Expanding User reporting in Teams to include Calls
Analysis / inference: Microsoft Defender for Office 365 now allows users to report completed or missed one-to-one Microsoft Teams calls as malicious or non-malicious.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Defender for Office 365 - What's new · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
End users can now flag completed or missed one-to-one Microsoft Teams calls from their call history as scam or non-scam, routing these submissions to the specified reporting mailbox or Microsoft depending on configuration.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisThis feature extends user-submission capabilities for Microsoft Teams to encompass completed or missed one-to-one calls, giving SOC teams visibility over reported suspicious telephony interactions alongside emails and chats.
Security Operations teams will receive new report types originating from Microsoft Teams call history, requiring inclusion in standard phishing and abuse triage playbooks.
Section 03 · Recommended actions
- Review and update SOC triage workflows to account for user-reported Microsoft Teams calls.
- Check user reporting configuration settings in the Microsoft Defender portal.
- Verify current user reporting settings in the Microsoft Defender portal for Teams messages and calls.
- Confirm the designation of the reporting mailbox configured to receive Teams call reports.