Microsoft is preparing to roll out an AI-powered security feature for Microsoft Teams that can detect phishing attempts, social engineering, and impersonation attacks by analyzing the context of conversations.
The new feature is expected to begin rolling out in early November 2026, with the initial targeted release scheduled to conclude by mid-November. Worldwide general availability is anticipated between early and mid-December.
According to Microsoft's Microsoft 365 Roadmap, the feature will use artificial intelligence to identify suspicious behavior in conversations, particularly in higher-risk situations such as chats with external users contacting someone for the first time.
AI to Detect Threats Beyond Malicious Links
The company described the feature in a Microsoft 365 Message Center update, explaining that it is designed to identify phishing, social engineering, impersonation attempts, and deceptive intent.
This could help organizations detect attacks in which cybercriminals pretend to be trusted contacts, IT support staff, or business partners to trick employees into revealing sensitive information or taking unsafe actions.
No Manual Setup Required for IT Administrators
Microsoft says IT administrators will not need to take any action to enable the new protection. For most users, the feature will focus on external chats where someone is contacting them for the first time.
The company has also clarified its data-handling approach. Although the detection system will analyze conversation context for security purposes, Microsoft says customer message content will not be retained for AI model training or secondary uses.
Microsoft emphasized that the capability is intended exclusively for security protection, not for productivity features, message summarization, advertising, or general user monitoring.
Part of Microsoft's Broader Teams Security Push
The new phishing detection feature is part of Microsoft's wider effort to strengthen security across Teams and reduce the risk of attacks targeting employees.
Other recent and planned security improvements include:
- Blocking external users: Microsoft has introduced plans and capabilities to help administrators restrict external users through the Defender portal, reducing opportunities for cybercriminals to exploit Teams chats.
- Blocking external meeting bots: A meeting protection policy allows administrators to automatically block identified external bots from joining Teams meetings.
- Blurring external QR codes: Microsoft has announced plans to blur QR codes sent by external users to help prevent phishing and fraud.
- Reporting suspicious guest invitations: Users will be able to report potentially malicious guest invitations directly within Teams.
- Deepfake and impersonation protection: Microsoft has also announced plans to support third-party deepfake detection solutions and additional impersonation protection for Teams meetings.
These measures address different ways attackers can exploit collaboration platforms to target employees.
What This Means for Businesses
The upcoming feature highlights an important shift in cybersecurity: detecting threats based not only on suspicious links or files, but also on the intent and context behind a conversation.
For businesses, this could provide an additional layer of protection against sophisticated social engineering attacks. However, AI-powered detection should complement or replace employee security awareness training, strong identity controls, and clear procedures for verifying unusual requests.
As collaboration platforms become increasingly important to daily business operations, context-aware security tools may play a growing role in helping organizations identify threats before employees fall victim to them.