The change

The conversation is becoming a signal

Microsoft says Teams will use AI-powered, context-aware detection to identify phishing and social engineering in one-to-one and group chats from new external first-time contacts. A warning may appear within the chat. Its support guidance says this applies to desktop, web and mobile users worldwide, with additional scope for mobile users in China.

The Cyber Security Hub newsletter points to a planned November targeted rollout and a wider December rollout. Those are plans, not evidence that every tenant already has the feature. Microsoft's support page does not publish detection-rate or false-positive benchmarks. Administrators should confirm availability and behaviour in their own tenant before treating a missing warning as a failed control—or a quiet chat as safe.

A warning is not a verdict

The documented worldwide scope focuses on new external first-contact chats. Do not assume the same protection covers established contacts, every internal chat or voice calls.

Defender note

Give staff a way to verify helpdesk requests

  1. 1

    Review external access. Check which external domains and users can initiate contact and whether the current policy matches business need.

  2. 2

    Make support identity testable. Tell employees how genuine IT support initiates contact and how to verify a request through a separate trusted channel before sharing codes or remote access.

  3. 3

    Rehearse the response. Ensure users know how to block and report a suspicious Teams contact. Review the security-detections report and reported-message workflow where available.

Microsoft says this detection is not used for model training, conversation summaries, productivity monitoring or advertising. That statement concerns this security feature; it does not replace a tenant's separate retention and compliance settings.