Phishing attacks are no longer confined to just emails cyber criminals are sneaking onto the collaboration tools that businesses use all the time, including Microsoft Teams.
Microsoft is addressing this threat with new AI-powered phishing detection in Teams, which picks up on suspicious conversations, impersonation attempts and the social-engineering tactics that traditional security software often misses.
Microsoft reportedly plans to start rolling out the feature in November with a broader rollout in December, according to a report by BleepingComputer.
But here’s the thing for businesses using Microsoft 365 this is more than just welcome news, it also highlights a major cybersecurity worry: your employees can be targeted by phishing attempts wherever they communicate, not just in their email inboxes.
How Microsoft’s New AI Phishing Detection Works
Phishing detection typically looks for red flags like malicious links, suspicious attachments and domains.
But cyber criminals often rely on conversation, impersonation and psychological manipulation to trick employees into revealing sensitive info or carrying out actions that put business security at risk.
Microsoft’s new technology is designed to spot these more subtle threats by looking at the context of Teams conversations.
The tech will help identify:
- Impersonation attempts: People pretending to be executives, coworkers, IT people or trusted business contacts.
- Social engineering: Convincing employees to share info or take actions via conversation even if there’s no malicious link.
- Suspicious requests: Messages that look a bit odd but don’t have any obvious bad links or attachments.
- Higher-risk external conversations: Initial chats with external contacts who may not be known to the employee.
Microsoft says the feature will first focus on the higher-risk scenarios, like first contact with external users.
The company also points out that message content analysed by the detection system won’t be kept for training the AI or any other purposes.
When Will Microsoft Teams Phishing Detection Be Available?
Microsoft says the new feature will roll out in the following stages:
- Early November 2026: It will begin rolling out to some businesses.
- Mid-November 2026: It should be complete with the targeted rollout.
- Early to mid-December 2026: It should be available worldwide.
Don’t worryIT admins won’t have to do anything to enable the feature.
However, businesses should still do a review of their Microsoft Teams security settings and their procedures for security awareness training for employees.
Note: This feature is meant to provide an extra layer of protection, not guarantee that no phishing or social engineering attacks will happen.
Why Cyber Criminals Are Targeting Microsoft Teams
Microsoft Teams is widely used for internal comms, file sharing, video meetings and collaborating with external orgs.
That makes it a pretty attractive target.
You might be cautious about opening a weird email but you might be less suspicious of a message in a platform you use for work.
Think about this:
You get a Teams message from someone claiming to be from IT and telling you there’s a problem with your account so you need to verify your login details.
Or you get a message from what looks like a company exec asking for an urgent payment or confidential document.
Or you get a message from some person you don’t know who claims to represent a company you’ve heard of and starts building credibility before asking you for sensitive info.
These examples show how attackers can use trust and urgency without sending anything odd.
And that’s why the new context-aware phishing detection is a big deal.
Microsoft Keeps Bolstering Teams Security
The new phishing detection tech is part of a bigger effort from Microsoft to keep its collaboration platform safe.
The company has also announced or introduced other Teams security features such as:
- Controls that allow you to block certain external users.
- Policies that stop external bots from joining meetings.
- Protection involving QR codes from external senders.
- Options for reporting suspicious guest invitations.
- Plans for third-party deepfake detection and impersonation protection in meetings.
All of these developments show that Microsoft recognizes collaboration platforms need special security protections.
Businesses should also get on board that security features work best when they are set up and supported by clear internal policies.
7 Ways Businesses Can Protect Employees From Teams Phishing Attacks
Microsoft’s new detection feature is a big help, but it shouldn’t be relied on as the only security measure. Here are seven steps your business can take now:
1. Review Your External Access Permissions
Microsoft Teams lets you communicate with people outside your company and that’s useful but also a risk.
Make sure you understand who can contact your employees and what restrictions are in place.
2. Train Employees to Spot Social Engineering
Phishing can happen through Teams, texts, social media and loads of other communication platforms.
Training on suspicious requests, impersonation attempts, weird login prompts and requests for sensitive info is a must.
3. Make IT Admins Your Allies
Your IT team can help to set up the right security settings, alert systems and real-time reporting tools to help employees avoid phishing.
Collaborate with them to stay ahead of the threats.
4. Use Multi-Authentication
Two-factor authentication can make it much harder for attackers to break in.
But businesses need to educate their employees on why multi-factor authentication is necessary.
5. Monitor Teams Activity
Set up tools that can monitor Teams activity for suspicious behaviour like unusual activity from external users.
6. Always Keep Your Microsoft Teams Software Up-to-Date
Keep your Microsoft Teams software up to date to ensure you have the latest security patches this will help keep your business safe from the bad guys.
7. Have a Clear Incident Reporting Process in Place
Your employees need to know what to do if they get a suspicious message.
Encourage them to report it straight away, rather than responding or just clicking links they shouldn’t be trying to investigate on their own either.
This will make it a lot easier for your IT teams to track down threats and take the right action.
Why Just Using AI-Powered Security Isn’t Enough
AI is obviously getting better at helping with cybersecurity but it’s no silver bullet.
It can help spot unusual patterns, catch suspicious behaviour and trawl through a lot more info than humans can in the same time.
But the bad guys are keeping up and adapting their tactics as well.
That means your AI security tools might flag up loads of false positives, miss out on new techniques that haven’t been seen before or just fail to spot an attack that’s a bit different.
So you need a layered approach to security that brings together all sorts of things: technology, monitoring, access controls, training employees and a good incident response plan.
For businesses using Microsoft 365, that means understanding exactly which security tools are available, how they’re set up and whether they’re actually protecting the level of risk you have.
How Enitech Helps Businesses Get Their Microsoft 365 Security Right
At Enitech we’re all about helping businesses be proactive with their cybersecurity and IT management.
We work with our clients to identify where their security is weak, get a better understanding of what’s going on inside their tech environment and then put in the right protections to suit them.
Some of the services we offer include:
- Managing Microsoft 365: we help businesses get their Microsoft 365 setup and security in order.
- Managed Cybersecurity Services: we provide layered security solutions to help spot and deal with potential threats.
- Managed IT Services: we proactively monitor and maintain your IT systems to make sure they’re running smoothly.
- Security Assessments: we check for any vulnerabilities and look for ways to strengthen your security.
- Business Continuity and Disaster Recovery: we help businesses prepare for and recover from any tech disasters.
As collaboration tools get more and more sophisticated it’s now more than ever that businesses need an IT partner who knows the benefits and risks involved.
Protect Your Business Beyond Just the Inbox
Microsoft is working on AI-powered phishing detection for Teams which is a good thing.
But the lesson is that the bad guys will just keep looking for ways to get in wherever employees are communicating and sharing info.
Protecting your business means a lot more than just spotting suspicious emails. You need to have visibility across your whole tech environment, your security needs to be properly configured and your employees need to know what constitutes a threat.
Is your Microsoft 365 setup as secure as it could be?
At Enitech we help businesses in Raleigh, Charlotte and all over the US to strengthen their cybersecurity and get their IT in order with confidence.
Get in touch with us today to book a cybersecurity consultation.
