Summary
Details
Updated November 17, 2025: The rollout of “Report incorrect security detection in Microsoft teams is expected to finish by the end of November 2025 for General Availability (Worldwide). The previously announced update to make “Report incorrect security detections” settings in Messaging settings in Teams admin center On by default has been postponed to early 2026. A separate communication will be issued detailing the roll out schedule for the default-on change in advance.
Thank you for your patience.
Introduction
Microsoft Teams now enables users to report messages they believe were incorrectly flagged as security threats in chats and channels. This capability is available to organizations with Microsoft Defender for Office 365 Plan 2 or Microsoft Defender XDR. It empowers users to provide feedback on false positives, helping improve detection accuracy and strengthen organizational security.
This feature will be available across Microsoft Teams on Android, Desktop (Windows), iOS, Mac, and Web platforms, ensuring broad accessibility for users regardless of device.
This feature is associated with Microsoft 365 Roadmap ID 501202.
When this will happen
Targeted Release (Worldwide): Begins in early September 2025; expected completion by mid-September 2025.
General Availability (Worldwide): Begins in early November 2025; expected completion by end of November 2025 (previously mid-November).
How this affects your organization
Users will be able to report messages they believe contain URLs that were incorrectly flagged as malicious:
- During Targeted Release, the feature is off by default in Teams.
- At General Availability, the feature will be on by default in Teams. Admin settings saved during Targeted Release will remain unchanged.
- In the Microsoft Defender portal, the setting is on by default for new tenants. Existing tenants must enable it manually.
What you can do to prepare
To enable this feature and ensure reported messages appear in the User reported tab in Submissions:
- In the Teams admin center, go to Messaging settings > Messaging safety and turn on Report incorrect security detections.
- In the Microsoft Defender portal, ensure the corresponding setting is enabled.
Both settings must be turned on for full functionality.
Learn more: [Updated documentation to be made available on Microsoft Learn in the second week of September 2025.]
Compliance considerations
| Does the change store new customer data, and if so, where is it stored? | Yes. When users report messages they believe were incorrectly flagged, those submissions are stored in the Microsoft Defender portal under the Submissions tab. |
| Does the change introduce or significantly modify AI/ML or agent capabilities that interact with or provide access to customer data? | Yes. User feedback on incorrectly flagged messages is used to improve detection models, which modifies how AI/ML systems classify threats over time. |
| Does the change include an admin control, and can it be controlled through Entra ID group membership? | Yes. Admins can enable or disable the feature in both the Teams admin center and the Microsoft Defender portal. Access to these controls can be managed through Entra ID group membership. |
Related Roadmap Items
Change History
Updated September 9, 2025: We have updated the content. Thank you for your patience.
Introduction
Microsoft Teams now enables users to report messages they believe were incorrectly flagged as security threats in chats and channels. This capability is available to organizations with Microsoft Defender for Office 365 Plan 2 or Microsoft Defender XDR. It empowers users to provide feedback on false positives, helping improve detection accuracy and strengthen organizational security.
This feature will be available across Microsoft Teams on Android, Desktop (Windows), iOS, Mac, and Web platforms, ensuring broad accessibility for users regardless of device.
This feature is associated with Microsoft 365 Roadmap ID 501202.
When this will happen
Targeted Release (Worldwide): Begins in early September 2025; expected completion by mid-September 2025.
General Availability (Worldwide): Begins in early November 2025; expected completion by mid-November 2025.
How this affects your organization
Users will be able to report messages they believe contain URLs that were incorrectly flagged as malicious:
- During Targeted Release, the feature is off by default in Teams.
- At General Availability, the feature will be on by default in Teams. Admin settings saved during Targeted Release will remain unchanged.
- In the Microsoft Defender portal, the setting is on by default for new tenants. Existing tenants must enable it manually.
What you can do to prepare
To enable this feature and ensure reported messages appear in the User reported tab in Submissions:
- In the Teams admin center, go to Messaging settings > Messaging safety and turn on Report incorrect security detections.
- In the Microsoft Defender portal, ensure the corresponding setting is enabled.
Both settings must be turned on for full functionality.
Learn more: [Updated documentation to be made available on Microsoft Learn in the second week of September 2025.]
Compliance considerations
| Does the change store new customer data, and if so, where is it stored? | Yes. When users report messages they believe were incorrectly flagged, those submissions are stored in the Microsoft Defender portal under the Submissions tab. |
| Does the change introduce or significantly modify AI/ML or agent capabilities that interact with or provide access to customer data? | Yes. User feedback on incorrectly flagged messages is used to improve detection models, which modifies how AI/ML systems classify threats over time. |
| Does the change include an admin control, and can it be controlled through Entra ID group membership? | Yes. Admins can enable or disable the feature in both the Teams admin center and the Microsoft Defender portal. Access to these controls can be managed through Entra ID group membership. |
Updated November 17, 2025: The rollout of “Report incorrect security detection in Microsoft teams is expected to finish by the end of November 2025 for General Availability (Worldwide). The previously announced update to make “Report incorrect security detections” settings in Messaging settings in Teams admin center On by default has been postponed to early 2026. A separate communication will be issued detailing the roll out schedule for the default-on change in advance.
Thank you for your patience.
Introduction
Microsoft Teams now enables users to report messages they believe were incorrectly flagged as security threats in chats and channels. This capability is available to organizations with Microsoft Defender for Office 365 Plan 2 or Microsoft Defender XDR. It empowers users to provide feedback on false positives, helping improve detection accuracy and strengthen organizational security.
This feature will be available across Microsoft Teams on Android, Desktop (Windows), iOS, Mac, and Web platforms, ensuring broad accessibility for users regardless of device.
This feature is associated with Microsoft 365 Roadmap ID 501202.
When this will happen
Targeted Release (Worldwide): Begins in early September 2025; expected completion by mid-September 2025.
General Availability (Worldwide): Begins in early November 2025; expected completion by end of November 2025 (previously mid-November).
How this affects your organization
Users will be able to report messages they believe contain URLs that were incorrectly flagged as malicious:
- During Targeted Release, the feature is off by default in Teams.
- At General Availability, the feature will be on by default in Teams. Admin settings saved during Targeted Release will remain unchanged.
- In the Microsoft Defender portal, the setting is on by default for new tenants. Existing tenants must enable it manually.
What you can do to prepare
To enable this feature and ensure reported messages appear in the User reported tab in Submissions:
- In the Teams admin center, go to Messaging settings > Messaging safety and turn on Report incorrect security detections.
- In the Microsoft Defender portal, ensure the corresponding setting is enabled.
Both settings must be turned on for full functionality.
Learn more: [Updated documentation to be made available on Microsoft Learn in the second week of September 2025.]
Compliance considerations
| Does the change store new customer data, and if so, where is it stored? | Yes. When users report messages they believe were incorrectly flagged, those submissions are stored in the Microsoft Defender portal under the Submissions tab. |
| Does the change introduce or significantly modify AI/ML or agent capabilities that interact with or provide access to customer data? | Yes. User feedback on incorrectly flagged messages is used to improve detection models, which modifies how AI/ML systems classify threats over time. |
| Does the change include an admin control, and can it be controlled through Entra ID group membership? | Yes. Admins can enable or disable the feature in both the Teams admin center and the Microsoft Defender portal. Access to these controls can be managed through Entra ID group membership. |
Introduction
Microsoft Teams now enables users to report messages they believe were incorrectly flagged as security threats in chats and channels. This capability is available to organizations with Microsoft Defender for Office 365 Plan 2 or Microsoft Defender XDR. It empowers users to provide feedback on false positives, helping improve detection accuracy and strengthen organizational security.
This feature will be available across Microsoft Teams on Android, Desktop (Windows), iOS, Mac, and Web platforms, ensuring broad accessibility for users regardless of device.
This feature is associated with Microsoft 365 Roadmap ID 501202.
When this will happen
Targeted Release (Worldwide): Begins in early September 2025; expected completion by mid-September 2025.
General Availability (Worldwide): Begins in early November 2025; expected completion by mid-November 2025.
How this affects your organization
Users will be able to report messages they believe contain URLs that were incorrectly flagged as malicious:
- During Targeted Release, the feature is off by default in Teams.
- At General Availability, the feature will be on by default in Teams. Admin settings saved during Targeted Release will remain unchanged.
- In the Microsoft Defender portal, the setting is on by default for new tenants. Existing tenants must enable it manually.
What you can do to prepare
To enable this feature and ensure reported messages appear in the User reported tab in Submissions:
- In the Teams admin center, go to Messaging settings > Messaging safety and turn on Report incorrect security detections.
- In the Microsoft Defender portal, ensure the corresponding setting is enabled.
Both settings must be turned on for full functionality.
Learn more: [Updated documentation to be made available on Microsoft Learn in the second week of September 2025.]
Compliance considerations
| Does the change store new customer data, and if so, where is it stored? | Yes. When users report messages they believe were incorrectly flagged, those submissions are stored in the Microsoft Defender portal under the Submissions tab. |
| Does the change introduce or significantly modify AI/ML or agent capabilities that interact with or provide access to customer data? | Yes. User feedback on incorrectly flagged messages is used to improve detection models, which modifies how AI/ML systems classify threats over time. |
| Does the change include an admin control, and can it be controlled through Entra ID group membership? | Yes. Admins can enable or disable the feature in both the Teams admin center and the Microsoft Defender portal. Access to these controls can be managed through Entra ID group membership. |
Updated September 9, 2025: We have updated the content. Thank you for your patience.
Introduction
Microsoft Teams now enables users to report messages they believe were incorrectly flagged as security threats in chats and channels. This capability is available to organizations with Microsoft Defender for Office 365 Plan 2 or Microsoft Defender XDR. It empowers users to provide feedback on false positives, helping improve detection accuracy and strengthen organizational security.
This feature will be available across Microsoft Teams on Android, Desktop (Windows), iOS, Mac, and Web platforms, ensuring broad accessibility for users regardless of device.
This feature is associated with Microsoft 365 Roadmap ID 501202.
When this will happen
Targeted Release (Worldwide): Begins in early September 2025; expected completion by mid-September 2025.
General Availability (Worldwide): Begins in early November 2025; expected completion by mid-November 2025.
How this affects your organization
Users will be able to report messages they believe contain URLs that were incorrectly flagged as malicious:
- During Targeted Release, the feature is off by default in Teams.
- At General Availability, the feature will be on by default in Teams. Admin settings saved during Targeted Release will remain unchanged.
- In the Microsoft Defender portal, the setting is on by default for new tenants. Existing tenants must enable it manually.
What you can do to prepare
To enable this feature and ensure reported messages appear in the User reported tab in Submissions:
- In the Teams admin center, go to Messaging settings > Messaging safety and turn on Report incorrect security detections.
- In the Microsoft Defender portal, ensure the corresponding setting is enabled.
Both settings must be turned on for full functionality.
Learn more: [Updated documentation to be made available on Microsoft Learn in the second week of September 2025.]
Compliance considerations
| Does the change store new customer data, and if so, where is it stored? | Yes. When users report messages they believe were incorrectly flagged, those submissions are stored in the Microsoft Defender portal under the Submissions tab. |
| Does the change introduce or significantly modify AI/ML or agent capabilities that interact with or provide access to customer data? | Yes. User feedback on incorrectly flagged messages is used to improve detection models, which modifies how AI/ML systems classify threats over time. |
| Does the change include an admin control, and can it be controlled through Entra ID group membership? | Yes. Admins can enable or disable the feature in both the Teams admin center and the Microsoft Defender portal. Access to these controls can be managed through Entra ID group membership. |
Never Miss a Microsoft 365 Update
Join thousands of IT professionals who rely on DeltaPulse for real-time Microsoft 365 change intelligence, automated notifications, and community insights.