Loading story…
Microsoft has started rolling out Workplace Check-in for Microsoft Teams, a Microsoft 365 feature that can mark employees as present in a specific office building by using corporate Wi-Fi data and, on some devices, location permissions. The capability is tied to organizations using Microsoft Places, remains disabled by default at the tenant level, and must first be enabled by enterprise administrators before users are prompted to participate.
Microsoft says the feature is optional and designed as an office-presence signal rather than continuous location tracking, noting it is not meant to follow employees between floors or buildings throughout the day. Even so, the rollout has renewed privacy concerns because administrators can configure prompts that encourage location sharing and employers could use the resulting attendance data to monitor return-to-office compliance; deployment may also be gradual because organizations must configure details such as office locations and Wi-Fi BSSID mappings.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft began rolling out the Workplace Check-in feature for Microsoft Teams, which can use corporate Wi-Fi and device location permissions to indicate whether a user is at a specific office building. Microsoft says the feature is disabled by default and requires administrator enablement and user consent.
Microsoft delayed the initial release of the Microsoft 365 Workplace Check-in feature after backlash in September 2025 over privacy and workplace surveillance concerns.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
zdnet.fr
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourcewindowslatest.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft announced that **Microsoft Entra ID** will, starting in March 2026, automatically enable *passkey profiles* and add **synced passkeys** support as the capability moves into **general availability**. The update introduces a new `passkeyType` property to control whether users can register **device-bound passkeys**, **synced passkeys**, or both, and adds a new admin experience that supports **group-based configuration** rather than tenant-wide-only settings. Microsoft plans a staged rollout with an opt-in window; tenants that do not opt in will be migrated later, with existing FIDO2/passkey authentication method settings moved into a default passkey profile and `passkeyType` set based on current attestation configuration. Separately, Microsoft is preparing a **Microsoft Teams** feature (Microsoft 365 Roadmap **ID 488800**) that can automatically set and display a user’s **work location** based on the **organizational Wi‑Fi network (SSID)** they connect to, mapping recognized network identifiers to building/location data configured by tenant administrators. The feature is described as **off by default** and requires admin enablement, with rollout now targeted for March 2026 after prior delays; it is positioned as a hybrid-work coordination improvement but raises potential **privacy/employee monitoring** concerns due to automated location inference.
Jun 29, 2026
Microsoft is rolling out **Brand Impersonation Protection** for *Microsoft Teams Calling* to warn users about potentially fraudulent external VoIP callers attempting to impersonate trusted organizations. The feature evaluates **first-contact external calls** for impersonation risk signals and, when a call is deemed high-risk, displays warnings before the user answers; warnings can also persist during the call if suspicious indicators remain. Users can then choose to **accept, block, or end** the call to reduce exposure to social engineering and **vishing** attempts. Deployment is expected to begin in the **Targeted Release** ring in **mid-February 2026** and will be **enabled by default** for Teams Calling tenants, with broader availability timing to be communicated later. Microsoft indicates no administrative changes are required to enable the capability, but recommends preparing helpdesk/support teams for user questions and updating internal awareness/training materials to reflect the new high-risk call alerts; support is noted for **Windows desktop and macOS** clients.
Jun 29, 2026
Microsoft has introduced new protections in **Teams** to stop unwanted third-party bots from automatically joining meetings, after warning that some service bots continued entering future meetings without users intending them to. The company said the behavior creates security and privacy risks for sensitive discussions, and its new system uses behavioral and infrastructure signals to better distinguish bots from human participants. Suspected bots are now routed to the lobby for explicit organizer approval, and organizers can see them more clearly before admitting them. Microsoft also added a Teams admin policy that allows organizations to require approval before third-party bots can join meetings, even when regular attendees are allowed to bypass the lobby. The policy can be assigned to specific users or groups through the Teams Admin Center, while Microsoft develops a registration path for independent software vendors so approved bots can self-identify as known participants. The rollout is underway, with Microsoft planning to retire earlier CAPTCHA-based defenses and later add approved-bot allow lists, full blocking of external bots, audit logs, and reporting as part of a broader effort to harden Teams against social-engineering and impersonation abuse.
Jul 2, 2026