Microsoft Teams to use AI to detect phishing scams hidden in conversations

# Microsoft to Introduce AI-Powered Phishing Detection in Teams

Microsoft is preparing to strengthen security in Microsoft Teams with a new artificial intelligence-powered feature designed to identify phishing attempts, impersonation and scams by examining the content of conversations. The system aims to detect suspicious behavior even when messages contain no malicious links, attachments or files.

The company announced the upcoming feature in a Message Center notice published on October 21. The initial rollout is expected to begin in early November, with the targeted release scheduled to continue through mid-November. Worldwide general availability is anticipated between early and mid-December. The protection is planned for Teams across desktop, Mac, web and mobile platforms.

**Addressing the Growing Threat of Social Engineering**

Traditional phishing defenses often concentrate on identifying harmful links, suspicious attachments and dangerous files. However, cybercriminals increasingly use social engineering techniques, manipulating individuals into revealing confidential information or providing unauthorized access to company systems without sending any malicious content.

Microsoft's new capability is intended to address this gap by analyzing conversations for indicators of deceptive intent, phishing, impersonation and other potentially harmful behavior. Such attacks can involve criminals pretending to be technical support personnel, colleagues, administrators or other trusted contacts to persuade victims to disclose sensitive credentials.

**How the New Detection System Works**

Microsoft provided an example in which an external account using the display name “MOD Administrator” discusses permission-related problems before asking the recipient to share their credentials. Teams identifies the suspicious request and displays a warning indicating that the message may be a phishing attempt.

The example demonstrates how scammers can use seemingly routine workplace conversations to establish trust before requesting confidential information. By examining the context of a conversation rather than relying exclusively on links or attachments, the feature is designed to help organizations identify threats that conventional security filters might overlook.

Initially, the protection will concentrate on conversations involving unfamiliar external contacts, including one-to-one and group chats. Microsoft has also indicated that Teams mobile users in China may receive protection for certain internal conversations.

**Gradual Rollout and Administrator Requirements**

During the initial rollout, the detection system will operate in the background while Microsoft evaluates its performance. Visible warnings may be introduced after the validation process, so users should not assume that every suspicious message will generate an immediate alert during the early stages.

Microsoft has stated that administrators will not need to make additional configuration changes to activate the protection. This approach is intended to simplify deployment for organizations already using Teams.

**Microsoft Addresses Privacy Concerns**

The company says the new capability is designed exclusively for security purposes. It will not be used for advertising, employee monitoring, productivity analysis or generating conversation summaries.

Microsoft has also addressed concerns about how private communications may be handled, stating that message content will not be retained by the detection system for AI model training or other secondary purposes. These assurances are intended to clarify the distinction between security-focused analysis and the broader use of workplace communications.

**Employee Awareness Remains Essential**

Although AI-based detection can provide an additional layer of defense, Microsoft continues to encourage organizations to educate employees about suspicious requests and unfamiliar contacts. Users should independently verify a sender's identity through a trusted communication channel before responding to unexpected requests for access or information.

Employees should never disclose passwords, verification codes, financial information or other sensitive details simply because a message appears to come from an administrator or colleague. Requests involving urgency, unusual permissions or confidential credentials deserve particular scrutiny.

As generative AI makes it easier for scammers to produce convincing and personalized messages, identifying deceptive conversations is becoming increasingly important. Microsoft's planned Teams feature represents an additional step toward addressing these evolving threats, but careful verification and employee awareness will remain important parts of an organization's cybersecurity strategy.