Microsoft is preparing to give Teams the ability to flag meetings where audio or video may have been artificially generated or manipulated, a direct response to the growing use of deepfakes in social-engineering attacks. The capability, tracked on the Microsoft 365 roadmap under ID 573451, is currently listed as in development, with rollout for Desktop, Mac, and Web clients in the Worldwide Standard Multi-Tenant cloud expected to begin in November 2026.

How the Detection Actually Works

The most important detail buried in the roadmap entry is that Teams itself won’t be the one analyzing meeting media for signs of manipulation. Instead, Microsoft is building an integration layer that connects Teams to certified third-party detection providers. Those outside vendors will examine the audio and video streams during a call, look for the telltale artifacts of synthetic generation or alteration, and send a detection signal back into Teams, which then surfaces that result to meeting participants or administrators.

In effect, Microsoft is positioning Teams as the delivery and display layer for a capability it doesn’t build or run itself. The roadmap entry doesn’t yet specify which third-party vendors will be certified, what the in-meeting warning will look like, how much it might cost organizations, or how detection accuracy holds up against increasingly capable generative tools. The rollout will proceed through Microsoft’s standard Targeted Release phase before reaching General Availability, and the November date marks only the start of that staged release — not a guarantee that every tenant will have the feature on day one.

A Response to Real Attacks Already Happening

This isn’t a defensive feature built for a hypothetical threat. Cybersecurity News has previously reported on active deepfake phishing campaigns that specifically abuse video conferencing platforms, including Teams and Zoom, to target cryptocurrency holders. In one documented pattern, victims received a meeting invitation through Telegram and then saw what appeared to be a familiar, trusted contact on the call — generated in real time using AI video synthesis. Partway through the conversation, the “contact” would claim there was an audio glitch and ask the victim to install a plugin or update to fix it. That request was the actual payload: the download was malware designed to drain cryptocurrency wallets, steal credentials, and hijack Telegram accounts.

What makes this style of attack effective is that it doesn’t require exploiting any flaw in the conferencing software at all — it exploits trust in a familiar face and voice, which is precisely the gap synthetic media detection is meant to narrow.

Part of a Broader Push on Meeting Integrity

Synthetic media detection is only one piece of what Microsoft is building out for meeting security. The company is separately developing a meeting impersonation protection feature, which focuses on flagging suspicious organizers or participants rather than manipulated audio or video directly — surfacing warnings and risk indicators when something about a participant’s identity looks off. Taken together, the two protections target related but distinct angles of meeting-based social engineering: one watches the media itself, the other watches the people attached to it.

What This Means for Security Teams

Organizations should treat the upcoming capability as an additional signal rather than a guarantee of authenticity. Even once rolled out, a “no manipulation detected” result won’t be definitive proof a call is legitimate, and a flagged result won’t necessarily mean an attack is underway — detection systems for synthetic media are still an active area of research with real false-positive and false-negative rates. Security teams preparing for the rollout should consider the following in the meantime:

• Continue training staff that any in-call request to install software, share credentials, or approve a payment needs independent, out-of-band verification — regardless of how convincing the caller appears.
• Watch for vendor and licensing details as Microsoft’s Targeted Release phase approaches, since certified third-party providers will need to be selected and possibly licensed separately.
• Evaluate how detection signals will be surfaced to end users versus administrators, since an alert during a live call needs a clear, low-friction response path to be useful.
• Pair this feature with existing impersonation and identity-verification controls rather than relying on it in isolation.

As deepfake-enabled fraud continues to scale, platform-level detection features like this one represent a meaningful step forward — but they arrive as one layer in a defense that still depends heavily on skepticism, verification habits, and user awareness.