Microsoft is preparing to add AI phishing detection to Microsoft Teams, using conversation context to spot scams that may contain no harmful links or attachments. The feature will focus mainly on first conversations with external contacts, where attackers can pose as trusted support staff and ask employees to share sensitive information.

Microsoft detailed the change in Message Center notice MC1519866, published on October 21, 2026. Targeted Release is scheduled to begin in early November and finish by mid-November. Worldwide general availability is expected to start in early December and finish by mid-December, rather than reaching every customer in November.

How Conversation Context Helps Detect Phishing

Traditional warning signs, such as suspicious links and infected files, are not always present in social engineering attacks. A message can instead build trust, claim an urgent account problem, and persuade someone to disclose a password or approve remote access.

Microsoft says the new capability will analyze conversation context to identify phishing, impersonation, social engineering, and deceptive intent. Its support guidance describes coverage for individual and group chats involving new external contacts across mobile, desktop, and web. Roadmap entry 575288 lists Android, iOS, Mac, desktop, and web support for the worldwide standard cloud.

The warning example accompanying the announcement shows an external account called “MOD Administrator” discussing permission problems before asking, “Can you share your credential first?” Teams displays a notice saying the message could be a phishing attempt. The example illustrates why the meaning of a conversation can matter even without a dangerous URL.

This addresses a familiar attack pattern. Cybersecurity News previously reported on attackers impersonating IT help desk staff through Teams, using convincing support requests to push users toward malware or remote access. Separate reporting described fake support operators abusing Quick Assist after contacting employees through external Teams accounts.

Microsoft says detection may initially run silently while it checks quality. Visible warnings may appear after that validation, so users should not expect every suspicious message to trigger an immediate banner during the rollout.

For most users, protection centers on external first-contact chats. Teams mobile users in China may also receive protection for conversations within their own organization, reflecting fraud patterns seen in that region. This is a specific extension, not a promise of universal internal chat scanning.

Microsoft states that the capability serves security purposes only. It is not intended for advertising, employee monitoring, productivity analysis, or conversation summaries. Customer message content is not retained by the detection system for model training or other secondary uses. That statement should not be read as a change to all existing Teams retention policies.

What Organizations Should Do

No new administrator configuration is required to enable the protection. However, Microsoft recommends reviewing guidance for unfamiliar external contacts and encouraging users to report suspicious activity or incorrect detections.

When a warning appears, employees should check the sender’s identity and email address through a trusted channel. Microsoft advises blocking and reporting confirmed phishing, while mistaken warnings can be reported as not a concern. Users should never share passwords, verification codes, financial details, or sensitive information through an unexpected support conversation.

The update adds another warning layer, but staff still need to independently verify unexpected support requests and report suspicious contacts, rather than treating the absence of a banner as proof of safety.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Microsoft Teams to Use AI for Detecting Phishing Attacks Using Teams Conversations appeared first on Cyber Security News.