Expanding user reporting in Teams to include meetings
Analysis / inference: Microsoft Teams now allows users to report scheduled meetings, impromptu sessions, and individual participants as security concerns.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Defender for Office 365 - What's new · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Microsoft Defender for Office 365 updated user reporting capabilities in Microsoft Teams to include scheduled or Meet Now meetings, individual meeting participants, and false positive reports for incorrectly flagged participants.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisThis feature expands attack surface visibility into Microsoft Teams by allowing end users to flag suspicious meetings and participants directly, routing metadata to designated reporting mailboxes or Microsoft for security triage.
SOC teams will see an influx of new user-submitted alerts regarding suspicious Microsoft Teams meetings, requiring updated triage playbooks.
Section 03 · Recommended actions
- Review and update Teams user-reported message settings
- Validate that reported meeting metadata successfully reaches the designated reporting mailbox
- Update SOC investigation playbooks to account for Teams meeting and participant user submissions
- Verify Teams user-reported settings and check if designated reporting mailboxes are properly receiving the newly supported meeting and participant metadata.