Microsoft published a writeup last month about an attack that starts with a Teams message from someone your team has never met.
Here's the setup. In most Microsoft 365 tenants, Teams is configured so that anyone outside your firm can start a chat or a call with your people. That's a feature — it's how you reach opposing counsel or a client without adding them to your tenant. It's also an open door.
The attackers walk through it posing as IT support. "Microsoft Security Update." "Account verification." They get a paralegal on a call, ask her to share her screen or open Quick Assist, and then they're driving her laptop. In the cases Microsoft documented, it didn't stop at one machine.
Teams does flag these people. There's an external label and an accept-or-block prompt before the first message lands. Microsoft is blunt that the attack works anyway, because a busy person clicks through the warning.
Two fixes, neither of which costs anything. Restrict Teams external access to the domains you actually work with — Microsoft's own guidance is trusted domains only. And tell your team out loud that real IT never cold-calls them on Teams.
Worth a look before your next cyber renewal. It's about ten minutes in the admin center.
Want the next one in your inbox?
One practical Microsoft 365, Copilot, Azure, or security move per week — plain English, no pitch.
Subscribe via email