Microsoft Teams Adds AI Phishing Checks for External Chats

Microsoft Teams will begin checking some conversations for signs of phishing, impersonation and other deceptive behavior. The feature matters to families and small offices because it may flag suspicious messages even when they contain no obviously dangerous link or attachment.

What happened

Microsoft plans to start a targeted rollout of AI-powered phishing detection in early November 2026, according to BleepingComputer. That initial rollout is expected to finish around the middle of November, followed by worldwide general availability between early and mid-December.

The system will examine the context of a conversation to identify behavior associated with phishing, social engineering and impersonation. Microsoft says this could reveal deceptive intent in messages that do not have the traditional warning signs, such as a malicious file or URL.

Microsoft also says the detection system will not keep customer message content for AI training or other secondary purposes. The company says the feature is intended only for security—not advertising, employee monitoring, productivity tools or conversation summaries.

The change follows other Teams protections described by BleepingComputer. Microsoft has started blurring QR codes from external senders, added a way to report suspicious guest invitations, and introduced an administrative option for blocking identified outside bots from meetings. The company has also announced support for third-party deepfake and impersonation detection during meetings.

Who is affected

The new protection is intended for Microsoft Teams users worldwide. It will focus mainly on higher-risk situations involving an outside person making first contact, according to the report. That could include an unfamiliar account approaching a household member, freelancer or employee at a small business.

Microsoft says administrators will not have to switch on the phishing detector manually. However, the source does not disclose whether every Teams edition, subscription or account type will receive it at exactly the same time.

The feature is a warning layer, not proof that every unflagged conversation is safe. BleepingComputer reports that cybercrime groups, including ransomware operators, have abused Teams for social-engineering attacks against employees.

What to do now

1. Install Teams updates. Open the Teams desktop or mobile app and apply an available update before the broader rollout begins. If an organization manages the device, ask its administrator whether updates are installed automatically.

2. Treat unexpected first-contact chats cautiously. Be especially careful when an external sender suddenly asks you to act, share information or continue a conversation elsewhere. The new detector is specifically aimed at these higher-risk exchanges.

3. Use Teams’ reporting option for suspicious guest invitations. If that option appears with an invitation you do not recognize, report it instead of accepting it. Microsoft introduced this function to help security teams respond to invitation-based phishing.

4. Do not assume a message is safe because it has no link or attachment. Microsoft says social engineering can depend on the conversation itself. Pause when a stranger uses urgency, impersonation or other pressure to influence your next action.

5. Be wary of QR codes from outside senders. Teams may blur them as a protective measure. Do not scan a code merely because it arrived through a work or family chat.

6. Tell your office administrator about suspicious external accounts. Microsoft has announced controls that let administrators block outside users through the Defender portal. Whether those controls are available depends on the organization’s setup and has not been disclosed in the source.