Microsoft Teams Gets AI Phishing Detection in November

Microsoft will start rolling out AI-powered phishing and fraud detection in Teams in early November 2026, with general availability expected in the first half of December — and IT teams won't have to lift a finger to turn it on.

The feature, announced in a Microsoft 365 Message Center post, marks a shift in how Microsoft defends its collaboration platform. Instead of primarily checking for malicious links and files, the tool will analyze the conversations themselves and identify suspicious behavior in the messages. Think of it as a fraud analyst reading the room, not just a filter inspecting attachments.

The detection will focus primarily on new contacts, which Microsoft flags as a higher security risk. That's a deliberate choice: the attacks that prompted this feature typically start with a stranger showing up in a chat.

What triggered the move?

The new security feature follows earlier warnings from Microsoft about attackers impersonating help desk staff in Teams. The playbook is simple and nasty: a threat actor poses as IT support and tricks users into granting them remote access to their machines. Once inside, the attacker owns the session.

That's the enterprise intrusion pattern Microsoft now wants its AI to catch in-flight — spotting the conversational signals of an impersonation attempt before the user hands over control.

How will users see it?

Not immediately, and that's by design. Microsoft spelled out the phased approach in its Message Center post: "During initial quality validation, detection may run in the background without showing warnings to users. After validation, users may see a warning when potential phishing is detected."

So expect a quiet calibration period starting in November, followed by visible warning prompts once Microsoft is confident in the detection quality.

What about privacy?

The question any security team will ask before December: does this mean Microsoft is reading our chats? Microsoft's answer, per the announcement, is no on two counts:

• No data retention for training. No messages will be saved or used to train AI models.
• Security-only use. The tool will be used solely for security purposes — not for surveillance, and not for advertising.

What does this change for IT leaders?

Practically speaking, very little — and that's the point. The feature will be automatically enabled, with no configuration required from IT teams. Security and compliance leads should still prepare for user questions once warnings start appearing in December: staff will want to know what the alerts mean, why they're seeing them, and whether a flagged colleague is actually a threat.

The bigger picture is that Teams has become a live attack surface, and Microsoft is moving detection from the payload to the person. For CISOs, that's one more layer that arrives without a project plan — and one more reason to brief the help desk now, before attackers get a head start on the calendar.