Microsoft has notified Microsoft 365 administrators that the newly introduced phishing alert functionality will be available to all users by the middle of February, as indicated by a report from Bleeping Computer. This feature will be activated by default and will notify users when phishing attempts are detected.
To receive these alerts, users must have external Teams access enabled, which allows members of your organization to communicate with individuals outside the organization. While the initial rollout began in mid-November, it hasn’t reached every user yet, but Microsoft aims to complete the distribution by mid-February. Users are encouraged to get familiar with the new high-risk Accept/Block interface.
When you receive a phishing alert, you will need to review the message and determine whether to accept it. If you choose to accept it, Microsoft will send a follow-up alert reminding you of the potential risks involved. Administrators can also review the audit log to track detected phishing attacks that utilize this method.
If you currently do not have access to the phishing alert feature and do not require communication with anyone outside your team, it is advisable to disable this feature through the Microsoft Teams Admin Center, followed by turning off External Access. However, if you need this functionality, administrators can add specific domains to a whitelist to minimize potential risks. It’s uncertain when the feature will be fully accessible to everyone, but it is anticipated to roll out soon. When that happens, it is likely that malicious actors, such as a group that previously inundated a user’s inbox with numerous emails before impersonating IT support, will find it more challenging to achieve their objectives.
Microsoft Teams has also implemented additional security measures, including the Safe Links feature designed to shield users from harmful links. It will be interesting to observe what other enhancements are introduced to Teams in the future.