Microsoft Teams to Scan QR Codes in Messages for Malicious URLs Starting in 2026
A new Teams feature will extract and check web addresses hidden in QR codes, extending Defender protections to detect threats after message delivery.
Key points
- Microsoft will roll out QR code scanning in Teams between early October and early November 2026.
- The feature works automatically for customers with Microsoft Defender for Office 365.
- This adds to existing controls that obscure QR codes from external senders.
Microsoft will begin rolling out a security enhancement for Teams that detects malicious web addresses hidden within QR codes. According to GBHackers, the feature, detailed in Message Center notice MC1490905, will launch globally in early October 2026 and finish by early November. Organizations using Teams alongside Defender for Office 365 will receive this capability automatically without needing to configure separate settings.
The new protection examines QR codes found in incoming Teams messages to extract the underlying URLs. Microsoft Defender for Office 365 then checks whether these destinations are harmful. If a dangerous link is identified, Teams displays a warning on the relevant message. This alert appears in both internal conversations among staff and external chats with people outside the organization.
Context and Background
This update extends the investigative information available to security teams by combining message alerts with deeper threat analysis. Microsoft has provided examples showing messages labeled as potentially harmful and channel posts that are blocked. These different enforcement outcomes indicate that not every suspicious QR code will be automatically removed. Whether a message is blocked depends on its specific threat classification and the organization's protection settings.
This enhancement differs from previously announced protections for external senders. That earlier feature obscures QR code images until recipients choose to reveal them, adding a manual step before scanning. In contrast, the new system assesses extracted URLs after a message is delivered. Together, these controls address different stages of exposure, from initial receipt to post-delivery evaluation.
Who Is Affected
Organizations using Teams with Defender for Office 365 Plan 1 or Plan 2 can utilize Zero-hour Auto Purge for eligible internal messages. Microsoft states that ZAP quarantines internal chats or channel messages identified as malware or high-confidence phishing after they have been delivered. Detection, warning, and quarantine are distinct actions that work together to mitigate risk.
QR code phishing, often called quishing, embeds a malicious destination in an image rather than a traditional clickable link. Attackers may frame scanning requests as account verification, document access, or urgent technical support. This redirects recipients to fraudulent authentication sites. By extracting the encoded address, Defender can evaluate the destination itself rather than relying solely on the surrounding text.
What should you do?
Security teams should verify that their Defender for Office 365 policies are active to ensure the automatic rollout applies correctly. Monitor internal messages for quarantine actions taken by Zero-hour Auto Purge. Review warning labels on messages to understand how the new detection affects user workflows. Prepare staff training materials that explain the difference between obscured QR codes and scanned warnings.
What to do and how to stay safe: Microsoft Teams
- Verify that Defender for Office 365 is active on your Teams tenant to enable automatic protection.
- Review Zero-hour Auto Purge settings to ensure internal malicious messages are quarantined after delivery.
- Educate users on recognizing warning labels for potentially harmful QR codes in both internal and external chats.
- Monitor security logs for new threat classifications related to QR code phishing attempts.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
When will the QR code scanning feature be available in Microsoft Teams?
The global rollout begins in early October 2026 and is expected to be completed by early November 2026.
Do organizations need to configure this feature manually?
No, organizations using Teams with Defender for Office 365 will receive the enhancement automatically with no separate setup required.
How does this feature differ from previous QR code protections?
Previous protections obscured QR codes from external senders until users revealed them, while this new feature scans and evaluates URLs after message delivery.
