Beginning in early November 2026, Microsoft Teams will introduce artificial intelligence-powered phishing detection designed to spot malicious activity within messages. The company plans a staged rollout concluding by mid-November, with worldwide general availability anticipated between early and mid-December.
The capability, first detailed in a Microsoft 365 Roadmap posting last week, leverages conversation context—without preserving message content—to recognize phishing and suspicious activity in high-risk messaging situations, particularly initial contacts with external parties.
Microsoft Teams is introducing AI-powered, context-aware phishing detection to help identify phishing, social engineering, impersonation attempts, and deceptive intent
Microsoft, in a Microsoft 365 Message Center update
According to Microsoft, the system identifies questionable behavior that may lack conventional warning signs like malicious hyperlinks or attachments. The feature will activate automatically for most users focusing on external first-contact conversations, requiring no configuration from IT administrators.
Microsoft emphasized that while the detection mechanism examines conversation patterns to uncover suspicious activity, customer message data remains unretained. The company stated: "This capability is used only for security protection and not for productivity, summarization, advertising, user monitoring, or other non-security purposes. Customer message content is not retained by the detection system for model training or other secondary uses."
This phishing detection rollout represents one component of Microsoft's expanding Teams security enhancements. In December, the company announced that administrators could restrict external user access through the Defender portal beginning in January, a measure aimed at preventing cybercriminals and ransomware operators from exploiting Teams for social engineering campaigns targeting employee victims.
Additional protective measures already deployed or in development include a Teams meeting protection policy introduced in August allowing administrators to automatically block recognized external bots from joining calls. Microsoft also began obscuring QR codes transmitted by external senders to reduce fraud and phishing risks, and enabled users to flag questionable guest invitations directly within Teams to assist security teams in blocking attacks leveraging guest access.
Most recently, in early October, Microsoft announced forthcoming support for third-party deepfake detection tools and impersonation safeguards in Teams meetings.