Microsoft 365 message security changes: Teams user reporting expansion and Exchange Online false-positive quarantines

Microsoft is expanding end-user reporting capabilities in Microsoft Teams by enabling Defender for Office 365 Plan 1 customers to report suspicious messages directly in Teams (Roadmap ID 531760), a capability previously limited to Plan 2. The feature is intended to strengthen collaboration-platform defenses by letting users classify messages as Security Risk (suspected phishing/malware/spam) or Not a Security Risk (false positives), providing additional signals to SOC workflows and improving detection for chat-based social engineering such as BEC-style lures delivered via Teams; the rollout is expected to complete by late March 2026 and requires administrative enablement.

Separately, Microsoft acknowledged an Exchange Online service issue in which legitimate emails were incorrectly marked as phishing/spam and quarantined, disrupting some users’ ability to send/receive email. Microsoft attributed the false positives to a new URL rule that misclassified certain legitimate URLs/domains as malicious due to evolving detection criteria; some previously quarantined messages may begin reappearing as mitigations roll out, but other emails may remain quarantined until the fix is fully deployed, and affected organizations are advised to review quarantine for missing legitimate mail.