Skip to content

Email & collaboration this week: 6 changes (31 October 2026)

Six confirmed Teams and Defender for Office 365 changes from the week to 31 October 2026. Most need no switch flipped, but the helpdesk and your user guidance need to know before they land.

This is our weekly Email & collaboration roundup. It was due on Friday 30 October and is published a day late. Every item was re-read on its primary source on 31 October 2026.

Already briefed

  1. Teams chats with external organisations: file sharing turns on by default. Microsoft asks you to set the policy "by the first week of November". Teams admins. Brief: Teams external chat file sharing. Source: MC1479514.

New this week

Teams phishing detection in chats: Targeted Release early November, GA December 2026

Targeted Release "Beginning in early November 2026 and expected to complete by mid-November 2026"; General Availability "Beginning in early December 2026 and expected to complete by mid-December 2026".

  • Who acts: Teams admins and the helpdesk. No admin configuration.
  • Check: your user guidance says how to report a wrongly flagged message and how to treat unfamiliar external contacts.
  • Source: MC1519866.

Teams malicious QR code detection, early to mid-November 2026, on by default

GA from early November, finishing mid-November 2026. "No admin action is required." The setting "is enabled by default" and follows the existing Malicious URL protection setting.

  • Who acts: Teams admins.
  • Check: Malicious URL protection is on in the Teams admin center. The QR setting follows it.
  • Source: MC1526651.

Users can report suspicious guest invitations, early to mid-November 2026

GA "early November 2026" to "mid-November 2026". Managed at Teams admin center > Messaging policies > Report a security concern.

  • Who acts: Teams admins; SecOps decides who triages the reports.
  • Check: the messaging policy setting matches where your reported messages already go.
  • Source: MC1530615.

Teams meeting impersonation protection, mid to late December 2026

GA "mid-December 2026" to "late December 2026". "No immediate admin action is required."

  • Who acts: nobody yet. Tell the helpdesk before December so a new warning in a meeting isn't a surprise.
  • Source: MC1530613.

Defender for Office 365 Plan 2: move email to quarantine as a remediation action

GA "Beginning in early November 2026 and expected to complete by mid-December 2026". Needs Defender for Office 365 Plan 2. "The Search and Purge role is required to approve remediation actions."

  • Who acts: SecOps.
  • Check: who holds Search and Purge, and which quarantine policy applies. If it lets users release messages, a quarantined phish can come back.
  • Source: MC1523084. Related: Exchange Online Protection Kit.

More: all Email & collaboration news · Microsoft 365 security deadlines.

Last reviewed: 31 October 2026. Runbook Lab is not affiliated with Microsoft.