MC1466296 - Microsoft Teams: Report security concerns in meetings

What and why

We're introducing a new security reporting capability in Microsoft Teams meetings that allows meeting participants to report suspicious, malicious, or potentially fraudulent behavior during or after a meeting.

This capability helps organizations identify and investigate threats such as phishing attempts, impersonation, scams, social engineering, and other suspicious activity. Submitted reports provide additional security signals that can be reviewed by administrators in Microsoft security and administration tools to support investigation and response workflows.

This message is associated with Microsoft 365 Roadmap ID 569207.

Rollout schedule

• Targeted Release: Beginning in late September 2026 and expected to complete by late September 2026
• General Availability (Worldwide): Beginning in mid-October 2026 and expected to complete by late October 2026

Impact on your organization

Who is affected

• Users participating in Microsoft Teams meetings on Windows, Mac, and web

Platforms and services

• Microsoft Teams
• Microsoft Defender portal
• Teams admin center

What will happen

• Users will see a new Report a concern option in the participant tile and participant pane during Teams meetings: 

  

• Users will be able to report suspected phishing attempts, impersonation, scams, social engineering activity, and other security concerns directly from Teams meetings: 

  

• Users will also be able to mark a previously reported participant as Not a concern.
• Relevant meeting metadata and limited contextual information will be collected to support security investigations and remediation activities.
• Information associated with reported meetings will be available for administrator review and investigation.
• Organizations with Microsoft Defender for Office 365 Plan 1, Microsoft Defender for Office 365 Plan 2, or Microsoft Defender XDR will be able to review detailed reported meeting submissions in the Microsoft Defender portal.
• Report information will also be available in the Teams admin center under Protection reports > User-reported security submissions.
• Administrators can investigate reported meetings and take actions according to their organization's security processes and policies.
• This capability will be enabled by default.

Action required and recommendations

Review your organization's security investigation and incident response processes before rollout.

Recommended actions:

• Review Microsoft Defender user reporting settings and ensure reporting workflows align with organizational requirements.
• If your organization uses Microsoft Defender for Office 365 or Microsoft Defender XDR, verify that Teams meeting reporting is configured appropriately so detailed submissions are available to security investigators.
• Inform users about the new Report a concern capability and when it should be used.
• Inform users about the Not a concern option and when it should be used.
• Update security awareness training, incident response documentation, and internal guidance as needed.
• Verify that security administrators responsible for reviewing reports have the appropriate access to the Microsoft Defender portal or Teams admin center.

Compliance considerations