What’s new: AI-powered phishing detection in Teams chat
Microsoft has added AI-powered, context-aware phishing detection to Microsoft Teams chat. According to Microsoft Support documentation, Teams now analyzes conversation context in one-on-one and group chats to identify phishing-related behavior, and it displays a warning banner to help users make a more informed decision before continuing a conversation.
For SMB administrators, this matters because phishing and impersonation attempts delivered through chat tools are increasingly common, and most organizations rely heavily on end-user judgment to catch them. A built-in detection layer inside Teams adds another signal for users, without requiring admins to deploy a separate tool.
It’s worth noting upfront what the supplied Microsoft sources do not confirm: there is no Message Center notice ID or date included in the approved source material for this feature, and Microsoft has not published licensing requirements or an explicit admin on/off toggle for this specific chat phishing detection capability in the sources reviewed. Where documentation is silent, this article says so explicitly rather than guessing.
How the detection works, according to Microsoft
Based on the Microsoft Support article “Phishing content detection in Microsoft Teams,” here’s what is documented:
- Teams uses conversation context in one-on-one chats and group chats to detect phishing-related behavior.
- The detection specifically targets new external first-time contacts — meaning people outside your organization that a user hasn’t previously communicated with in Teams.
- When phishing-related behavior is detected, Teams shows a warning banner in the chat to help the user decide whether to continue the conversation.
What the warning asks users to do
Microsoft’s guidance for end users who see the warning includes:
- Review the sender’s identity and email address for signs of impersonation.
- Watch for high-risk requests, such as asking for money or personal information.
- If phishing is confirmed, don’t engage — block and report the user from their contact card.
- If the warning was triggered incorrectly for a trusted contact, use More options > Report as not a concern on the flagged message.
Microsoft also advises users never to share passwords, verification codes, financial information, or other sensitive data in chat, regardless of whether a warning appears.
Platform availability
According to Microsoft, this detection is available on mobile, desktop, and web for worldwide users. The source material does not break availability down further by specific Teams client versions, tenant type, or Microsoft 365 plan, so administrators should not assume uniform rollout timing across every environment without checking current in-product behavior.
Additional protections for mobile users in China
Microsoft Support notes that mobile users in China may receive additional phishing and fraud protection that can apply to both external and in-tenant conversations, described as being designed to address region-specific fraud patterns. This expanded scope is distinct from the worldwide external-contact detection described above, and the source does not indicate this broader in-tenant coverage applies outside of China.
What the detection is not used for
Microsoft explicitly states that phishing content detection in Teams chat is not used for:
- Training AI models
- Conversation summarization
- Productivity insights
- User monitoring
- Advertising
- Other non-security purposes
For administrators evaluating data governance or privacy questions, this is a useful documented boundary: the feature is scoped to security detection and is not described as feeding other Microsoft 365 features or analytics products.
Related impersonation protections in Teams calling and meetings
The chat phishing detection feature sits alongside several other impersonation-related protections that Microsoft has documented separately. These are related but distinct capabilities, and SMB admins should not conflate them.
Call impersonation warnings (“Scam suspected”)
Microsoft Support describes a feature where Teams displays a “Scam suspected” warning during incoming calls from outside the organization when a potential impersonation attempt is detected. If a user has already answered the call, Teams may display a message recommending they leave the call unless they’re certain of the caller’s identity.
Users can report suspicious calls through Calls > History > More > Report call, but Microsoft’s documentation notes this reporting option is available only “if available in your organization,” meaning tenant-level availability may vary and is not guaranteed in every environment.
Meeting and brand impersonation signals
A June 2026 Microsoft Teams blog post describes additional impersonation-related capabilities rolling out around the same period, including:
- Brand impersonation protection for calls — an in-call signal warning users when a caller may be posing as a trusted brand, such an IT help desk or bank.
- Meeting impersonation detection and high-risk alerts extended to Teams on iOS and Android, surfacing contextual alerts when elevated risk is detected during meetings.
- A Security Detection Report in the Teams admin center, which consolidates impersonation, malicious URL, and weaponizable file detection data across Teams messaging, and which admins can export as a CSV including sender identifier and thread ID for investigation.
- A separate bot detection admin policy for meetings, allowing admins to route suspected bots to a lobby group requiring organizer approval before joining — this is a meeting-bot control, not a phishing-chat control.
These features are described in a Microsoft Teams blog post rather than Microsoft Learn product documentation, and the blog does not provide Message Center IDs, licensing tables, or step-by-step admin configuration instructions for each item. Where the blog uses terms like “public preview,” that status is noted in the source but should be verified in your own tenant’s admin center, since preview features can be scoped narrowly.
What’s unclear or undocumented in the supplied sources
To keep this article conservative and accurate, it’s important to flag several open questions that the supplied Microsoft sources do not answer:
- Message Center notice: No Message Center ID or publication date is included in the approved source material for the chat phishing detection feature specifically.
- Licensing requirements: None of the supplied sources state which Microsoft 365 or Teams license tier is required for AI-powered phishing content detection in chat.
- Admin scoping or disabling: The supplied Microsoft Support article does not describe an admin control to configure, scope, or disable the chat phishing detection feature. The Security Detection Report (from the June 2026 blog) is a reporting and investigation tool for admins, not a described on/off switch for the underlying detection.
- Rollout timeline: The Support article’s “Microsoft date” indicates recent documentation, but no phased rollout schedule (by ring, region, or tenant type) is included in the supplied sources.
Administrators should treat these as open items to verify directly in the Microsoft 365 admin center or current Microsoft Learn documentation before making governance decisions, rather than assuming a specific answer.
Practical recommendations for SMB admins
The following are practical suggestions, not documented Microsoft requirements:
- Communicate the warning banner to staff so they recognize it and know Microsoft’s suggested response (verify sender, don’t share sensitive data, report if confirmed, mark as “not a concern” if a trusted contact was flagged incorrectly).
- Check your Teams admin center for the Security Detection Report and any related impersonation or bot-detection policies described in the June 2026 update, since availability and configuration options can differ by tenant and licensing.
- Avoid assuming this feature replaces existing phishing training or email security controls. It is scoped to Teams chat behavior with new external contacts and does not appear, from the supplied sources, to extend to all conversation types or all regions equally.
- Monitor Microsoft Learn and the Microsoft 365 admin Message Center directly for a formal rollout notice, since the supplied source material does not include one for this specific capability.
Conclusion
Microsoft Teams now includes AI-powered phishing content detection for chats with new external contacts, backed by a documented warning banner and clear guidance for users on how to respond. Related impersonation protections for calls and meetings, along with a consolidated Security Detection Report for admins, appear to be rolling out around the same period based on Microsoft’s June 2026 Teams update.
However, based strictly on the supplied official sources, several practical details that SMB admins typically need — a Message Center notice, specific licensing requirements, and explicit admin controls to scope or disable the chat detection feature — are not yet documented. Treat this feature as a useful additional signal for users rather than a fully configurable admin-managed control until Microsoft Learn or the Message Center publishes more complete guidance. As always, verify current behavior in your own tenant’s admin center before updating internal security policies.