Added support for contextual Teams messages in User reported Teams Messages
Analysis / inference: Microsoft Defender for Office 365 now includes up to fifteen preceding and succeeding contextual messages when users report suspicious Teams items.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Defender for Office 365 - What's new · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Microsoft updated the user reported messages feature in Microsoft Teams to include up to fifteen messages before and after the flagged message from chats, standard/shared/private channels, and meeting conversations.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisEnabling the capture of contextual Teams messages around a user-reported item provides analysts with critical conversational history during incident triage.
Security analysts gain broader context around reported Teams chats, reducing the need for manual follow-up with users to understand the conversation history.
Section 03 · Recommended actions
- Familiarize SOC analysts with the new contextual message viewing capabilities in Microsoft Defender.
- Ensure standard organization guidelines for reporting malicious Teams content are communicated to end users.
- Verify that user reporting workflows for Microsoft Teams messages across chats, channels, and meetings are configured correctly in your tenant.
- Review incoming reported message payloads in Microsoft Defender to confirm contextual message history is populating.