Overview
Microsoft will add AI-powered phishing detection to Teams messages beginning in early November 2026. The feature reads the context of a conversation to spot phishing, social engineering, impersonation, and deceptive intent.
Rollout Timeline
| Phase | Timing |
|---|---|
| Targeted release begins | Early November 2026 |
| Targeted release ends | Mid-November 2026 |
| Worldwide general availability | Early to mid-December 2026 |
How It Works
- Analyses conversation context rather than relying only on malicious links or attachments, which suits attacks that carry no traditional indicators.
- Focuses on higher-risk situations such as first-contact chats from external users.
- Microsoft says message content is not retained by the detection system for model training or other secondary uses, and that the feature is limited to security purposes.
Admin Impact
No admin action is needed to enable it, and the announcement describes no setting to control it. Microsoft announced related Teams protections separately:
- Admins can block external users from the Defender portal, starting in January.
- A meeting protection policy, rolled out in August, can block identified external bots.
- QR codes from external senders will be blurred, and users will be able to report suspicious guest invitations.
- Third-party deepfake detection in meetings is planned.
Why It Matters
Attackers increasingly use Teams chat, often impersonating IT support from an external tenant, to deliver malware. Detecting intent in text fills a gap that URL and file scanning cannot.
Recommendations
- Brief help desk and staff that new warnings may appear on external first-contact chats.
- Review external access settings and restrict federation to trusted domains.
- Keep user reporting for suspicious Teams messages in your phishing training.