Solution · MailGuard

Detect phishingin Teams and warnright in the chat.

Attacks also arrive through Teams. Conbool MailGuard checks new messages in chats and channels and warns those affected where they are reading.

Request a demoMailGuard in detail

Why Teams is a way in

Chat lacks what the mailbox has had for years.

Chat with outsiders

By default, users can chat with other organizations. Attackers use this, for example posing as IT support.

No filter in front

A chat message passes through no mail gateway. A spam filter in the mail flow does not see it.

Links in images

A QR code in an image only reveals its link when scanned, often on a personal phone.

Trust in chat

Hardly anyone expects fraud in chat. A message there feels more personal than any email.

How Teams protection works

Consent, check, warn.

1. Consent once

A global administrator grants the permissions. No software on devices, no change to the mail flow.

2. Check messages

MailGuard checks new and edited messages. You can catch up on delivered ones for the last 14 days.

3. Warn and decide

Those affected are warned if you switch this on. Your IT team sees the finding with its reason under Incidents.

One message, four checksExample

IT support (External)

Your account expires today. Please confirm here:

https://your-cornpany.com/sign-in

Edited

  • Role title in the nameSender
  • Looks like your-company.comLink
  • Link comes from a QR code in an imageImage
  • Message was edited after sendingEdit
The whole message

Attacks are not only in the link.

Sender, link, image and later edits: MailGuard gives the reason for every finding.

Domains resembling your own or a known one

QR codes in images

Domains with a bad reputation and blocked addresses

Dangerous file types

What Teams protection does

Detect, warn, report, act.

Warning directly in Teams

The Conbool Sicherheit app warns by direct message, and optionally visibly in the group chat. The warnings are currently in German.

No E5 licence needed

Detection, warnings and reporting work without an E5 licence.

Reporting from Teams

The “An IT melden” action sends a suspicious message to your IT team. The sender is not told.

External senders

First contact from an organization, job titles in the name and requests for remote access or credentials stand out.

Taking action

Remove the sender from a group chat, delete the chat or end the sign-ins of a compromised account.

Report for administrators

What was detected and what happened, per period and as a table without message text.

Teams protection alongside Microsoft link protection

The two work side by side. This is what it adds.

 
Conbool MailGuard
Microsoft, as it describes itself
Known malicious link
Finding in the portal and a warning to those affected
Warning notice on the message
Similar domain
Compared with your domain and known domains
Not described for link protection
QR code in an image
Read and checked
Not described for link protection
Reporting by employees
“An IT melden”, finding in the Conbool portal
With Defender for Office 365 Plan 2 or Defender XDR
Removal from the chat
Remove the sender or delete the chat; a single message not without an E5 licence
With Defender for Office 365, Plan 1 or 2
Overview for administrators
Incidents and report in the Conbool portal
In the Microsoft Defender portal, depending on licence

As of November 2026, based on Microsoft documentation. Microsoft may change this.

FAQ on phishing in Microsoft Teams

Does Conbool read our Teams messages?
Yes, to check them, and only after your consent. Findings are stored, message text is not.
Do we need an E5 licence?
Not for detection, warnings and reporting. Hiding a single message requires an E5-class licence from Microsoft.
Can MailGuard remove a message from the chat?
Not without an E5 licence; Microsoft does not allow any app to change the text of someone else's message. The message stays visible, which is why MailGuard warns those affected.
Do employees have to install anything?
No. An administrator uploads the Teams app once in the Teams admin center and deploys it from the portal. Without the app the warning arrives by email. The warnings and the action name are currently in German.
Where does the red notice on a message come from?
That is Microsoft's built-in link protection. MailGuard warnings come from the Conbool Sicherheit app. The two work independently.
Does protection cover channels too?
Yes, chats and channels. You can apply it to all users or to selected groups.
Does Teams protection run on your own server?
No, Teams protection is available in the cloud only.
What happens with a false alarm?
Your IT team dismisses the finding or trusts the domain. Once a domain is trusted, links to it are no longer reported.

Related solutions

Falscher IT-Support

Erst die Mailflut, dann der Chat: Mail und Teams zusammen betrachten.

Conbool Mail

Das Postfach dazu: Grundschutz in jedem Plan, betrieben in Deutschland.

Hornetsecurity-Alternative

Deutsche MailGuard-Alternative nach der Proofpoint-Übernahme.

Barracuda-Alternative

Module je Postfach statt Planstufen, deutscher Vertragspartner.

Phishing-Schutz

BEC, Spear-Phishing und QR-Code-Phishing erkennen und entfernen.

Phishing-Simulation

Was durch den Filter kommt, mit dem Team üben statt hoffen.

Ransomware-Schutz E-Mail

Mehrstufige Anhang-Filter und URL-Reputation gegen Ransomware-Kampagnen.

Spam-Filter Unternehmen

Spam und unerwünschte Massenmail mit DACH-Heuristiken filtern.

CEO-Fraud-Schutz

BEC und CEO-Fraud-Attacken über Authentifizierungs-Layer abwehren.

DANE und TLSA

Manipulationssichere Transportverschlüsselung nach BSI TR-03108, gegen Downgrade und MITM.

Directory-Harvesting-Schutz

Abwehr von Adress-Sammlern, bevor gültige Postfächer in Spam-Datenbanken landen.

Make phishing in Teams visible.

Consent once, check messages, warn those affected.

Request a demoMailGuard in detail