Microsoft says the team will begin using AI-powered phishing detection as early as November 2026 to detect malicious behavior in messages.
The rollout is part of a scheduled rollout phase expected to end in mid-November, with new security features likely to reach general availability worldwide between early and mid-December.
Microsoft first revealed in A Microsoft 365 Roadmap entry Last week, AI-powered phishing detection will use conversation context (without preserving the message content) to identify scams and suspicious behavior in high-risk messaging situations, such as external communications.
“Microsoft Teams is introducing AI-powered phishing detection, with contextual understanding to help identify phishing, social engineering, impersonation attempts, and fraudulent intent,” the company said. said In the Microsoft 365 Message Center update on Wednesday.
“The ability to analyze conversational context to identify suspicious behavior that may not include traditional indicators such as malicious links or files.”
Microsoft says that IT administrators will not need to take any action to enable this new security protection feature, which will focus on external first contact conversations for most users.
It also added that while the team’s new feature will analyze conversational context to discover suspicious behavior, it will not store customer data for further AI training or other uses.
“This capability is used only for security protection and not for production, summary, advertising, user tracking, or other non-security purposes,” Microsoft said. “Customer text content is not stored by the search engine for model training or other secondary uses.”
This is part of a broader list of security changes to Teams, with Microsoft announcing in December that administrators can lock out external users through the Defender portal starting in January to prevent cybercriminal groups (including ransomware gangs) from harassing Teams in social engineering attacks that target the victim’s employees.
It also began rolling out a new Team Meeting Protection policy in August that allows administrators to automatically block all specified external bots from joining meetings.
Last month, Microsoft also revealed that the team will blur QR codes sent by external senders To better prevent fraud and phishing attempts, and that It will prompt users to report suspicious guest invitations Directly in Teams to help security teams prevent phishing attempts and other attacks that abuse guest invitations.
More recently, in early October, the company announced plans to introduce support for third-party detection solutions and impersonation protection in team meetings.
Overall defense scores can hide what happens after initial access. When attackers are using valid credentials, defenses are greatly reduced.
The Blue Report 2026 measures defense technique by technique across 338 million simulations run in customer production environments.
