It would be helpful to get some some guidance from Microsoft as to what is the best practice here.
Using a user dependent account is a strange design choice.
Webhooks are not carried out by a user. It is usually initiated by a service. So why give the impression that the webhook is sendt by the user?
Furthermore, what happens if the user account is deactivated or deleted?
Sure, one could make a dedicated service account, but this is usually considered bad form for most IT admins these days.