Skip to content
NewsProduct launch

Microsoft Teams adds AI phishing detection for external first-contact chats

· by Pondero Newsdesk

The short version

A Microsoft 365 message center notice confirms Teams will score the content of first-contact external chats for phishing and impersonation, not just scan links, reaching general availability in November 2026.

Microsoft Teams adds AI phishing detection for external first-contact chats

Teams has long scanned incoming links and attachments for malware; what it has not done is read the actual pitch a stranger makes in their first message. A notice in the Microsoft 365 message center describes a new detection layer that scores the conversation itself, not just what is attached to it, and the feature is set to reach general availability in November 2026, per a mirror of message center entry RM575288 per Microsoft's message center notice.

What

The message center entry, titled "Microsoft Teams: Phishing Detection in Teams Messaging," says the new system is built to "identify phishing and social engineering in higher-risk messaging scenarios, primarily external first-contact chats," using conversation context rather than link or attachment scanning alone, per Microsoft's message center notice. It rolls out across Android, Desktop, iOS, Mac, and Web, and Microsoft's own copy notes that "additional protection may apply in certain regions or scenarios." A second, independently mirrored copy of the same notice lists it as created October 15, 2026, with an internal review checkpoint dated November 1, 2026, ahead of the general-availability window, per an independent message center mirror.

Link-and-attachment scanning only catches a phishing attempt that contains a malicious URL or file. A pure social-engineering message, one that asks a target to wire money, share a password, or move the conversation to a different app, carries neither, so it has slipped past that kind of filter before. Context-aware scoring gives Teams a shot at catching that category too, specifically in the moment it is most common: a first message from someone outside the organization who has not yet built any trust with the recipient. That also widens the net beyond Teams' existing identity check, which only flags a sender whose email domain does not match the brand they claim to represent. Unlike that 2025 identity check, which shipped on by default for every commercial customer with no toggle to configure, Microsoft's message center notice does not say whether the new context-aware layer will be on by default or whether admins get an opt-out. Teams admins planning rollout communications should confirm that detail in the admin center once the feature appears rather than assume it matches the earlier default.

Context and reactions

Teams already had a narrower version of this idea. In February 2025, Microsoft turned on brand impersonation protection by default for all commercial customers, comparing a sender's domain against the brand name they used in a first-contact chat and showing a high-risk warning on a mismatch, per Petri's reporting on the rollout. That check works on sender identity; the new system reads message content instead, a separate detection layer from the 2025 check.

What to watch next

Message center entry RM575288 itself is the signal to watch: it lists an internal review checkpoint for November 1, 2026, ahead of the stated general-availability month, so a status change from "in development" to "launched" in the admin center that first week of November confirms the rollout hit its target.

Sources