Microsoft to Switch On Teams Messaging Safety Defaults in January

Microsoft to Switch On Teams Messaging Safety Defaults in January

Key Takeaways

• Microsoft will automatically enable Teams messaging safety features in January 2025 for tenants that haven’t modified these settings.
• Three protections are being activated: weaponizable file type blocking, malicious URL detection, and false-positive reporting.
• Organizations that want to keep custom configurations must update and save their settings before the rollout date.

Microsoft is preparing a quiet but consequential update to Teams security: in January 2025, the company will automatically switch on a set of messaging safety features for organizations that never customized those controls. It’s not a flashy change, but it’s one of those security defaults that tends to matter more than people expect. And it arrives at a moment when Teams, now used by more than 320 million people each month, is under heightened scrutiny for how it handles threats circulating through chats, channels, and external connections.

The company outlined the shift in a Microsoft 365 message center notice directed at administrators. According to the update, Teams will begin enforcing three protections by default: blocking messages that contain potentially weaponizable file types, labeling or intercepting messages with suspicious URLs, and enabling users to report false positives. Tenants that have already set their own preferences won’t be affected, but everyone else is going to see the change arrive automatically.

The file-blocking piece will probably get the most attention from IT teams. Microsoft hasn’t published a long list in the notice, but weaponizable file types typically include formats—like certain script files—that attackers can use to deliver or execute malicious code. This kind of filtering isn’t new in enterprise communications platforms, but turning it on without waiting for admin action signals that Microsoft’s tolerance for default-risk exposure in Teams is shrinking. And honestly, it’s not hard to see why. The platform has become a favored channel for phishing attempts and malware delivery, including threats that hop across organizational boundaries.

Microsoft’s second default, malicious URL detection, is designed to catch the growing number of attacks delivered through everyday links. When the system spots something suspicious, users may see warnings applied directly in chat. It’s a small detail, but it tells you a lot about where Microsoft thinks risk originates now: not just email, but whatever channel happens to be the most convenient for a scammer on any given day.

The third feature—false-positive reporting—is more operational than defensive. Still, it matters. If Teams security labels a safe message as harmful, users can flag the incorrect detection so administrators can review it. It’s a lightweight feedback loop, but an important one for environments that have long (and occasionally painful) histories of overactive threat scanning. The presence of this option may also ease the transition for organizations that worry about automated blocking disrupting collaboration.

Microsoft’s instructions to administrators are straightforward: if you want to preserve your current configuration, you need to update and save your settings before mid-January. Otherwise, the new defaults will kick in. For Teams admins who haven’t visited the relevant panel in a while, the controls live under Messaging > Messaging settings > Messaging safety in the Teams admin center. The company also advises updating internal documentation and preparing helpdesk staff for a rise in user questions. And yes, questions will probably arrive—what helpdesk hasn’t gotten at least one urgent ticket about a blocked attachment?

There’s a small tangent worth noting here: Microsoft is adding these defaults as part of a broader response to increased cybersecurity scrutiny. It’s not just Teams that’s been under examination. The company has faced criticism over coordination between its cloud services, identity protections, and app-level controls. And yet, changes like this one tend to be quietly welcomed by defenders because they reduce the need for organizations to build their own safety baselines from scratch. That said, a forced default change always triggers the same worry: will this help or hinder highly customized environments? That’s where the January deadline becomes more than just a date.

The security push extends beyond messaging. Microsoft recently added a feature that automatically blocks screen-capture attempts during Teams meetings—a move clearly aimed at preventing sensitive information from being extracted during live collaboration. While Microsoft didn’t connect the two changes in its announcement, taken together they paint a picture of Teams hardening itself on multiple fronts. The company also noted it is working on a new call handler for the Teams desktop client to improve launch speed and performance on Windows 11. It’s a reminder that not all user complaints are security-related; sometimes people simply want the app to open faster.

Some admins may wonder whether these new messaging protections overlap with Microsoft Defender or other enterprise security tools. The company didn’t address that in the announcement, but historically, Teams-specific controls are meant to complement—not replace—broader defenses. For context on how messaging and collaboration tools have been targeted, the FBI warned earlier this year that attackers increasingly pivot through workplace platforms after compromising email accounts. It's not a direct reference to Teams, but the pattern is familiar enough to raise eyebrows.

The intensified focus on Teams security also reflects how attackers’ strategies have shifted. Cybercriminals have learned that meeting invites, chat pings, and document shares often carry an assumption of trust. This is one reason Microsoft rolled out another capability—one that warns administrators about suspicious traffic coming from external domains. It may sound niche, but for organizations that work with many partners, contractors, or vendors, external domain interactions are everyday occurrences. Security teams don’t have the luxury of ignoring them.

Still, the impending January switch is the immediate operational concern. Organizations likely fall into one of three camps: those that welcome automatic enforcement, those that have deeply customized their security configuration, and those that haven’t looked at their settings in a long while and now face a decision. What does that mean for teams already juggling configuration debt? It may be a prompt to revisit long-outdated defaults.

Microsoft isn’t framing the update as a drastic shift—just a strengthening of the baseline. But baseline changes have a habit of surfacing underlying issues, especially in larger enterprises with complex governance models. Even so, the logic of turning on protections by default is difficult to argue with. A platform used by hundreds of millions of people needs a safer starting point, not a lighter touch.

The next few weeks will probably be quieter than the update itself. Most users will only notice the change when a link gets labeled or an attachment doesn’t go through. For many organizations, that’s the ideal outcome: a bit of friction where it matters, and fewer opportunities for malicious content to slip into everyday collaboration.