Microsoft Teams will use AI to flag phishing in chats from new external contacts

Teams will read the context of risky chats

Microsoft told Microsoft 365 administrators on 21 October 2026 that Teams will start using AI-powered, context-aware phishing detection in chats. The notice, Message Center post MC1519866 (mirrored here), says the feature is meant to identify phishing, social engineering, impersonation attempts and deceptive intent, including in messages that contain none of the traditional warning signs such as malicious links or files.

That last part is the real change. Most chat and email filters look for things they can check against a list: a known bad link, a suspicious attachment, a sender with a poor reputation. A message that simply says it is from the IT help desk and asks you to read back a verification code has none of those. Microsoft says the new system analyses the conversation itself to spot that kind of behaviour.

The feature first appeared as Microsoft 365 Roadmap item 575288 (mirrored here) on 14 October, which described it as using conversation context to identify phishing and social engineering in higher-risk messaging scenarios, primarily external first-contact chats.

Who is covered and when

For most organisations, detection will focus on external first-contact chats, the moment when someone outside your company messages you in Teams for the first time. That is where Teams-based attacks usually start, because many organisations allow chat with outside accounts by default.

Microsoft's support page for the feature says that for worldwide users it is available on mobile, desktop and web, and that it uses conversation context in one-on-one and group chats to detect phishing-related behaviours from new external first-time contacts. Teams mobile users in China may also get extra phishing and fraud protection for conversations inside their own organisation, which Microsoft says is designed for fraud patterns seen in that region.

The rollout is staged. Targeted Release customers should get it from early November 2026, with that phase expected to finish by mid-November. General availability worldwide is planned to start in early December and to finish by mid-December. No admin configuration is needed to turn it on.

Microsoft also says that during initial quality validation, detection may run in the background without showing warnings. In other words, some organisations may have the system running for a while before users see anything, while Microsoft checks how often it gets things wrong.

What users will see

When the system flags a conversation, a warning banner appears in the chat. Microsoft's support page tells users to check the sender's identity and email address for signs of impersonation, and to look for high-risk requests such as asking for money or personal information.

If the message is phishing, Microsoft advises not engaging, and blocking and reporting the sender from their contact card. If a trusted contact is flagged by mistake, users can open the flagged message and choose Report as not a concern from the More options menu. The page also repeats basic advice not to share passwords, verification codes, financial information or other sensitive data in chat.

Those false-positive reports matter. A system that reads intent rather than links is more likely to misjudge an unusual but honest message, such as a new supplier asking for payment details. Microsoft recommends that admins remind staff how to report incorrect detections, and how to deal with unfamiliar external contacts.

Microsoft's privacy promises

Any AI that reads workplace chats raises obvious questions, and Microsoft's notice addresses them directly. It says the capability is used only for security protection, not for productivity, summarisation, advertising, user monitoring or other non-security purposes. It also says customer message content is not retained by the detection system for model training or other secondary uses.

The compliance section of the notice is candid that the change does alter how data is processed: Teams analyses conversation context to detect suspicious behaviour, and the change introduces AI capabilities that interact with customer data. Organisations in regulated sectors may want to note it in their records of processing even though no action is required.

What the notice does not say is which model performs the analysis, whether it runs in Microsoft's cloud in the same region as the tenant's data, or how much of each conversation it looks at. Admins who need those details will probably have to ask Microsoft.

Part of a wider push against Teams scams

Teams has become a common route for social engineering, and the new detection adds to a series of defences. BleepingComputer, which reported the rollout on 23 October, lists earlier moves: letting admins block external users from the Defender portal, a meeting policy that automatically blocks identified external bots, blurring QR codes sent by external senders, reporting suspicious guest invitations, and planned support for third-party deepfake detection in meetings.

Microsoft itself has been tracking attackers who use AI tools, most recently when it tied the ConnectWise supply-chain attack to China-aligned hackers using AI agents. At the same time, Microsoft is giving AI agents more access inside its own suite, with Copilot Studio agents now getting Microsoft 365 accounts, which makes it more important to tell real colleagues and approved agents apart from impostors.

The same idea is spreading across platforms

Using a model to judge the intent of a conversation, rather than just its links, is becoming standard. On Android, Google has used on-device models to warn about scam texts and calls, including Gemma-based scam detection built with Google DeepMind in Singapore. Identity firms are attacking the problem from the other side, with tools such as World ID's deepfake check for Zoom that try to prove a caller is a real person.

Microsoft's version is notable for its scale and its default setting. Teams is used by hundreds of millions of people at work, and the feature will be on without any admin choice. If it works well, it could cut off a common first step in ransomware and fraud campaigns. If it flags too many harmless messages, users will learn to ignore the banner, which would undo much of the benefit.

The first test comes in early November, when Targeted Release tenants start getting the feature. The number of complaints about false warnings, and whether Microsoft publishes any figures on what the system catches, will show whether context-aware detection lives up to its promise.