Microsoft will start rolling out AI-powered, context-aware phishing detection in Microsoft Teams in early November 2026, according to a Microsoft 365 Message Center update (MC1519866) published on Wednesday.

The protection targets higher-risk conversations, with external first-contact chats as the main focus for most users, and IT administrators do not need to take any action to enable it.

The rollout starts with a targeted release phase that Microsoft expects to finish by mid-November. General availability worldwide is expected between early and mid-December 2026.

Microsoft says the feature is meant "to help identify phishing, social engineering, impersonation attempts, and deceptive intent." Classic filters look for known indicators such as malicious links or attached files. The new Teams capability analyzes the context of a conversation instead, which lets it flag suspicious behavior in messages that contain neither.

This is relevant for chat-based social engineering, where an attacker may never send a link at all. A message from an unknown external contact can now be judged on its intent rather than on its attachments.

The capability first appeared in a Microsoft 365 Roadmap entry last week. The Message Center post adds the rollout schedule and the data handling commitments.

Microsoft states that the detection system does not keep message content for later use. "This capability is used only for security protection and not for productivity, summarization, advertising, user monitoring, or other non-security purposes," the company said. "Customer message content is not retained by the detection system for model training or other secondary uses."

Because the protection is enabled automatically, organizations have little to configure. Admins who want to prepare can still do the following:

1. Track MC1519866 in the Microsoft 365 Message Center to see when the targeted release reaches the tenant.
2. Tell help desk staff and employees that Teams may start flagging external first-contact chats as suspicious from November.
3. Review who in the organization regularly receives first contact from external Teams users, since those chats are the main focus of the new detection.

The phishing detection is the newest entry in a run of Teams security changes. Microsoft previously said admins could block external users through the Defender portal, and in August it began rolling out a meeting protection policy that automatically blocks identified external bots from joining meetings.

Last month, the company said Teams will blur QR codes sent by external senders and let users report suspicious guest invitations directly in the app. In early October, Microsoft announced support for third-party deepfake detection and impersonation protection in Teams meetings.

Microsoft has not said whether the context-aware detection will expand beyond higher-risk scenarios such as external first-contact chats, or whether admins will get settings to tune it once it reaches general availability in December.