Loading story…
Microsoft has introduced a new Teams meeting protection policy that allows administrators to automatically block identified external bots from joining meetings, adding a stronger safeguard against unwanted third-party access. The feature builds on an earlier control that flagged suspected bots in the lobby and required organizer approval, and it is being rolled out in targeted release before broader availability. Microsoft said the setting will be off by default in the Teams admin center.
The new control is designed to reduce the risk that legitimate third-party bots or malicious applications could be used to monitor meetings, harvest sensitive information, or support social engineering and follow-on intrusion activity. Administrative options tied to the policy include ExternalBotAccessMode settings such as BlockDetectedBots, RequireApprovalWhenDetected, and AllowAllBots, reflecting Microsoft’s broader effort to curb abuse of Teams by attackers posing as IT or helpdesk staff to gain remote access and steal data.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
Microsoft began rolling out the BlockDetectedBots Teams meeting policy to Targeted Release tenants in August. The setting lets administrators automatically deny detected external bots from joining meetings instead of relying on organizer approval in the lobby.
Microsoft said in June that it planned additional Teams admin controls, including policies to block external bots entirely, allow lists for approved bots, and reporting and audit logging for bot detection and presence.
In June, Microsoft introduced a Teams policy that tagged detected bots in the meeting lobby and required organizer approval before they could join.
Microsoft announced a new Teams meeting protection policy that lets administrators automatically block identified external bots from joining meetings, expanding the earlier approval-based control.
Microsoft warned in April that attacks abusing Teams for access and lateral movement on enterprise networks were increasing, including impersonation of IT or helpdesk staff in cross-tenant chats.
Microsoft said that since December, administrators have been able to block external Teams users through the Defender portal to help counter social engineering abuse of Teams.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has introduced new protections in **Teams** to stop unwanted third-party bots from automatically joining meetings, after warning that some service bots continued entering future meetings without users intending them to. The company said the behavior creates security and privacy risks for sensitive discussions, and its new system uses behavioral and infrastructure signals to better distinguish bots from human participants. Suspected bots are now routed to the lobby for explicit organizer approval, and organizers can see them more clearly before admitting them. Microsoft also added a Teams admin policy that allows organizations to require approval before third-party bots can join meetings, even when regular attendees are allowed to bypass the lobby. The policy can be assigned to specific users or groups through the Teams Admin Center, while Microsoft develops a registration path for independent software vendors so approved bots can self-identify as known participants. The rollout is underway, with Microsoft planning to retire earlier CAPTCHA-based defenses and later add approved-bot allow lists, full blocking of external bots, audit logs, and reporting as part of a broader effort to harden Teams against social-engineering and impersonation abuse.
Jul 2, 2026
Microsoft is rolling out a **"Report a concern"** feature in Microsoft Teams that lets meeting participants flag suspected phishing, impersonation, scams, social engineering, and other suspicious behavior tied to meetings or meeting chat. Reports will be surfaced to defenders through the **Teams admin center** and **Microsoft Defender portal**, where security teams can review meeting metadata and limited contextual information as they investigate possible abuse. Microsoft is also adding controls to detect external meeting bots and improve organizer visibility into unauthorized AI assistants joining meetings, with the feature enabled by default as part of a broader push to harden collaboration platforms against fraud. The move follows Microsoft's warning that **AI-powered deception** is accelerating fraud operations, including deepfake participants, voice cloning, and other impersonation tactics that exploit trust in digital communications. Separate user reporting has also highlighted how Microsoft security workflows can create confusion for administrators and employees, particularly when phishing-reporting actions in Outlook appear in security tooling as user interaction with a malicious message. Together, the updates show Microsoft expanding in-product reporting and investigation capabilities while organizations contend with increasingly convincing AI-enabled scams across email and meetings.
Aug 4, 2026
Microsoft is introducing a new security feature for its Teams collaboration platform called the "External Domains Anomalies Report," aimed at enhancing the detection of suspicious or risky interactions with external organizations. This tool, scheduled for rollout in February 2026, will provide IT administrators with behavioral analytics to identify unusual communication patterns, such as sudden spikes in message volume to specific external domains or interactions with previously unseen domains. The feature is designed to address the growing security challenges posed by increased external collaboration and remote work, offering actionable intelligence to help prevent data leaks, social engineering attacks, and unauthorized use of third-party services. The report will be available for standard multi-tenant cloud environments via the Teams web platform and will help organizations maintain a balance between productive cross-organization work and robust data protection. In addition to this new reporting capability, Microsoft continues to enhance Teams' security posture by warning users about malicious links, improving protections against unsafe file types, and introducing features to block unauthorized screen captures and streamline client performance. The External Domains Anomalies Report represents a proactive step in giving administrators early visibility into potential threats arising from external communications.
Jun 29, 2026