Microsoft Teams phishing: why suspicious messages are no longer just an email problem

What is Microsoft Teams phishing?

Teams phishing uses a chat, call, meeting invitation or shared link to persuade someone to disclose information or take an unsafe action. The destination might be a fake Microsoft 365 sign in page, an unexpected download or a request to let a stranger control the computer.

External collaboration is useful, but it also gives people outside your organisation a possible route to contact staff. A familiar display name is not identity verification. Check the account address and any external label, then confirm an unusual request separately. A genuine colleague's account can also be compromised, so an internal message is not automatically safe.

This guide focuses on Teams contact and collaboration settings. Our existing phishing email response guide covers the wider incident process, while our Microsoft 365 checklist covers general tenant security.

Verified example: criminals posing as IT support

On 2 September 2026, Microsoft published research describing an intrusion that began with an external Teams chat or call impersonating IT support. The attacker persuaded a user to grant control through screen sharing or a legitimate remote assistance tool, then installed malicious software and explored other systems.

Microsoft explains that this approach relies on persuasion rather than a Teams software vulnerability. External labels and warnings can help, but the attacker tries to convince the recipient to ignore them. A real support tool does not make the person using it trustworthy.

Practical advice: agree how your IT provider will identify themselves, where support tickets are raised and how staff can confirm a call. Treat an unexpected request to open Quick Assist, install software or approve screen control as something to verify, not something to rush.

Microsoft research published 2 September 2026

Suspicious chats and links: what should staff check?

Microsoft advises checking the sender's identity and previewing an external chat before accepting it. Teams can display warnings for suspected impersonation and known malicious links. The absence of a warning is not a guarantee that a new link or a persuasive request is safe.

The examples below are practical warning signs, not a claim that every message containing them is fraudulent. A legitimate request may be urgent, but urgency should never remove your normal checks.

• An unexpected external account claiming to be your IT department, Microsoft or a senior colleague.
• A threat that your account will be suspended unless you act immediately.
• A shared file or meeting link that unexpectedly asks for your password, a device code or new application permissions.
• A request to read out a security code, approve an Authenticator prompt or allow remote control.
• Instructions to change bank details, share pupil information or move the conversation away from your normal process.

Microsoft guidance on suspicious external chats

Why multifactor authentication alone is not enough

Multifactor authentication, or MFA, remains essential. It makes a stolen password much less useful. However, criminals can persuade a person to approve an unwanted prompt or disclose a temporary code. MFA also does not stop someone voluntarily giving an attacker control of an already signed in computer.

Microsoft's device code phishing research, published on 13 February 2025 and updated on 31 July 2026, describes fake Teams meeting invitations sent by email. Victims entered an attacker supplied code on a genuine sign in page, authorising access that the attacker could then use. This example involved Teams themed invitations, not necessarily a message delivered inside Teams.

Practical advice: do not enter a device code just because a chat or invitation tells you to. Only complete a sign in or device registration that you started and understand. A genuine Microsoft page does not prove that the action being requested is legitimate.

The NCSC's 23 April 2026 passkey guidance explains that traditional MFA methods remain phishable and recommends passkeys where supported. Its corporate guidance recommends FIDO2 authentication where appropriate. Plan stronger authentication for staff and administrators, but keep device protection, access controls and a response process as well.

Microsoft research on device code phishing

NCSC passkey guidance published 23 April 2026

NCSC recommended MFA types for corporate services

What to do when a Teams message looks suspicious

Our practical advice is to pause, verify and report. Do not click again to test a link or keep talking to the sender to investigate. Use a known telephone number, your normal support portal or an existing trusted contact, not details supplied in the suspicious conversation.

Block an unwanted external contact. Where your licence, client and policy provide it, use the message menu to report a security concern. If that option is unavailable, use your organisation's agreed reporting route. Record the sender, message time and what happened, without circulating sensitive chat content unnecessarily.

If you entered credentials, approved a prompt or granted remote access, telephone IT immediately from a trusted device. End the remote session. If an unknown person controlled the computer or software ran, disconnect its wired and wireless network connections and follow your incident procedure. Do not wipe it or switch it off unless your IT team instructs you to.

Tell IT exactly which action you took. They may need to revoke sessions, reset credentials, inspect the device and check account changes. Do not assume changing your password alone has contained the incident. If money is involved, contact the bank promptly through a trusted route.

What should Microsoft Teams administrators configure?

Microsoft documents separate controls for external chat, unmanaged Teams accounts and user policies. External access is not the same as guest membership or anonymous meeting access. Reviewing one setting does not secure every way an outsider can interact with your organisation.

Our recommendation is to record the current settings, establish which partners genuinely need access and test proposed changes with a small group. Do not block all external communication without checking how staff work.

• Review Users, then External access in the Teams admin centre. Consider allowing only required partner domains rather than every external domain, and check assigned user policies for exceptions.
• Review whether unmanaged personal Teams accounts can contact staff or start conversations. Disable unnecessary routes while preserving approved collaboration.
• Review guest membership, shared channels and anonymous meeting permissions separately. Remove access that no longer has a business or school purpose.
• Keep MFA enabled. Plan phishing resistant authentication, separate administrator accounts and appropriate device and sign in controls, checking licence requirements first.
• Restrict remote assistance to approved tools and an agreed verification process. Review who can grant screen control and monitor unusual support activity.

Microsoft administrator guidance on external access

Check Defender protection and reporting, not just email filtering

Microsoft lists built in virus protection and warnings for known malicious Teams URLs. These are not the same as licensed Safe Links protection when a user clicks. Defender for Office 365 Plan 1 and Plan 2 add Teams protections; do not assume that owning Microsoft 365 means every feature is included.

For licensed users, check that Teams is enabled in applicable Safe Links policies and that Defender protection for SharePoint, OneDrive and Teams files is on. Review Teams automatic quarantine settings and exclusions. Microsoft documents that Teams ZAP quarantines qualifying malicious messages in internal chats or channels, so do not treat it as a promise to remove every external scam.

Enable supported user reporting in Teams and monitoring in Defender, then test who actually receives and reviews a report. Microsoft notes that existing tenants may need to enable Defender monitoring. Reports sent to Microsoft can include surrounding messages and other contextual data, so agree the submission route with your data protection lead.

Microsoft Teams protection features and licensing

Microsoft configuration checklist for Teams protection

Microsoft guidance on Teams user reporting

Practical priorities for UK businesses and schools

For a small business, start with the people who handle payments, supplier changes and administrator access. Make it normal to confirm an unexpected instruction through a different trusted route, even when it appears to come from the director.

For a school, agree staff and pupil collaboration rules with leadership and safeguarding staff. Our recommendation is to review pupil external contact separately from staff collaboration and preserve access genuinely needed for teaching, trusts and approved partners. In primary settings, include shared classroom devices in the review. In secondary settings, include individual pupil accounts and departmental arrangements.

School staff should know how to raise both a technical incident and any safeguarding concern. Do not share pupil records or safeguarding information in response to an unverified support request, and keep incident evidence within approved channels.

The NCSC's phishing guidance supports layered defences and a reporting culture without blame. It is primarily about email; applying that principle to Teams is our practical recommendation. Staff training helps, but it should not carry the entire burden of stopping attacks.

NCSC layered phishing defence and incident reporting guidance

How Bury I.T. Support can help

Bury I.T. Support can review your Teams external access, guest arrangements, Microsoft 365 licences, authentication and Defender configuration. We can help document an approved support process, make reporting straightforward and explain the changes to staff in everyday language.

For schools, we can work with your leadership and safeguarding teams to balance collaboration with appropriate access boundaries. For businesses, we can focus on the accounts, devices and financial processes where a convincing support request could cause the most harm.

Ask us for a Microsoft 365 and Teams security review. Call 0161 884 3303 or email info@buryitsupport.co.uk. You do not need to wait until a suspicious message arrives to find out whether the right controls are in place.