Loading story…
Microsoft has introduced new protections in Teams to stop unwanted third-party bots from automatically joining meetings, after warning that some service bots continued entering future meetings without users intending them to. The company said the behavior creates security and privacy risks for sensitive discussions, and its new system uses behavioral and infrastructure signals to better distinguish bots from human participants. Suspected bots are now routed to the lobby for explicit organizer approval, and organizers can see them more clearly before admitting them.
Microsoft also added a Teams admin policy that allows organizations to require approval before third-party bots can join meetings, even when regular attendees are allowed to bypass the lobby. The policy can be assigned to specific users or groups through the Teams Admin Center, while Microsoft develops a registration path for independent software vendors so approved bots can self-identify as known participants. The rollout is underway, with Microsoft planning to retire earlier CAPTCHA-based defenses and later add approved-bot allow lists, full blocking of external bots, audit logs, and reporting as part of a broader effort to harden Teams against social-engineering and impersonation abuse.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Microsoft announced new protections in Teams to prevent unwanted third-party bots from automatically joining meetings, including detection that distinguishes suspected bots from humans and places them in the lobby for explicit organizer approval. The company also introduced a Teams admin policy allowing organizers to require approval before third-party bots can join and said rollout of the feature has begun.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityweek.com
Open sourcehelpnetsecurity.com
Open sourcecybersecuritynews.com
Open sourcetheregister.com
Open sourcebleepingcomputer.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has introduced a new **Teams meeting protection policy** that allows administrators to automatically block identified external bots from joining meetings, adding a stronger safeguard against unwanted third-party access. The feature builds on an earlier control that flagged suspected bots in the lobby and required organizer approval, and it is being rolled out in targeted release before broader availability. Microsoft said the setting will be **off by default** in the Teams admin center. The new control is designed to reduce the risk that legitimate third-party bots or malicious applications could be used to monitor meetings, harvest sensitive information, or support social engineering and follow-on intrusion activity. Administrative options tied to the policy include `ExternalBotAccessMode` settings such as `BlockDetectedBots`, `RequireApprovalWhenDetected`, and `AllowAllBots`, reflecting Microsoft’s broader effort to curb abuse of Teams by attackers posing as IT or helpdesk staff to gain remote access and steal data.
Aug 25, 2026
Microsoft is rolling out a **"Report a concern"** feature in Microsoft Teams that lets meeting participants flag suspected phishing, impersonation, scams, social engineering, and other suspicious behavior tied to meetings or meeting chat. Reports will be surfaced to defenders through the **Teams admin center** and **Microsoft Defender portal**, where security teams can review meeting metadata and limited contextual information as they investigate possible abuse. Microsoft is also adding controls to detect external meeting bots and improve organizer visibility into unauthorized AI assistants joining meetings, with the feature enabled by default as part of a broader push to harden collaboration platforms against fraud. The move follows Microsoft's warning that **AI-powered deception** is accelerating fraud operations, including deepfake participants, voice cloning, and other impersonation tactics that exploit trust in digital communications. Separate user reporting has also highlighted how Microsoft security workflows can create confusion for administrators and employees, particularly when phishing-reporting actions in Outlook appear in security tooling as user interaction with a malicious message. Together, the updates show Microsoft expanding in-product reporting and investigation capabilities while organizations contend with increasingly convincing AI-enabled scams across email and meetings.
Aug 4, 2026
Microsoft is set to automatically enable key messaging safety features in Microsoft Teams for tenants using default configurations, starting January 12, 2026. The update will activate protections against weaponizable file types, real-time malicious URL detection, and a reporting mechanism for false positives, aiming to reduce the risk of malware and phishing attacks within enterprise collaboration environments. Organizations that have previously customized their messaging safety settings will not be affected by this change, as their preferences will remain in place. End-users will experience changes such as warning labels on suspicious URLs and blocked messages when attempting to share high-risk file types. The reporting feature allows users to flag incorrect security detections, helping Microsoft refine its threat detection algorithms. IT administrators are advised to review and update their Teams configurations and internal documentation before the rollout to ensure a smooth transition and maintain desired security postures.
Jun 29, 2026