MC1536056 - Microsoft Teams: Facilitator Protection skill helps identify suspected social-engineering attempts

Microsoft 365 Message Center announcement MC1536056.

MS Message Center's Summary

Microsoft Teams is introducing a new artificial intelligence capability designed to detect social engineering attempts during meetings involving external participants by reviewing transcripts. Rolling out worldwide from late January to mid February 2027, this feature automatically alerts users with options to end the session or limit information sharing. Administrators should review internal documentation and inform their user base about these upcoming security prompts before the rollout begins.

Administrator impact
Review internal guidance and prepare support teams for user queries regarding new meeting security warnings.
End user impact
Users will see automated warnings and remediation choices during meetings when potential social engineering threats are identified in transcripts.
Importance
4/10: This is a standard feature rollout introducing automated security warnings that require user awareness but no immediate administrator configuration.

Microsoft Summary

Microsoft Teams' Facilitator Protection skill uses AI to detect suspected social-engineering attempts in meetings with external participants by analyzing transcripts. If detected, users receive warnings with options to end the meeting or restrict sharing. It rolls out worldwide from late January to mid-February 2027, requiring no user action.

Message Center ID
MC1536056
Category
stay Informed
Severity
normal
Services
Microsoft Teams
Tags
New feature, User impact, Admin impact
Roadmap ID
573450
Platforms
Desktop, Mac
Published
2026-11-03
Last updated
2026-11-03
Expires
2027-03-12

[What and why] Facilitator can help users identify suspected social-engineering attempts by people outside their organization during a meeting. When Facilitator is present, its Protection skill uses AI to check the meeting transcript for signs that someone may be attempting to trick users into sharing sensitive information. If a suspected attempt is detected, users will see a warning with options to end the meeting or temporarily restrict information sharing. This feature can help organizations reduce the risk of sensitive information being disclosed through social engineering during meetings with external participants. [Rollout schedule] General Availability (Worldwide): Beginning in late January 2027 and expected to complete by mid-February 2027 [Impact on your organization] Who is affected Users who use Facilitator in meetings with participants outside their organization Platforms and services Microsoft Teams Facilitator What will happen When Facilitator is present in a meeting with participants outside your organization, the Protection skill is invoked automatically. The Protection skill uses AI to check the meeting transcript for signs of suspected social-engineering attempts. If a suspected attempt is detected, users will receive a warning. Users will have options to end the meeting or temporarily restrict information sharing. No action is required to enable the Protection skill. [Action required and recommendations] No action is required to enable the Protection skill. We recommend that you: Inform users that they may receive warnings about suspected social-engineering attempts during meetings with external participants. Help users understand the available options if a warning appears. Review the Facilitator documentation to familiarize yourself with the feature. [Compliance considerations] This change introduces an AI capability that interacts with customer data. When Facilitator is present, the Protection skill uses AI to check the meeting transcript for signs of suspected social-engineering attempts.