Microsoft Teams will use AI to spot phishing in message context

Microsoft is preparing an AI-powered phishing detection feature for Microsoft Teams, with a planned general rollout in November 2026. The tool is designed to look beyond obvious malicious links or attachments and assess the context of conversations for signs of phishing, impersonation, social engineering and other deceptive behaviour.¹

The feature appears in Microsoft’s 365 roadmap as an update to Teams’ security protections. TechRadar reports that Microsoft described the system as particularly relevant to higher-risk situations such as messages from external contacts making first contact.² That matters because many modern scams begin with a plausible conversation rather than an immediately suspicious file or URL.

What Microsoft says the feature will do

Microsoft says the detection system will analyse conversation context to identify suspicious behaviour that may not contain traditional warning signs. The company’s description includes phishing, social-engineering attempts, impersonation and deceptive intent.¹

The system is not being presented as a general-purpose assistant. Microsoft says it is intended only for security protection, rather than productivity features, advertising, user monitoring or message summarisation. It also says customer message content will not be retained by the detection system for model training or other secondary uses.¹

The roadmap currently lists November 2026 as the planned general-availability window for Teams users. Microsoft says administrators will not need to take action to enable the feature, although the final rollout details and regional availability may still change before release.¹

The company has not publicly identified which AI models will power the detection process. That leaves an important practical question unanswered: how Teams will balance contextual analysis against false positives when a legitimate conversation resembles a social-engineering attempt.

Why contextual detection could help

Traditional phishing controls are strongest when a message contains a known malicious domain, a suspicious attachment or a recognisable scam pattern. Context-aware analysis could add another layer by considering who is speaking, how a conversation develops and whether a request appears deceptive even when its individual messages look ordinary.

That approach is not a guarantee that scams will disappear. Attackers can adapt, and automated detection can misread unusual but legitimate conversations. Microsoft’s decision to describe the feature as a security-only capability, alongside its statement about not retaining customer content for model training, is therefore as important as the AI label itself.¹

Our opinion

This is a sensible direction for Teams security, but the rollout should be judged by its accuracy and transparency rather than by the presence of AI in the announcement. Context is exactly what many impersonation scams exploit, so a system that can connect otherwise harmless-looking messages may catch threats that link-based filters miss. Microsoft still needs to explain how users and administrators can challenge a false positive, what signals are processed, and how regional protections differ. Until those details arrive, the feature looks useful on paper rather than proven in the workplace.

For now, the story is a planned Teams security update, not a promise that every suspicious conversation will be caught. November 2026 is the stated target, and Microsoft may adjust the timing or scope before the feature reaches general availability.