Teams Phishing Detection Will Use AI to Spot Suspicious Chats

Microsoft plans to introduce AI-powered Teams phishing detection in early November 2026. The feature will examine conversation context to identify potential scams, including messages without dangerous links or attachments.

Initially, Microsoft will focus on higher-risk conversations, particularly first-time chats from external contacts. The targeted release should finish by mid-November. Meanwhile, the company expects worldwide general availability between early and mid-December.

Teams Phishing Detection Looks Beyond Links and Files

Traditional warning signs do not appear in every phishing attempt. Attackers can also use convincing conversations to impersonate colleagues, pose as support staff or pressure employees into taking unsafe actions.

To address these tactics, Microsoft says the new protection will assess conversation context for signs of deception. Its targets include phishing, social engineering and impersonation attempts.

Consequently, the system could identify suspicious behaviour even when a message contains no malicious file or web address.

For most users, the feature will concentrate on initial conversations with external senders. IT administrators will not need to take action to enable the protection.

Microsoft Limits Message Analysis to Security Purposes

Although the feature examines conversations, Microsoft says the detection system will not retain customer message content for model training or secondary uses.

Furthermore, the company says the capability serves security protection exclusively. It will not support advertising, productivity features, conversation summaries or user monitoring.

These restrictions distinguish the security analysis from other AI functions that process workplace conversations.

External Chats Remain a Focus for Teams Security

The planned launch forms part of a broader effort to reduce attacks involving external contacts in Teams.

Cybercriminals, including ransomware operators, have exploited the platform to approach employees through social engineering. In some cases, attackers have posed as IT support staff to gain victims’ trust.

Microsoft previously announced controls allowing administrators to block external users through the Defender portal. Additionally, it began rolling out a meeting policy in August that lets administrators automatically block identified external bots.

Together, these measures address several ways outsiders can reach employees through the collaboration platform.

More Protections Will Target QR Codes and Impersonation

Microsoft has also outlined protections for other potential entry points.

In September, the company revealed plans to blur QR codes from external senders to reduce phishing and fraud risks. It also announced a reporting option for suspicious guest invitations directly within Teams.

That reporting feature aims to help security teams identify and block attacks involving guest access.

More recently, Microsoft announced plans to support third-party deepfake detection tools and impersonation protection in Teams meetings. However, these are separate initiatives from the context-aware phishing detection scheduled for November.