Microsoft is adding AI-powered, context-aware phishing detection to Teams. The goal is to catch threats that traditional security filters often miss—especially attacks that rely on manipulation and trust rather than malicious links or attachments.
What the feature does
The new detection analyzes the context of a conversation to identify phishing, social engineering, impersonation, and deceptive intent. Instead of only checking URLs and files, it looks at conversational patterns. That means it can flag attacks even when no obvious malicious content is present.
Microsoft says the protection is aimed at scenarios such as link-free phishing, impersonation of colleagues or executives, and social engineering attempts that push users toward unsafe actions.
Who gets protected first
The initial focus is on higher-risk scenarios, particularly external first-contact chats—messages from people outside the organization. These conversations are a common entry point for attackers who try to build trust before launching a broader attack.
Rollout timeline
The feature is expected to begin rolling out in early November 2026 as part of a targeted release phase, planned to finish by mid-November. Worldwide general availability is expected in early to mid-December 2026.
No admin setup required
IT administrators will not need to enable or configure the protection. It will activate automatically for eligible users.
Privacy safeguards
Microsoft says the detection system is used only for security purposes. Customer message content is not retained for AI model training, advertising, user monitoring, or other secondary use. Analysis happens in real time to assess risk without storing conversation data.
Part of a wider Teams security push
The phishing detection feature is one of several security improvements Microsoft has been adding to Teams. Other recent and upcoming changes include blocking external users through the Defender portal, automatically blocking external meeting bots, blurring QR codes from external senders, and support for third-party deepfake detection in meetings.
For organizations that use Teams as a central communication hub, context-aware phishing detection adds a proactive layer against attacks that exploit human trust rather than technical vulnerabilities.