A new QR code safety feature designed to reduce phishing and fraud risks in chats involving external users.
As documented by Microsoft, the capability will, by default, obscure images containing QR codes when sent by external participants, requiring recipients to deliberately reveal the image before they can view or scan the code.
Listed as in development on the Microsoft 365 roadmap, the feature is scheduled to begin rolling out in October 2026.
Microsoft Teams Adds QR Code Protection
Microsoft has assigned the update Roadmap ID 570439 and plans to make it available worldwide across Teams desktop, web-associated desktop experiences, Android, iOS, and Mac platforms.
QR codes are increasingly used as a social-engineering delivery mechanism because they can conceal a destination URL from the user until it is scanned.
An attacker can place a malicious QR code inside what appears to be an ordinary image, invoice, onboarding document, support request, or collaboration message.
Microsoft’s planned Teams protection introduces friction before a QR code received from an external sender can be acted upon. Rather than displaying the QR image in the chat immediately, Teams will obscure it by default.
Users who need to inspect the content must explicitly reveal the image before viewing or scanning it. This approach is intended to encourage a pause before users interact with QR-based content.
The additional step may help employees notice that a message originated outside their organization, reconsider whether the sender is trusted, and validate the context before scanning a code with a mobile device.
The protection specifically applies to QR-code images shared by external users in Teams messages. External communication can include conversations with guest users, partner organizations, vendors, contractors, or other contacts outside the recipient’s tenant.
By focusing on external senders, Microsoft is targeting a common trust boundary in enterprise collaboration environments.
External messaging is essential for business operations, but it can also expose users to impersonation attempts and malicious content distributed from compromised or attacker-controlled accounts.
The feature does not prevent users from accessing legitimate QR codes. Instead, it changes the default behavior for externally delivered QR images, making the content hidden until the recipient chooses to reveal it.
Microsoft expects to begin deployment in October 2026 through both Targeted Release and General Availability phases. The feature will be available in the Worldwide Standard Multi-Tenant cloud environment.
Organizations should review their Teams external-access and guest-access settings before the rollout begins.
Security teams may also want to update user-awareness guidance to explain why QR images from external contacts appear obscured and why employees should validate unexpected codes before revealing or scanning them.
The upcoming control adds another protective layer to Teams messaging, particularly as phishing campaigns increasingly move beyond conventional email links and attachments.
By making QR code interactions more intentional, Microsoft aims to reduce the likelihood that users scan deceptive content before recognizing the associated risk.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
