Microsoft Teams adds AI phishing detection for external chats
Microsoft Teams will begin using AI-powered phishing detection in early November 2026, according to BleepingComputer, which reported the rollout on October 23, 2026. The feature looks at conversation context to spot malicious behaviour in messages, and Microsoft says admins do not need to enable it.
What we know
- Microsoft first listed the capability in a Microsoft 365 Roadmap entry the week before, then confirmed it in a Message Center update on Wednesday, as reported by BleepingComputer.
- The rollout starts in a targeted release phase in early November 2026, which is expected to end by mid-November.
- General availability worldwide is likely between early and mid-December, according to the report.
- Microsoft describes the feature as identifying phishing, social engineering, impersonation attempts and deceptive intent.
- It is meant to catch suspicious behaviour that may not include traditional indicators such as malicious links or files.
The detection uses conversation context, without retaining message content, in higher-risk scenarios. For most users the focus will be external first-contact chats, where someone outside the organisation messages a user for the first time.
Who is affected
Teams tenants will receive the capability without admin action, so security teams should expect it to appear in their environment during the targeted release and general availability phases. Microsoft has not said in the sources we reviewed which licences or plans are included, so check the Message Center post for your tenant.
Microsoft states the capability is used only for security protection, not for productivity, summarisation, advertising or user monitoring. It also says customer message content is not retained by the detection system for model training or other secondary uses. Those are vendor statements and have not been independently verified.
Why this matters
Analysis, not new reporting. Attackers increasingly use chat platforms for social engineering, because a message from an outside account can look like routine collaboration and often carries no link or file for email-style filters to inspect. BleepingComputer notes that Microsoft has been adding Teams protections against this, including the option to lock external users via the Defender portal, automatic blocking of identified external bots in meetings, QR code blurring for external senders and reporting of suspicious guest invitations.
A detector that reads intent rather than indicators could help against pretexting, such as a fake help desk contact. How accurate it is, how often it flags legitimate chats and what users will see when a message is flagged have not been disclosed. Treat it as an extra layer, not a replacement for controls on external access.
What has not been confirmed
- Detection accuracy and false positive rates are not disclosed.
- The exact user experience for flagged messages is not described in the source.
- Whether the feature extends beyond external first-contact chats for all users is not stated.
What to do
- Read the Microsoft 365 Message Center post and the Roadmap entry for your tenant, and note the early November targeted release window.
- Brief the help desk and SOC so they recognise flagged messages and know where users should report suspicious chats.
- Review external access settings, including whether external users can start chats with your staff, and use the Defender portal controls to lock external users where policy allows.
- Remind staff that a first-contact message asking for credentials, MFA codes, payments or remote access is suspicious even if no link is attached.
- During rollout, watch for false positives from legitimate partners and collect examples to feed back to Microsoft.
