MC1219794 – M365 Change Digest

One-line summary

Teams admins can now access an External domains anomalies report to detect and manage unusual cross-tenant communication, with proactive alerting options in Teams admin center.

Similar updates

Details

RoadmapIds

536572

FeatureStatusJson

{"536572":[{"RoadmapId":536572,"Platform":"Web","Status":"Launched","LastUpdateTime":"2026-05-14T03:00:20.2966971Z","LatestRing":"StandardRelease"},{"RoadmapId":536572,"Platform":"All","Status":"Launched","LastUpdateTime":"2026-05-14T03:00:20.2966971Z","LatestRing":"StandardRelease"}]}

Summary

Microsoft Teams will roll out the External domains anomalies report by late May 2026, enabling admins to detect unusual external communication patterns. The report, in the Teams admin center, highlights anomalies and offers a block option. Admins can enable alerts for proactive notifications; no action is needed to access it.

Platforms

Web

Body (from Message Center)

Updated March 27, 2026: We have updated the timeline. Thank you for your patience.

[Introduction]

To help admins detect unusual or potentially risky interactions with external organizations, Microsoft Teams is introducing the External domains anomalies report. This report analyzes cross-tenant communication patterns for your tenant and highlights sudden spikes or abnormal engagement activity. These insights support proactive investigation and help protect your organization while enabling secure external collaboration.

This message is associated with Microsoft 365 Roadmap ID 536572.

[When this will happen]

General Availability (Worldwide): Rolling out in mid-May 2026 (previously early April) and expected to complete by late May 2026 (previously mid-April).

[How this affects your organization]

Who is affected:

Teams administrators can view this report for their Microsoft 365 tenant if their organization collaborates with external organizations.

What will happen:

A new External domains anomalies report will be available in the Microsoft Teams admin center under Protection reports.
Admins can select Communication anomalies, choose a date range, and run the report to view results:
Insights include external domains with unusual communication activity:
- External domain name
- Total anomalies detected
- New 1:1 threads created by that domain
- New group threads created by that domain
A Block option is available directly in the report for managing external domains:

user settings

[What you can do to prepare]

No action is required to access the report.

To receive proactive alerts:

Enable External domains anomalies alerts in the Teams admin center:
- Go to Notifications & alerts > Rules.
- Select External domains anomalies.
- Set status to Active.
Specify a Teams channel for notifications if desired.

user settings

Daily alerts will summarize the top five domains with unusual activity.

user settings

[Compliance considerations]

No compliance considerations identified. Review as appropriate for your organization.

Raw JSON (for debugging)

Expand/collapse the full payload below.

Show/hide raw

{
  "snapshot_item": {
    "action_required_by": null,
    "ai_action_required_by": "2026-03-01T00:00:00Z",
    "ai_actions": [
      "Review new External domains anomalies report",
      "Enable alerts in Teams admin center if desired"
    ],
    "ai_master_tags": [
      "Admin",
      "Security"
    ],
    "ai_model": "gpt-4.1",
    "ai_summary": "Teams admins can now access an External domains anomalies report to detect and manage unusual cross-tenant communication, with proactive alerting options in Teams admin center.",
    "ai_topics": [
      "Teams"
    ],
    "category": "stayInformed",
    "details_map": {
      "FeatureStatusJson": "{\"536572\":[{\"RoadmapId\":536572,\"Platform\":\"Web\",\"Status\":\"Launched\",\"LastUpdateTime\":\"2026-05-14T03:00:20.2966971Z\",\"LatestRing\":\"StandardRelease\"},{\"RoadmapId\":536572,\"Platform\":\"All\",\"Status\":\"Launched\",\"LastUpdateTime\":\"2026-05-14T03:00:20.2966971Z\",\"LatestRing\":\"StandardRelease\"}]}",
      "Platforms": "Web",
      "RoadmapIds": "536572",
      "Summary": "Microsoft Teams will roll out the External domains anomalies report by late May 2026, enabling admins to detect unusual external communication patterns. The report, in the Teams admin center, highlights anomalies and offers a block option. Admins can enable alerts for proactive notifications; no action is needed to access it."
    },
    "id": "MC1219794",
    "importance": 4,
    "is_major_change": false,
    "last_modified": "2026-05-13T18:11:29Z",
    "ms_products": [
      "Teams"
    ],
    "platforms": "Web",
    "roadmap_ids": [
      "536572"
    ],
    "services": [
      "Microsoft Teams"
    ],
    "severity": "normal",
    "tags": [
      "Updated message",
      "New feature",
      "User impact",
      "Admin impact"
    ],
    "title": "(Updated) Microsoft Teams: External domains anomalies report"
  }
}