Microsoft Teams to Introduce AI-Driven Phishing Detection in November 2026

Microsoft has announced that Teams will begin utilizing AI-powered phishing detection in early November 2026 to identify malicious behavior in messages.

This rollout is part of a targeted release phase expected to conclude by mid-November, with the new security feature anticipated to reach general availability worldwide between early and mid-December.

According to a recent entry in the Microsoft 365 Roadmap, the AI-powered phishing detection will leverage conversation context—without retaining message content—to detect phishing and suspicious behavior in higher-risk messaging scenarios, particularly in external first-contact chats.

“Microsoft Teams is introducing AI-powered, context-aware phishing detection to help identify phishing, social engineering, impersonation attempts, and deceptive intent,” the company stated in a Microsoft 365 Message Center update.

The capability will analyze conversation context to identify suspicious behavior that may not involve traditional indicators such as malicious links or files.

Microsoft noted that IT administrators will not need to take any action to enable this new security feature, which primarily focuses on external first-contact chats for most users.

Furthermore, while the Teams feature will analyze conversation context to detect suspicious behavior, Microsoft emphasized that it will not retain customer data for further AI training or other purposes.

“This capability is used only for security protection and not for productivity, summarization, advertising, user monitoring, or other non-security purposes,” the company explained. “Customer message content is not retained by the detection system for model training or other secondary uses.”

This initiative is part of a broader effort to enhance security for Teams users. In December, Microsoft announced that administrators could block external users via the Defender portal starting in January to prevent cybercrime groups from exploiting Teams in social engineering attacks.

Additionally, Microsoft began rolling out a new Teams meeting protection policy in August, allowing administrators to automatically block all identified external bots from joining meetings.

Last month, the company revealed that Teams would blur QR codes sent by external senders to better protect against fraud and phishing attempts. It also introduced a feature allowing users to report suspicious guest invitations directly in Teams to assist security teams in blocking phishing attempts and other attacks.

More recently, in early October, Microsoft announced plans to support third-party deepfake detection solutions and impersonation protection in Teams meetings.

Source: BleepingComputer