflow that Power Automate can handle.

The goal is to create an automated path where the scheduled incident report becomes the input, Power Automate processes the CSV, high-priority incidents are identified, and the selected information is delivered to Microsoft Teams without requiring someone to manually monitor the report.

The final architecture looks like this:

ServiceNow Scheduled Report
          │
          ▼
   Outlook Email
          │
          ▼
   CSV Attachment
          │
          ▼
    Power Automate
          │
          ├── Validate Attachment
          │
          ├── Convert Base64 → Text
          │
          ├── Clean CSV Content
          │
          ├── Split CSV into Rows
          │
          ├── Skip Header
          │
          ├── Split Rows into Columns
          │
          ├── Check Incident Priority
          │
          └── Filter High/Critical Incidents
                       │
                       ▼
              Microsoft Teams Alert

Full Flow Visualization

Below is a visual representation of the complete automation flow:

The result is a lightweight incident notification workflow. Instead of repeatedly monitoring a scheduled report and manually forwarding important incidents, the operations team receives the selected alerts directly in Teams.

Why Automate ServiceNow Incident Processing?

A scheduled ServiceNow report may contain dozens or hundreds of incidents, while only a small number may require immediate attention from an operations team.

Manually searching the report for priority values introduces repetitive work and creates an additional step between the report arriving and the team being notified.

Power Automate can perform the repetitive filtering automatically.

Manual vs. Automated Process

Prerequisites

To build a similar workflow, you will need:

• Microsoft Power Automate.
• Microsoft Outlook / Microsoft 365.
• Microsoft Teams.
• A scheduled ServiceNow report or another ITSM report delivered as a CSV attachment.
• A consistent CSV structure.
• Permission to create Power Automate flows.

For this example, assume that the CSV contains fields such as:

Incident,Priority,Short Description,Assignment Group,Assigned To,Caller,Created,Category,Sub Category,Location,Description

Your actual ServiceNow export can contain different fields. The important requirement is that the column positions remain predictable so that the expressions used later in the flow match the correct fields.

Step 1: Trigger the Power Automate Flow

Start with the Outlook trigger: When a new email arrives (V3).

Configure the trigger so that only the scheduled incident reports are processed.

• Email folder: Inbox or a dedicated incident-report folder.
• Subject filter: use the subject generated by the ServiceNow scheduled report.
• Include Attachments: Yes.

Step 2: Process Email Attachments

An email can contain multiple attachments. Therefore, use an Apply to each action to process the attachments individually.

The flow should verify that the attachment is a CSV before processing it.

Expression:

endsWith(items('Apply_to_each')?['name'], '.csv')

If the attachment is not a CSV, the No branch can simply perform no processing for that attachment.

Avoid terminating the entire flow for a non-CSV attachment if the same email could contain another valid CSV attachment.

Step 3: Convert the CSV Attachment from Base64 to Text

Email attachment content is provided to Power Automate as encoded content. Before the CSV can be processed as text, convert the attachment content into a string.

Use a Compose action with:

base64ToString(item()?['contentBytes'])

Step 4: Clean the CSV Content

CSV files generated by enterprise systems can contain Windows-style line endings. Normalize the line endings before splitting the file into rows.

replace(
    replace(
        outputs('CSV_Text'),
        decodeUriComponent('%0D%0A'),
        decodeUriComponent('%0A')
    ),
    decodeUriComponent('%0D'),
    ''
)

%0A represents a line-feed character and %0D represents a carriage return.

Step 5: Handle Windows Line Breaks

Windows commonly represents a new line using \r\n. If carriage returns remain after the first cleanup step, remove them before splitting the CSV.

replace(
    outputs('Clean_CSV_Text'),
    decodeUriComponent('%0D'),
    ''
)

Step 6: Split the CSV into Rows

Once the CSV has been normalized, split the text at each newline to create an array containing individual rows.

split(
    outputs('Remove_CR'),
    decodeUriComponent('%0A')
)

Optional: Count the CSV Rows for Testing

During development and troubleshooting, you can verify how many lines Power Automate has identified.

length(outputs('CSV_Lines'))

Step 8: Skip the CSV Header

The first item in the array represents the column headers. Skip it before processing the actual incident records.

skip(outputs('CSV_Lines'), 1)

Optional: Inspect the First Data Row

During development, you can inspect the first incident row without processing the entire dataset.

first(skip(outputs('CSV_Lines'), 1))

Step 10: Ignore Empty Rows

CSV files can contain trailing blank lines. Add a condition so that only rows containing actual data continue through the parsing logic.

greater(
    length(trim(item())),
    0
)

Step 11: Split Each Incident into Columns

Inside the row-processing loop, the example flow removes simple quote and backslash artifacts before separating the fields by commas.

split(
    replace(
        replace(item(), '"', ''),
        '\\',
        ''
    ),
    ','
)

Step 12: Access Individual CSV Columns

The example CSV contains 11 fields, so the zero-based indexes run from 0 through 10.

Keep this mapping synchronized with the actual ServiceNow report configuration.

Step 13: Filter High and Critical Incidents

The next step is to decide which incidents should generate a Teams notification.

In this example, the flow checks the priority column and continues only when the value contains High or Critical.

or(
    contains(outputs('Cols')[1], 'High'),
    contains(outputs('Cols')[1], 'Critical')
)

The exact terminology used by ServiceNow depends on how your organization's incident priorities and scheduled reports are configured.

Therefore, do not assume that every ServiceNow instance uses the same labels. Modify the condition to match the actual values present in your export.

Step 14: Send the Incident to Microsoft Teams

Once an incident passes the priority condition, use the Teams connector action: Post message in a chat or channel.

Insert the extracted incident fields into the message so that the receiving team has enough context to understand the alert without opening the original report.

Example Microsoft Teams Alert

When a matching incident is detected, the operations channel can receive a formatted notification similar to:

Complete Power Automate Workflow

The complete control flow can be summarized as follows:

┌──────────────────────────────┐
│  ServiceNow Scheduled Report │
└──────────────┬───────────────┘
               │
               ▼
┌──────────────────────────────┐
│       Outlook Email          │
│       Trigger                │
└──────────────┬───────────────┘
               │
               ▼
┌──────────────────────────────┐
│      Get Attachments         │
└──────────────┬───────────────┘
               │
               ▼
┌──────────────────────────────┐
│   Loop Through Attachments   │
└──────────────┬───────────────┘
               │
               ▼
          Is it CSV?
          /         \
        No           Yes
        │             │
        ▼             ▼
      Ignore     Base64 → Text
                       │
                       ▼
                 Clean CSV Text
                       │
                       ▼
                 Split into Rows
                       │
                       ▼
                  Skip Header
                       │
                       ▼
               Process Each Row
                       │
                       ▼
                  Empty Row?
                   /      \
                 Yes       No
                 │          │
                 ▼          ▼
               Ignore   Split Columns
                             │
                             ▼
                       Check Priority
                        /          \
                     Other      High/Critical
                       │             │
                       ▼             ▼
                    Ignore     Teams Message

Key Power Automate Expressions

Common Problems & Troubleshooting

CSV attachment isn't readable

Check that the Outlook trigger includes attachments and that the correct attachment content is passed to base64ToString().

CSV rows aren't splitting correctly

Check the line endings. Windows commonly uses \r\n. Normalize the line endings before calling split().

Header is being processed as an incident

Ensure the array passed to the processing loop uses: skip(outputs('CSV_Lines'), 1).

Blank Teams messages are being generated

Add a condition using greater(length(trim(item())), 0) so that empty rows are ignored.

Incorrect fields appear in Teams

Verify the column indexes against the current ServiceNow CSV export. If the report configuration changes the column order, the positional expressions must also be updated.

Some incident fields are shifted into the wrong columns

Check whether the CSV contains commas inside quoted field values. The simple split() method used in this tutorial cannot reliably distinguish a comma that separates columns from a comma that belongs inside a quoted field.

Important Limitations

1. This is a simple CSV parsing approach

This tutorial intentionally uses Power Automate string expressions rather than a dedicated CSV parser. That keeps the workflow relatively easy to understand and reproduce, but it also means the approach works best when the CSV structure is simple and predictable.

2. Commas inside fields

Consider a field such as: "Server down, impact high".

A plain split(item(), ',') operation can treat the comma inside that value as a column separator. The resulting indexes can therefore become incorrect.

For that reason, this approach should be considered suitable for controlled or predictable CSV exports rather than a full RFC-compliant CSV parser.

3. Embedded line breaks and complex quoting

CSV fields can also contain embedded line breaks or escaped quotation marks. Those cases require additional parsing logic and are outside the scope of this implementation.

4. ServiceNow configurations vary

The exact priority values, field names, scheduled-report format, email subject, and available Microsoft integrations can differ between organizations. Treat the expressions in this article as an implementation pattern and adapt them to your environment.

5. Licensing and organizational policies

This workflow does not require a separate third-party integration platform in the architecture described here. However, Microsoft 365 and Power Automate licensing, connector availability, Teams policies, security controls, and administrator restrictions can vary between environments.

How This Automation Helps IT Operations

• Incident Alerting: Push selected high-priority incidents to operational Teams channels.
• ServiceNow Report Processing: Automatically process scheduled incident exports delivered through email.
• Operational Notifications: Reduce the need for engineers to repeatedly monitor scheduled reports.
• Incident Triage: Surface selected priority incidents so the appropriate team can begin reviewing them sooner.
• Report-Based Automation: Reuse the same pattern for other predictable CSV-based operational reports.

Best Practices

1. Keep the CSV schema consistent: Avoid changing column positions without updating the Power Automate expressions.
2. Validate incoming attachments: Check the file extension and consider additional validation such as file size where appropriate.
3. Filter early: Use the email subject and attachment checks to avoid processing unrelated messages.
4. Handle empty records: Filter empty lines before attempting to split columns.
5. Test special characters: Verify quotes, commas, carriage returns, line breaks, and other characters that may appear in the export.
6. Add error handling: Consider using Power Automate Scope actions for error handling and troubleshooting.
7. Protect sensitive information: Only post the incident fields that the receiving Teams audience actually needs.
8. Test with realistic reports: Do not test only with a two-row CSV. Use representative data containing the same field structure and formatting as the real scheduled report.