Microsoft is expanding Teams reporting to cover meetings and individual participants. The Defender for Office 365 release notes list the change for October 2026. For organizations with 10 to 250 employees using Teams and the relevant Defender capabilities, this creates a task: check meeting reporting, establish a monitored destination, and explain reporting to staff. This differs from reporting completed group calls through call history. Meetings have a separate policy and reporting entry points beside a participant.
What users can report
Microsoft says users can report scheduled meetings, Meet now meetings, and individual participants as security concerns during or after a meeting. When a participant is incorrectly identified as suspicious, users can also provide feedback that the participant is not a security concern. A report supplies investigation context for security administrators; it does not replace their assessment.
During a meeting, users open the reporting dialog through the More menu. They can report a participant through the three-dot menu on the participant tile or in the roster. Reporting is also available after the meeting. Microsoft’s instructions use different menu labels, so check the presentation in your organization’s client.
Which settings must work together
Microsoft documents separate settings in Teams and Defender. An available reporting dialog alone therefore does not demonstrate a working review process. When checking an existing Microsoft Defender deployment, these four points matter:
- In the Teams admin center, Allow users to report meetings controls reporting for meetings and participants.
- In the Defender portal, Monitor reported items in Microsoft Teams must align with enabled Teams reporting.
- The Teams user reported settings page determines whether reports go to Microsoft, your reporting mailbox, or both destinations.
- User reporting requires an online Teams mailbox; the configured reporting mailbox must also be hosted in Exchange Online.
Microsoft describes the Defender setting as enabled by default for new tenants; existing tenants need to enable it. Check the configuration rather than assuming every established tenant is configured correctly. On-premises Exchange mailboxes are not supported for either documented mailbox role.
Deadlines and availability without artificial urgency
The release notes specify October 2026, but provide neither an exact introduction day nor a mandatory activation deadline. Their documentation date of October 15 falls within this review period; it should not be treated as a universal rollout date. Microsoft does not announce a shutdown of existing reporting paths for this expansion. A planned functional check is appropriate, not a rushed migration driven by an invented deadline.
The technical instructions list Teams desktop and the Teams Web App as supported clients. Mobile Teams apps are explicitly listed for message reporting only. Meeting reporting from a smartphone should therefore not be promised as a documented capability. Microsoft also excludes user reporting for calls, meetings, and messages in the specified US Government environments.
Decide how metadata and review are handled
Depending on the destination configuration, meeting and participant metadata is sent to Microsoft, your own mailbox, or both. For submissions to Microsoft, the documentation describes analysis of submitted information and storage in secured, compliance-audited data centers in the USA. Organizations should agree this data flow internally before activation and explain it clearly in their user guidance.
Metadata is available for follow-up on the User reported tab of the Submissions page. Microsoft says meeting and participant reports use the same alert policies as reported calls. When the destination is your reporting mailbox only, reports are not automatically sent to Microsoft for analysis, although administrators can submit items manually. An internal destination must therefore not be mistaken for evidence that Microsoft has already analyzed a report.
Concrete next steps for small IT teams
The following sequence is ReByteIT’s operational recommendation based on Microsoft’s instructions, not an additional Microsoft requirement:
- Check the meeting reporting policy and Defender monitoring together with the responsible administrators.
- Define the reporting destination, Exchange Online mailbox, and review owners; document the selected data flow.
- Use an agreed test meeting on desktop or the web to check reporting for an individual participant.
- Confirm that the report appears under User reported and inspect its associated alert; record the outcome clearly.
- Explain meeting reports, participant reports, and feedback on incorrect detections separately from call reporting.
Official Microsoft sources
- Microsoft Learn: October updates for Defender for Office 365
- Microsoft Learn: Teams reporting settings, destinations, clients, and review
- Microsoft Learn: Report suspicious meetings and participants
Our Microsoft Security Assessment reviews technical reporting paths and responsibilities. You can book a call to review your environment; this does not include a licensing recommendation.
What does this mean for your environment?
Assess the topic in the context of your Microsoft 365 environment and define a practical next step.
You speak directly with Sebastian Kerssen – working in the Microsoft ecosystem since 2014, with personal consulting and a dedicated point of contact.
