Microsoft is boosting threat detection by extending Microsoft Defender for Office 365 (MDO) URL click alerts into Microsoft Teams.
This update lets security teams spot, probe, and block risky link clicks in Teams messages. It moves beyond email threats to catch dangers earlier and stop attackers from spreading sideways in networks.
Key Feature Enhancements
Two MDO alerts now fire for Teams: “A user clicked through to a potentially malicious URL” and “A potentially malicious URL click was detected.”
These pop up on the Microsoft Defender alerts page with the full Teams message as evidence. Analysts skip platform-hopping for faster checks.
Teams signals join incident correlation too, linking threats across tools automatically. Researcher Steven Lim notes no user changes needed, but SOC efficiency jumps. Automated Investigation and Response (AIR) skips these alerts for now.
| Category | Description and Eligibility Requirements |
|---|---|
| Eligible Licenses | Microsoft Defender for Office 365 Plan 2 or Microsoft 365 E5 |
| Security Teams | Admins and SOC analysts in Microsoft Defender portal |
| End Users | Anyone sending/receiving Teams messages with URLs |
| System Status | Enabled by default; no activation needed |
| Release Phase | Rollout Start Date | Expected Completion Date |
|---|---|---|
| Public Preview (Worldwide) | Late February 2026 | Early March 2026 |
| General Availability (Worldwide) | Early March 2026 | Mid-March 2026 |
| General Availability (GCC, GCCH, DoD) | Early May 2026 | Late May 2026 |
Feature rolls out by tenant type. Update playbooks now for Teams signals.
Hunt Teams URL clicks in Microsoft Defender XDR’s Advanced Hunting:
texttextAlertEvidence
| where Timestamp > ago(1h)
| where ServiceSource == @"Microsoft Defender for Office 365"
| where EntityType == @"Url"
| where Title has "Teams"
Pipe to email or Teams channels for alerts.
Action Items for Security Teams
- Update SOC docs for Teams message analysis.
- Train analysts on new alerts.
- Add KQL to rules for auto-notifications.
This closes a Teams blind spot, sharpening visibility against phishing and malware.
Follow us on Google News, LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google
%20(1)%20(1).webp?fit=1600,900&ssl=1&description=This update lets security teams spot, probe, and block risky link clicks in Teams messages. It moves beyond email threats){kind=link}