In most of the Microsoft 365 projects I work on, Teams is now where daily collaboration happens. Teams protection with Defender for Office 365 still gets far less attention than email, though. Attackers noticed long ago. Phishing links, malicious attachments and social engineering all show up in Teams these days, particularly once external access is turned on. The Teams protection Defender provides out of the box is solid, but only after you enable and tune Safe Links, Safe Attachments and user reporting. Below is what has actually held up in my projects.

Safe Links checks Teams URLs at the moment of the click

Most admins know Safe Links from Exchange Online, and it matters just as much in Teams. Since late 2023, Safe Links can scan URLs in Teams messages when a user clicks them and block dangerous sites right away. For Teams this is not enabled by default. You need a dedicated Safe Links policy for Teams, which you create in the Defender portal under "Policies & rules → Threat policies → Safe Links". Until that policy exists, chats and channels are open to phishing. If you allow external users or guests (see how to stop social engineering through Teams external access), you can't do without Safe Links and the other Teams protection Defender features. Microsoft documents the details and caveats in Safe Links for Teams.

Safe Attachments covers files in Teams, OneDrive and SharePoint

Anything shared as a file in Teams is stored in SharePoint or OneDrive, so Safe Attachments coverage applies automatically. The Safe Attachments policy for SharePoint, OneDrive and Teams scans uploaded files and blocks or quarantines them when needed. You'll find it in the Defender portal under "Safe Attachments → Policy for SharePoint, OneDrive, and Microsoft Teams". Many tenants I look at simply run the default policy. I'd recommend checking whether you want monitor-only, block or remove as the action, and whether any exceptions are configured. Safe Attachments works whether a file is opened in Teams or directly in SharePoint/OneDrive. Preset policies give you a quick start, but Teams scenarios almost always need some fine-tuning. I go into that in my post on what Defender for Office 365 preset policies actually give you.

Zero-hour Auto Purge removes threats from Teams after the fact

This one is easy to overlook. Zero-hour Auto Purge (ZAP) now works for Teams messages as well. When Safe Links or Safe Attachments flag a message or file as malicious after delivery, ZAP removes it from Teams chats and channels automatically. That narrows the window attackers have to exploit links or files that slipped through at first, which matters most with targeted attacks built on new or changing threats.

The flowchart below shows how Safe Links, Safe Attachments and ZAP work together in Teams:

flowchart TD
  Send["Message/file sent"] --> SafeLinks["Safe Links scan"]
  Send --> SafeAttachments["Safe Attachments scan"]
  SafeLinks --> ZAP["ZAP: Remove after detection"]
  SafeAttachments --> ZAP
  ZAP --> User["User sees message removed"]

Figure: Safe Links, Safe Attachments and ZAP protecting Teams messages.

Users can report suspicious Teams messages themselves

Since mid-2024, users can report suspicious Teams messages directly from their client. You turn this on in the Teams admin center under "Messaging policies → Report a security concern". Depending on your configuration, the reports then go to the Defender portal under "Email & collaboration → Actions & submissions → Submissions". Also review the Defender settings under "Settings → Email & collaboration → User reported settings → Microsoft Teams", where you set the recipient address and how reports are handled. Microsoft describes the workflow and its limitations in Submissions in Teams and Teams support in Defender.

Tip from the field: User reporting only helps if people know the option exists. A short intranet post or a Teams announcement about the new button will raise reporting rates considerably.

All submissions end up in the Defender portal

Every Teams message or file that users report or that gets blocked automatically shows up in the Defender portal under "Actions & submissions → Submissions". Your SOC or security admins review detections and reports from Teams and other workloads there. With Teams in particular, I check submissions regularly, because user reports often point to new phishing or social engineering attempts before the automated filters pick them up.

A few simple steps make a big difference for Teams protection in Defender

Together, Safe Links, Safe Attachments, ZAP and user reporting raise Teams protection in Defender considerably, provided you actually enable and tune them. In a lot of tenants, important Teams-specific policies are still missing. Review your configuration, especially if you allow external guests or handle sensitive projects in Teams. If you want to know how preset policies set the baseline (and where they stop), read my post on what Defender for Office 365 preset policies actually give you. For defending against social engineering, I strongly recommend my article on stopping phishing through Teams external access.