Microsoft Defender XDR: Investigate suspicious Microsoft Teams calls and meetings with advanced hunting

[What and why]

When investigating a suspicious Microsoft Teams call or meeting, your security team needs to understand what happened, who initiated the activity, and the organization associated with the initiator.

The CallActivityEvents table in Microsoft Defender XDR advanced hunting provides visibility into activities performed during Teams calls and meetings in your organization. Security teams can use this information to investigate suspicious activity, review related messages, and correlate findings with other security signals.

This capability is available to organizations with Microsoft Defender for Office 365 Plan 2. 

[Rollout schedule]

• General Availability (Worldwide): Beginning in early November 2026 and expected to complete by mid-November 2026

[Impact on your organization]

Who is affected

• Security operations and threat hunting teams in organizations with Microsoft Defender for Office 365 Plan 2

Platforms and services

• Microsoft Defender XDR advanced hunting
• Microsoft Teams

What will happen

Your security team can use the CallActivityEvents table on the Advanced hunting page in the Microsoft Defender portal to:

• Understand what happened by reviewing activities performed during Teams calls and meetings, including whether an activity succeeded or failed and whether it was performed on the initiator or another participant.
• Investigate who initiated an activity by reviewing the initiator's identity, account and membership types, organization, tenant region, and Teams client platform.
• Identify the organizer by reviewing the identity and tenant of the user who organized the call or meeting.
• Review related messages by joining CallActivityEvents with the MessageEvents table using ThreadId to examine recorded messages exchanged in the associated call or meeting chat.
• Broaden investigations by correlating call and meeting activity with other available advanced hunting data.
• Call and meeting activity data will also be available through the event streaming API and Microsoft Sentinel API, allowing security teams to incorporate the data into existing security monitoring and investigation workflows.

[Action required and recommendations]

Share this update with your security operations and threat hunting teams.

We recommend that you:

• Review the CallActivityEvents schema and identify how call and meeting activity can support your existing Teams investigation workflows.
• Ensure analysts who will use this capability have appropriate advanced hunting access. Microsoft documents that permissions are required to run advanced hunting queries.
• If your organization uses the event streaming API or Microsoft Sentinel API, review your data ingestion configuration and plan to incorporate call and meeting activity into your existing workflows.

Learn more

• Advanced hunting - Microsoft Defender
• Advanced hunting overview in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learn
• CallActivityEvents table in the advanced hunting schema - Microsoft Defender | Microsoft Learn
• MessageEvents table in the advanced hunting schema - Microsoft Defender XDR | Microsoft Learn
• Security Operations Guide for Teams protection - Microsoft Defender for Office 365 | Microsoft Learn

[Compliance considerations]

No compliance considerations identified. Review as appropriate for your organization.