Microsoft Teams to add AI-powered phishing detection for external chats

Microsoft's Wednesday Microsoft 365 Message Center update states that Teams will start using AI-powered phishing detection in early November 2026 to flag malicious behavior in messages. A Microsoft 365 Message Center post said the feature is designed to catch phishing, social engineering, impersonation, and deceptive intent.

The rollout starts as a targeted release that is scheduled to finish by mid-November. BleepingComputer expects the feature to become generally available worldwide from early to mid-December. The company first disclosed the capability in a Microsoft 365 Roadmap listing last week.

The system will examine conversation context in higher-risk messaging situations, particularly external first-contact chats, and will not retain message content. Microsoft said it can identify suspicious behavior even when messages lack clear warning signs such as malicious links or attachments. Customer message content is not kept for model training or other secondary uses, and the capability is used only for security protection, not for tasks such as productivity, summarization, advertising, user monitoring, or other non-security work. IT administrators do not need to enable anything.

The Teams update follows several other security changes. In December, Microsoft announced that administrators would be able to block external users through the Defender portal starting in January to counter abuse by cybercrime groups, including ransomware gangs that use Teams for social engineering. In August, Microsoft began rolling out a Teams meeting protection policy that lets administrators automatically block all identified external bots. Microsoft also said Teams would blur QR codes from external senders and allow users to report suspicious guest invitations directly in Teams. Plans to support third-party deepfake detection and impersonation protection in Teams meetings were announced in early October.