Microsoft Teams to get AI-powered, context-aware phishing detection

Microsoft says Teams will begin using AI-powered phishing detection in early November 2026 to detect malicious behavior in messages.

The rollout is part of a targeted release phase expected to end by mid-November, with the new security feature likely reaching general availability worldwide between early and mid-December.

Microsoft first revealed in a Microsoft 365 Roadmap entry last week that the AI-powered phishing detection will use conversation context (without retaining message content) to identify phishing and suspicious behavior in higher-risk messaging scenarios, such as external first-contact chats.

"Microsoft Teams is introducing AI-powered, context-aware phishing detection to help identify phishing, social engineering, impersonation attempts, and deceptive intent," the company said in a Microsoft 365 Message Center update on Wednesday.

"The capability analyzes conversation context to identify suspicious behavior that may not include traditional indicators such as malicious links or files."

Microsoft says IT admins won't need to take any action to enable this new security protection feature, which will focus on external first-contact chats for most users.

​It also added that while the new Teams feature will analyze conversation context to discover suspicious behavior, it will not retain customer data for further AI training or other uses.

"This capability is used only for security protection and not for productivity, summarization, advertising, user monitoring, or other non-security purposes," Microsoft said. "Customer message content is not retained by the detection system for model training or other secondary uses."

This is part of a broader list of Teams security changes, with Microsoft announcing in December that admins could lock external users via the Defender portal starting in January to thwart cybercrime groups (including ransomware gangs) from abusing Teams in social engineering attacks that target victims' employees.

It also began rolling out a new Teams meeting protection policy in August that lets admins block all identified external bots automatically from joining meetings.

Last month, Microsoft also revealed that Teams will blur QR codes sent by external senders to better protect against fraud and phishing attempts, and that it will let users report suspicious guest invitations directly in Teams to help security teams block phishing attempts and other attacks abusing guest invitations.

More recently, in early October, the company announced plans to introduce support for third-party deepfake detection solutions and impersonation protection in Teams meetings.

Once attackers have valid credentials, only 37% of their actions are blocked

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report