Microsoft schedules context-aware phishing detection for Teams

Microsoft says the capability is intended to identify phishing, social engineering, impersonation attempts and deceptive intent in Teams conversations.[1] Rather than relying only on familiar warning signs, the system analyzes conversation context to look for suspicious behavior.[1] Microsoft says it may identify that behavior even when a message contains no traditional indicators such as malicious links or files.[1]

Microsoft schedules the targeted release to begin in early November 2026 and finish by mid-November.[1] Worldwide general availability is scheduled to begin in early December and finish by mid-December 2026.[1] The feature will focus on external first-contact chats for most users.[1] Microsoft also says Teams mobile users in China may receive additional phishing and fraud protection for conversations within their tenant.[1] The platform list cited for the feature includes Android, desktop, iOS, Mac and web.[1] BleepingComputer reports that Microsoft first revealed the capability in a Microsoft 365 Roadmap entry the previous week.[2]

Microsoft says Teams will not retain customer message content for model training or other secondary uses.[1] The company describes the capability as security protection, not a tool for productivity, summarization, advertising, user monitoring or other non-security purposes.[1] Microsoft also says the feature analyzes context without retaining message content.[2] During initial quality validation, detection may run in the background without displaying warnings to users.[1] After validation, users may see a warning when the system detects potential phishing.[1]

Microsoft says administrators do not need to take action to enable the protection.[1] It recommends that administrators review guidance for interacting with unfamiliar external contacts.[1] Microsoft also recommends reminding users to report suspicious activity and incorrect detections through Teams reporting experiences.[1] Those steps can help teams prepare for warnings and provide feedback as the feature is introduced. The distinction between background validation and later user-facing warnings is worth communicating so that users understand that the absence of an alert during validation does not mean the detection is not running.[1]