Microsoft Defender for Office 365: Teams user reporting enabled by default

What and why

To help organizations identify and respond to security threats in Microsoft Teams, Microsoft Defender for Office 365 will enable Teams user reporting by default. Users can report suspicious messages, calls, and meetings, helping organizations improve detection of phishing, spam, impersonation, malicious content, and other threats.

This capability is available for organizations licensed for Microsoft Defender for Office 365 Plan 1 or Plan 2, Microsoft 365 E5, or Office 365 E5.

Rollout schedule

• General Availability (Worldwide): Beginning in late October 2026 and expected to complete by late October 2026

Impact on your organization

Who is affected

• Organizations licensed for Microsoft Defender for Office 365 Plan 1 or Plan 2, Microsoft 365 E5, or Office 365 E5
• Microsoft Teams and security administrators
• Teams users in affected organizations

Platforms/Services

• Microsoft Teams
• Microsoft Defender portal
• Microsoft Defender for Office 365

What will happen

• Users can report suspicious messages, calls, and meetings directly from Teams. Reported content is submitted per your configured reported destination for security analysis.
• Security risk items can include phishing, spam, impersonation, malicious content, and phishing URLs.
• Beginning October 7, 2026, Teams user-reported settings will be managed on a dedicated page in the Microsoft Defender portal.
• If you have already configured Teams user-reported settings, your existing settings will be carried over. Changes made after migration may not be reflected until the week of October 15, 2026.
• If you have not already configured Teams user-reported settings, Teams user reporting will be enabled by default beginning October 25, 2026, unless you opt out.

Image 1 - Teams user reported settings view:

Image 2 - Email user reported settings view:

Action required/Recommendations

Review your Teams user-reported settings before October 25, 2026, if you do not want Teams user reporting enabled by default or want reported content sent to a destination other than Microsoft.

Recommended actions:

• Review Teams user-reported settings in the Microsoft Defender portal.
• Decide whether user-reported Teams content should be submitted to Microsoft for security analysis.
• Opt out before October 25, 2026, if desired.
• Inform security administrators and help desk staff about this change.

Learn More

• Email user-reported settings: security.microsoft.com/securitysettings/userSubmission
• Teams user-reported settings: security.microsoft.com/securitysettings/teamsUserSubmission
• User reported settings in Teams - Microsoft Defender for Office 365 | Microsoft Learn

Compliance considerations