Teams protection: detecting dangerous messages in Microsoft Teams and warning those affected

Attacks do not only arrive by email. Teams protection checks messages in chats and channels for dangerous links, external senders and fraud patterns. Findings appear in the portal under Incidents, on the Teams tab.

Setting it up

1. Open Settings > MailGuard and go to Teams protection.
2. Switch Teams protection on and grant consent to the permissions as a global administrator.
3. Choose how protection responds to a finding. By default it only reports.

Protection only becomes active once an administrator in your organization has switched it on and granted consent.

Warning directly in Teams

With Warn those affected, MailGuard informs the chat members from your organization, never the sender. Without further setup the warning arrives by email. It appears directly in Teams once the Teams app Conbool Sicherheit is available in your tenant. You do not need your own bot or an Azure subscription.

1. Download the Teams app. Do not unzip the file.
2. Open the Teams admin center and go to Teams apps > Manage apps.
3. Choose Upload new app and select the ZIP file.
4. Check that Conbool Sicherheit is listed as Allowed.
5. Switch on Warn those affected in the settings.

The settings then state that the warning arrives directly in Teams. If they still mention email, renew the consent. Uploading requires your policies to allow custom apps.

MailGuard installs the app for the recipient itself when a warning is due. The app receives nothing and stores nothing, and it cannot be replied to.

What you can do with a finding

Deleting and restoring a chat

In an open Teams client a deleted chat stays visible for a while, but sending there no longer works. Warn those affected anyway.

When restoring, MailGuard adds your organization's members to the chat again so it reappears for them in Teams. The chat shows a note for each member. The history stays complete. Participants may not see a one-to-one chat again straight away.

Limits

Microsoft does not allow any app to change the text of someone else's message. A single message can only be hidden with an E5 licence, and not at all for senders from another organization. You can block such senders in Teams under External access.

Notifications

Every new finding appears for administrators in the bell. The email to alert recipients has a button that leads directly to the incident in the portal. It deliberately names neither the domain nor the sender's name, so that filters do not rate our message because of the dangerous address. The details are in the portal.

Permissions