Summary
Details
Updated February 13, 2026: We have updated the timeline. Thank you for your patience.
[Introduction]
We’re expanding the ability for users to report suspicious Microsoft Teams messages to customers with Microsoft Defender for Office 365 Plan 1. Previously available only to Plan 2, this update helps security teams identify and investigate potential phishing, malware, and spam across internal and external Teams chats, channels, and meeting chats. This enhancement strengthens protection by incorporating user-reported signals into existing Defender detections.
Users will be able to report messages in two ways:
- Report as security risk — for messages suspected to contain phishing, malware, or other malicious content.
- Report as not a security risk — for messages that were incorrectly identified as threats (false positives).
This message is associated with Microsoft 365 Roadmap ID 531760.
[When this will happen]General Availability (Worldwide): Rollout begins in late February 2026 (previously mid-March) and is expected to complete by end of February 2026 (previously late March).
[How this affects your organization]Who is affected:
- Microsoft 365 tenants using Microsoft Defender for Office 365 Plan 1
- Users across Microsoft Teams
- Security admins reviewing reported messages
What will happen:
- Users will see options to report messages as security risks or not security risks.
- Reports will appear on the User reported page in the Defender portal and/or your configured mailbox.
- This feature is opt-in and respects your existing User reported settings.
- Teams admin center toggles for reporting will be automatically enabled when User reported settings are turned on.
- Enable and configure User reported settings in the Defender portal.
- Review message reported destination preferences for reported messages.
- Communicate reporting guidance to users.
- Review supporting documentation.
- Update internal documentation as needed.
Learn more:
- How your submissions to Defender for Office 365 are processed behind-the-scenes | Microsoft Defender for Office 365 Blog
- Turn off or turn on user reporting of Teams messages in the Defender portal | Microsoft Learn
- User reported message settings in Microsoft Teams | Microsoft Defender for Office 365 | Microsoft Learn
No compliance considerations identified. Review as appropriate for your organization.
Change History
Updated February 9, 2026: We have updated the timeline. Thank you for your patience.
[Introduction]
We’re expanding the ability for users to report suspicious Microsoft Teams messages to customers with Microsoft Defender for Office 365 Plan 1. Previously available only to Plan 2, this update helps security teams identify and investigate potential phishing, malware, and spam across internal and external Teams chats, channels, and meeting chats. This enhancement strengthens protection by incorporating user-reported signals into existing Defender detections.
Users will be able to report messages in two ways:
- Report as security risk — for messages suspected to contain phishing, malware, or other malicious content.
- Report as not a security risk — for messages that were incorrectly identified as threats (false positives).
This message is associated with Microsoft 365 Roadmap ID 531760.
[When this will happen]General Availability (Worldwide): Rollout begins in mid-March 2026 (previously mid-February) and is expected to complete in late March 2026 (previously mid-February).
[How this affects your organization]Who is affected:
- Microsoft 365 tenants using Microsoft Defender for Office 365 Plan 1
- Users across Microsoft Teams
- Security admins reviewing reported messages
What will happen:
- Users will see options to report messages as security risks or not security risks.
- Reports will appear on the User reported page in the Defender portal and/or your configured mailbox.
- This feature is opt-in and respects your existing User reported settings.
- Teams admin center toggles for reporting will be automatically enabled when User reported settings are turned on.
- Enable and configure User reported settings in the Defender portal.
- Review message reported destination preferences for reported messages.
- Communicate reporting guidance to users.
- Review supporting documentation.
- Update internal documentation as needed.
Learn more:
- How your submissions to Defender for Office 365 are processed behind-the-scenes | Microsoft Defender for Office 365 Blog
- Turn off or turn on user reporting of Teams messages in the Defender portal | Microsoft Learn
- User reported message settings in Microsoft Teams | Microsoft Defender for Office 365 | Microsoft Learn
No compliance considerations identified. Review as appropriate for your organization.
Updated February 13, 2026: We have updated the timeline. Thank you for your patience.
[Introduction]
We’re expanding the ability for users to report suspicious Microsoft Teams messages to customers with Microsoft Defender for Office 365 Plan 1. Previously available only to Plan 2, this update helps security teams identify and investigate potential phishing, malware, and spam across internal and external Teams chats, channels, and meeting chats. This enhancement strengthens protection by incorporating user-reported signals into existing Defender detections.
Users will be able to report messages in two ways:
- Report as security risk — for messages suspected to contain phishing, malware, or other malicious content.
- Report as not a security risk — for messages that were incorrectly identified as threats (false positives).
This message is associated with Microsoft 365 Roadmap ID 531760.
[When this will happen]General Availability (Worldwide): Rollout begins in late February 2026 (previously mid-March) and is expected to complete by end of February 2026 (previously late March).
[How this affects your organization]Who is affected:
- Microsoft 365 tenants using Microsoft Defender for Office 365 Plan 1
- Users across Microsoft Teams
- Security admins reviewing reported messages
What will happen:
- Users will see options to report messages as security risks or not security risks.
- Reports will appear on the User reported page in the Defender portal and/or your configured mailbox.
- This feature is opt-in and respects your existing User reported settings.
- Teams admin center toggles for reporting will be automatically enabled when User reported settings are turned on.
- Enable and configure User reported settings in the Defender portal.
- Review message reported destination preferences for reported messages.
- Communicate reporting guidance to users.
- Review supporting documentation.
- Update internal documentation as needed.
Learn more:
- How your submissions to Defender for Office 365 are processed behind-the-scenes | Microsoft Defender for Office 365 Blog
- Turn off or turn on user reporting of Teams messages in the Defender portal | Microsoft Learn
- User reported message settings in Microsoft Teams | Microsoft Defender for Office 365 | Microsoft Learn
No compliance considerations identified. Review as appropriate for your organization.
We’re expanding the ability for users to report suspicious Microsoft Teams messages to customers with Microsoft Defender for Office 365 Plan 1. Previously available only to Plan 2, this update helps security teams identify and investigate potential phishing, malware, and spam across internal and external Teams chats, channels, and meeting chats. This enhancement strengthens protection by incorporating user-reported signals into existing Defender detections.
Users will be able to report messages in two ways:
- Report as security risk — for messages suspected to contain phishing, malware, or other malicious content.
- Report as not a security risk — for messages that were incorrectly identified as threats (false positives).
This message is associated with Microsoft 365 Roadmap ID 531760.
[When this will happen]General Availability (Worldwide): Rollout begins in mid-February 2026 and is expected to complete in mid-February 2026.
[How this affects your organization]Who is affected:
- Microsoft 365 tenants using Microsoft Defender for Office 365 Plan 1
- Users across Microsoft Teams
- Security admins reviewing reported messages
What will happen:
- Users will see options to report messages as security risks or not security risks.
- Reports will appear on the User reported page in the Defender portal and/or your configured mailbox.
- This feature is opt-in and respects your existing User reported settings.
- Teams admin center toggles for reporting will be automatically enabled when User reported settings are turned on.
- Enable and configure User reported settings in the Defender portal.
- Review message reported destination preferences for reported messages.
- Communicate reporting guidance to users.
- Review supporting documentation.
- Update internal documentation as needed.
Learn more:
- How your submissions to Defender for Office 365 are processed behind-the-scenes | Microsoft Defender for Office 365 Blog
- Turn off or turn on user reporting of Teams messages in the Defender portal | Microsoft Learn
- User reported message settings in Microsoft Teams | Microsoft Defender for Office 365 | Microsoft Learn
No compliance considerations identified. Review as appropriate for your organization.
Updated February 9, 2026: We have updated the timeline. Thank you for your patience.
[Introduction]
We’re expanding the ability for users to report suspicious Microsoft Teams messages to customers with Microsoft Defender for Office 365 Plan 1. Previously available only to Plan 2, this update helps security teams identify and investigate potential phishing, malware, and spam across internal and external Teams chats, channels, and meeting chats. This enhancement strengthens protection by incorporating user-reported signals into existing Defender detections.
Users will be able to report messages in two ways:
- Report as security risk — for messages suspected to contain phishing, malware, or other malicious content.
- Report as not a security risk — for messages that were incorrectly identified as threats (false positives).
This message is associated with Microsoft 365 Roadmap ID 531760.
[When this will happen]General Availability (Worldwide): Rollout begins in mid-March 2026 (previously mid-February) and is expected to complete in late March 2026 (previously mid-February).
[How this affects your organization]Who is affected:
- Microsoft 365 tenants using Microsoft Defender for Office 365 Plan 1
- Users across Microsoft Teams
- Security admins reviewing reported messages
What will happen:
- Users will see options to report messages as security risks or not security risks.
- Reports will appear on the User reported page in the Defender portal and/or your configured mailbox.
- This feature is opt-in and respects your existing User reported settings.
- Teams admin center toggles for reporting will be automatically enabled when User reported settings are turned on.
- Enable and configure User reported settings in the Defender portal.
- Review message reported destination preferences for reported messages.
- Communicate reporting guidance to users.
- Review supporting documentation.
- Update internal documentation as needed.
Learn more:
- How your submissions to Defender for Office 365 are processed behind-the-scenes | Microsoft Defender for Office 365 Blog
- Turn off or turn on user reporting of Teams messages in the Defender portal | Microsoft Learn
- User reported message settings in Microsoft Teams | Microsoft Defender for Office 365 | Microsoft Learn
No compliance considerations identified. Review as appropriate for your organization.
Never Miss a Microsoft 365 Update
Join thousands of IT professionals who rely on DeltaPulse for real-time Microsoft 365 change intelligence, automated notifications, and community insights.