Microsoft is adding AI phishing detection to Teams chats, and it will show a warning banner when a new external contact looks suspicious. According to the plan BleepingComputer reported on 23 October 2026, the targeted release starts in early November and general availability follows in December.
The short answer
- What it does: detects phishing and social engineering in chats and warns users, so they can decide whether to continue.
- Where: worldwide on mobile, desktop and web, in one-on-one and group chats, focusing on new external first-time contacts. In China on mobile, extra protection may also cover in-tenant chats.
- What data: conversation context, including chats without malicious links or files (per Microsoft’s Message Center text).
- Rollout (as reported): BleepingComputer, quoting a Microsoft 365 Message Center update, reported on 23 October 2026 that the targeted release starts in early November and finishes by mid-November. General availability follows between early and mid-December 2026.
- Admin action: reportedly none needed. The sources read describe no admin controls.
- Use limits: Microsoft says it is not used to train AI models, summarize conversations, produce productivity insights, monitor users or for advertising.
Both pages were read on 26 October 2026. The feature was not seen in a live tenant, so the dates are Microsoft’s plan as reported, not a confirmation that it is on for your account.
What will users see?
When phishing is suspected, a warning banner appears in the chat. Microsoft’s page advises you to:
- Check the sender’s identity and email address for impersonation.
- Be careful with high-risk requests such as money or personal information.
- Stop engaging, then block and report the sender from the contact card if it is confirmed phishing.
- Never share passwords, verification codes or financial information.
If a trusted contact was flagged by mistake, open the message, choose More options and then Report as not a concern.
Why does conversation context matter?
The detection works on conversation context, so a message can be flagged even without a malicious link or file. An example is a message that impersonates a colleague and asks for a transfer or code. A clean-looking link is therefore not proof that a chat is safe.
For protecting your identity if credentials leak, see free credit reports and how to freeze your credit.
Is it on in your account today?
Probably not yet. Microsoft’s support page describes the feature without a rollout date, and the Message Center plan reported by BleepingComputer places the start in November. Microsoft’s own admin message was not available to us.
If you manage Teams, we suggest checking your Microsoft 365 Message Center or asking your IT team before telling staff the feature is active. Microsoft publishes no detection rates on the pages read, so do not treat the banner as a guarantee either way.
What should you do now?
- Staff: keep the four habits above, since the banner will not catch everything.
- Admins: look for the Message Center post and plan a short note to staff about the banner and the Report as not a concern option.
- Everyone: treat any request for a code, password or transfer from a new external contact as suspicious, banner or not.
Questions and answers about Teams phishing detection
Does Microsoft use my chats to train AI?
No. Microsoft’s page says the feature is not used to train AI models, and also not for summaries, productivity insights, monitoring users or advertising.
Which chats are checked?
Worldwide it focuses on new external first-time contacts. In China on mobile it may also cover in-tenant chats.
What do I do if a real contact is flagged?
Open the message, choose More options and select Report as not a concern.
Do IT admins need to turn it on?
Reportedly not. The sources describe no admin controls.
Will it flag a message with no link?
Yes, it can. It reads conversation context, so a message that impersonates a colleague and asks for a transfer or code can be flagged without any link or file.
Terms in plain language
- Phishing: a message that tricks you into giving away passwords, codes or money.
- Social engineering: persuading a person, rather than hacking a system, to do something unsafe.
- Tenant: your organization’s own Microsoft 365 space.
- Targeted release: an early rollout to a limited group before general availability.
Sources
- Microsoft Support: phishing content detection in Microsoft Teams (read 26 October 2026)
- BleepingComputer: Microsoft Teams to get AI-powered, context-aware phishing detection (23 October 2026)
Facts read on 26 October 2026.
