> ## Content Index
> Fetch the complete content index at: https://blog.harshkohli.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Microsoft Teams Will Use AI to Flag Phishing Chats
- URL: https://blog.harshkohli.com/microsoft-teams-ai-phishing-detection/
- Published: 2026-10-26T05:01:05.000Z
- Updated: 2026-10-26T05:01:05.000Z
- Description: Teams is getting AI phishing detection that reads chat context, even without links. Rollout starts in November. How it works and what to do.
- Author: Harsh Kohli
- Tags: Tech News, AI

Phishing has moved well beyond email. A lot of the scams aimed at office workers now arrive as a friendly Teams chat from someone claiming to be IT support. Microsoft is about to make Teams look harder at those chats, and it doesn't need a dodgy link to raise a flag. I came across it in [BleepingComputer's report](https://www.bleepingcomputer.com/news/microsoft/microsoft-teams-to-get-ai-powered-context-aware-phishing-detection/?ref=blog.harshkohli.com) and then checked Microsoft's own notes.

## What happened

In Microsoft 365 Message Center notice [MC1519866](https://mc.merill.net/message/MC1519866?ref=blog.harshkohli.com), posted October 21, Microsoft says Teams is getting AI-based phishing detection that reads the context of a conversation. It looks for phishing, social engineering, impersonation and deceptive intent, including messages that carry no malicious file or URL at all.

Targeted Release starts in early November 2026 and should finish by mid-November. General availability worldwide is planned for early to mid-December.

For most people it only watches external first-contact chats, meaning the first time someone outside your organisation messages you, in one-to-one or group chats. Teams mobile users in China may also get extra checks on internal chats. Admins don't need to switch anything on. Early on, detection may run quietly in the background while Microsoft validates quality, so don't expect warnings on day one.

## Why it matters

Teams has become a favourite route for attackers. Ransomware crews have spent the last couple of years messaging employees from outside tenants and pretending to be the help desk, and filters that only look for bad links don't catch that. A banner that says "this looks like phishing" in a first-contact chat could stop someone before they hand over a code or approve remote access.

The obvious question is privacy. Microsoft's [support page](https://support.microsoft.com/en-us/teams/chat/phishing-content-detection-microsoft-teams?ref=blog.harshkohli.com) says the detection is used only for security, not for summaries, productivity insights, monitoring or ads, and that message content isn't kept to train models. That's a policy promise, not something you can check yourself, so judge it accordingly. It also doesn't change how your organisation retains Teams chats in general.

## What to do

- If you see a warning, check who the sender really is through a channel you trust, like a phone number from your company directory.
- If it's a scam, don't reply. Block and report the sender from their contact card.
- If a trusted contact gets flagged by mistake, use More options on the message and choose Report as not a concern.
- Never share passwords, sign-in codes or payment details in a chat, warning or not.
- Admins: brush up your guidance on unfamiliar external contacts now, before the banners start appearing.

Breaches like the [Capcom ID leak](https://blog.harshkohli.com/capcom-id-data-breach-11-million/) are a reminder that scammers often already know your name and email. A chat that seems to know you isn't proof it's real.