Microsoft updated the Defender for Office 365 documentation on September 21, 2026: users can now report completed or missed group calls in Microsoft Teams from call history as scam or not scam. Until now, the visible reporting workflow focused mainly on messages and one-to-one calls. For organizations with 10 to 250 users, the change matters because fraud attempts no longer arrive only by email. A short Teams call, a missed callback request, or a supposed support contact can serve the same purpose as a phishing message: build trust, ask for credentials, or prepare remote access. The practical issue is not the button alone. The operating chain behind it must work: Teams policy, Defender setting, reporting mailbox, review process, and clear user guidance need to point in the same direction.
What Microsoft added on September 21
In the Microsoft Defender for Office 365 what’s new article, Microsoft lists expanded user reporting in Teams for September 2026: users can report completed or missed group calls from call history as malicious, meaning scam, or nonmalicious. The detailed Teams reporting page also confirms that Teams desktop, Teams Web App, and the mobile Teams apps support message reporting, while call reports are submitted from call history. Administrators can then view user reported Teams messages and calls in the Defender portal. This brings Teams closer to the familiar Outlook reporting model and reduces the need for users to send screenshots or separate emails to IT when a suspicious collaboration event happens.
Which settings need to align
Microsoft describes two separate controls that work together. If one of them is missing, organizations can end up with false confidence: users might not see the reporting option, or reports might not appear where the security team expects to review them.
- In the Teams admin center, policy controls whether users can report Teams items.
- For messages, “Report a security concern” and “Report incorrect security detections” are the settings to verify.
- For calls, the Calling settings include the “Report a call” toggle.
- In the Microsoft Defender portal, “Monitor reported items in Microsoft Teams” must match the intended workflow.
Why this matters for SMBs
In smaller organizations, email security, Teams administration, telephony, and support often sit with the same IT team. That is why the new Teams reporting capability should not be treated as an isolated feature. If users can report items but nobody reviews the submissions, there is little security value. If reports flow into the User reported page in the existing Defender workflow, recurring patterns become easier to detect: fake support calls, suspicious external contacts, or Teams messages that prepare a later sign-in attempt. This fits a practical Microsoft Defender operations review as well as Microsoft 365 Consulting, where reporting paths and user communication need to be part of the same operating model.
Deadlines, limits, and data handling
Microsoft does not name a retirement deadline for this change. It is a current capability expansion, not a deprecation. The limits are more important: according to Microsoft, user reporting of calls and messages in Teams is not supported in U.S. Government organizations. A submission can also include data directly associated with the item, such as message content, attachments, routing metadata, call metadata, and, for messages, up to fifteen messages before and after the reported item. Microsoft states that this information can be copied for analysis. Organizations should therefore explain the reporting path internally and confirm whether the configured destination, “Microsoft and my reporting mailbox,” “Microsoft only,” or “my reporting mailbox only,” matches their operating and privacy practice.
Practical next steps
- Review global and user-specific Teams policies for message and call reporting in the Teams admin center.
- Check in the Defender portal whether reported Teams items are monitored and visible on the User reported page.
- Treat the reporting mailbox as a SecOps mailbox and avoid DLP or simulation conflicts.
- Tell users when a Teams call should be reported as scam and that the caller is not notified.
- Include the first reports in a Microsoft Security Assessment or recurring Defender review.
Official Microsoft sources
- Microsoft Learn: What’s new in Microsoft Defender for Office 365
- Microsoft Learn: User reported settings in Teams
- Microsoft Learn: Configure user reported message settings
If you want Teams reporting, Defender review, and user communication to work together, we review the settings as part of a Microsoft Defender for Endpoint or Microsoft 365 security check – get in touch.
What does this mean for your environment?
Assess the topic in the context of your Microsoft 365 environment and define a practical next step.
You speak directly with Sebastian Kerssen – working in the Microsoft ecosystem since 2014, with personal consulting and a dedicated point of contact.
