Check ID:
Provider: Microsoft 365
Service:
Severity: MEDIUM
Categories:
Resource type:
teams_security_reporting_enabledProvider: Microsoft 365
Service:
teamsSeverity: MEDIUM
Categories:
e3Resource type:
NotDefinedWhat this check verifies
Teams messaging policies enable end-user security reporting viaAllowSecurityEndUserReporting, letting users report messages from chats, channels, and meetings for security review.
Risk
Disabled reporting hides phishing, malicious links, and social engineering in Teams. This delays detection and response, enabling lateral movement and data exfiltration, and degrading confidentiality and integrity.Recommendation
EnableAllowSecurityEndUserReporting in relevant messaging policies and route submissions to security operations for timely triage.
Reinforce defense in depth with link/file protection and monitoring, train users to report suspicious content, and apply least privilege to administrative access.
Remediation
- CLI
- Dashboard steps
Set-CsTeamsMessagingPolicy -Identity Global -AllowSecurityEndUserReporting $true
References
- https://learn.microsoft.com/en-us/powershell/module/microsoftteams/set-csteamsmessagingpolicy?view=teams-ps
- https://blog.hametbenoit.info/2023/03/30/teams-you-can-now-enable-quarantine-for-teams-preview/
- https://learn.microsoft.com/en-us/defender-office-365/submissions-teams?view=o365-worldwide
Where this check fires
This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable byCheck ID = teams_security_reporting_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks