MC1478463 High Major change
Microsoft Defender for Office 365: Teams user reporting enabled by default
Summary AI-generated
Microsoft Defender for Office 365 will enable Teams user reporting by default, letting users report suspicious messages, calls, and meetings to help detect security threats.
Suggested actions AI-generated
- Review Teams user-reported settings in Microsoft Defender portal
- Decide submission destination for user-reported content
- Opt out before October 25, 2026, if desired
- Inform security administrators and help desk staff
Written by Azure OpenAI (gpt-4.1) from the text of the post below. It can be incomplete or wrong; the original post is authoritative.
Similar posts
Search for more like this- MC1147984 (Updated) Microsoft Teams: User reporting for incorrectly identified security concerns
- MC1446794 Microsoft Teams: Report security concerns in Teams meetings
- MC1219788 (Updated) Microsoft Defender for Office 365: Enable users to report suspicious Teams messages in Plan 1
- MC1447673 Microsoft Teams: Users can report security concerns in group calls
- MC1466296 Microsoft Teams: Report security concerns in meetings
- MC1223828 Microsoft Teams: Report a suspicious call
Original post from Microsoft
[What and why]
To help organizations identify and respond to security threats in Microsoft Teams, Microsoft Defender for Office 365 will enable Teams user reporting by default. Users can report suspicious messages, calls, and meetings, helping organizations improve detection of phishing, spam, impersonation, malicious content, and other threats.
This capability is available for organizations licensed for Microsoft Defender for Office 365 Plan 1 or Plan 2, Microsoft 365 E5, or Office 365 E5.
[Rollout schedule]
- General Availability (Worldwide): Beginning in late October 2026 and expected to complete by late October 2026
[Impact on your organization]
Who is affected
- Organizations licensed for Microsoft Defender for Office 365 Plan 1 or Plan 2, Microsoft 365 E5, or Office 365 E5
- Microsoft Teams and security administrators
- Teams users in affected organizations
Platforms/Services
- Microsoft Teams
- Microsoft Defender portal
- Microsoft Defender for Office 365
What will happen
- Users can report suspicious messages, calls, and meetings directly from Teams. Reported content is submitted per your configured reported destination for security analysis.
- Security risk items can include phishing, spam, impersonation, malicious content, and phishing URLs.
- Beginning October 7, 2026, Teams user-reported settings will be managed on a dedicated page in the Microsoft Defender portal.
- If you have already configured Teams user-reported settings, your existing settings will be carried over. Changes made after migration may not be reflected until the week of October 15, 2026.
- If you have not already configured Teams user-reported settings, Teams user reporting will be enabled by default beginning October 25, 2026, unless you opt out.
Image 1 - Teams user reported settings view:
Image 2 - Email user reported settings view:
[Action required/Recommendations]
Review your Teams user-reported settings before October 25, 2026, if you do not want Teams user reporting enabled by default or want reported content sent to a destination other than Microsoft.
Recommended actions:
- Review Teams user-reported settings in the Microsoft Defender portal.
- Decide whether user-reported Teams content should be submitted to Microsoft for security analysis.
- Opt out before October 25, 2026, if desired.
- Inform security administrators and help desk staff about this change.
Learn More
- Email user-reported settings: security.microsoft.com/securitysettings/userSubmission
- Teams user-reported settings: security.microsoft.com/securitysettings/teamsUserSubmission
- User reported settings in Teams - Microsoft Defender for Office 365 | Microsoft Learn
[Compliance considerations]
| Question | Answer |
| Does the change alter how admins can monitor, report on, or demonstrate compliance activities? | Teams user-reported settings will move to a dedicated configuration page in the Defender portal. |
| Does the change include an admin control, and can it be controlled through Entra ID group membership? | Administrators can opt out by configuring Teams user-reported settings in the Defender portal. Group-based controls are not specified. |
Additional details from Microsoft
- Summary
- Microsoft Defender for Office 365 will enable Teams user reporting by default starting late October 2026 for licensed organizations. Users can report suspicious Teams content to improve threat detection. Admins can review or opt out via a dedicated Defender portal page before October 25, 2026.