In the service that receives the outgoing webhook request, what should you validate to ensure that calls are coming from Microsoft Teams?

You are developing an outgoing webhook in Microsoft Teams.

In the service that receives the outgoing webhook request, what should you validate to ensure that calls are coming from Microsoft Teams?
A . the HTTP hmac header
B . the Microsoft Teams client cookies
C . the Microsoft Graph API
D . the bearer token

Answer: A

Explanation:

A Hash-based Message Authentication Code (HMAC) is a security token used to authenticate calls between Teams and the designated outside service, such as an outgoing webhook request. The HMAC security token doesn’t expire and is unique for each configuration.

Reference: https://docs.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/add-outgoing-webhook