Microsoft Teams will use AI to warn staff about phishing in outside chats from November

Microsoft Teams is getting AI-powered phishing detection for chats. Microsoft’s 365 roadmap says it will analyse the context of a conversation to spot phishing and social engineering, mainly in first-contact chats from people outside your organisation, and show users a warning when something looks suspicious. General availability is expected in November 2026, on desktop, Mac, web, iOS and Android.

What Microsoft announced

The feature is roadmap item 575288, "Phishing Detection in Teams Messaging", added on 14 October 2026:

• What it does: uses AI to read the conversation and flag phishing and social engineering attempts.
• Where: mainly in higher-risk scenarios, above all the first chat from someone outside your company. Microsoft adds that extra protection may apply in some regions or scenarios.
• What users see: a warning when suspicious activity is detected. Microsoft says the analysis is used only for security protection.
• When: general availability in November 2026, for the worldwide multi-tenant cloud.
• Status: still "in development", so treat the date as a plan.

Why chat phishing matters now

Phishing is no longer only an email problem. A chat message that looks like it comes from IT support, a supplier or a bank asks someone to click a link, share a code or install a "support tool". Email has years of filtering behind it; a Teams chat from outside the company has had much less.

Teams already shows a warning when it detects possible spam or impersonation from an external person. The recipient can preview the message, then accept the chat or block the sender. A separate check flags outside accounts that pretend to be well-known brands. The new AI detection adds a check on what the conversation actually says.

How to prepare

• Review external access in the Teams admin centre, so only the outside domains you work with can start chats with your staff.
• Tell staff what the warning means: check the name and email address, preview before replying, accept only people they know, and block when in doubt.
• Keep multi-factor sign-in on for every account, so a stolen password alone is not enough.
• Agree how to report a suspicious chat, so IT hears about it the same day.
• Expect some false alarms at first, and tell staff a warning is a prompt to check, not proof of an attack.

What it means for businesses

This is a useful extra layer for any company that chats with clients and suppliers on Teams. It does not replace good settings and staff who know what to look for. Our Microsoft 365 management team sets up external access, sign-in rules and security for businesses in Pakistan, and our IT support team in Lahore handles day-to-day issues and staff training. For the same sign-in rules applied to AI tools, see our guide to AI agent security basics.