Microsoft Teams will use AI to spot phishing hidden in workplace conversations

Microsoft is preparing to roll out context-aware phishing detection in Teams, initially targeting first-time chats with external contacts and warning users about suspicious behaviour.

Microsoft is set to begin rolling out AI-driven phishing detection in Teams in early November, with the company framing the move as part of a broader effort to counter increasingly sophisticated social engineering attacks in workplace chat. According to a Microsoft 365 Message Centre update, the new protection is designed to scrutinise conversation context rather than rely only on traditional warning signs such as malicious links or attachments, making it more useful against scams that try to build trust before asking for action.

The initial focus is on higher-risk exchanges, particularly first-time chats from external contacts, which Microsoft says are a common entry point for impersonation and other deceptive tactics. In practice, that means Teams can flag suspicious behaviour even when a message appears harmless on the surface. Microsoft says the feature is intended to identify phishing, social engineering, impersonation attempts and other forms of deceptive intent.

The company also says the system will not retain message content for model training or other secondary use, and that it is meant solely for security purposes rather than productivity features, summarisation or advertising. Microsoft’s support material says the capability will work across mobile, desktop and web, and that users may be warned when the system spots potentially risky behaviour in one-to-one or group chats involving new external contacts.

For administrators, the rollout should require little or no intervention. Microsoft says no action is needed to enable the feature, with the first phase expected to finish by mid-November and worldwide general availability due between early and mid-December. The change also adds to a recent string of Teams security updates, including measures to block certain external participants, blur QR codes sent by outsiders and strengthen protection against deepfakes and impersonation in meetings.

Source Reference Map

Inspired by headline at: ^[1]

Sources by paragraph:

Source: Fuse Wire Services