Microsoft Teams will soon support certified third-party tools that flag synthetic audio and video during meetings, alongside a new impersonation protection feature that warns users when a meeting organizer or participant looks suspicious. Both capabilities are scheduled for general availability in November after a worldwide rollout, giving organizations a way to see deepfake signals directly inside the Teams interface.
How third-party deepfake detection works in Teams
Once the feature ships, third-party detection providers will analyze live meeting media for signs of synthetic or manipulated audio and video, then send detection signals back to Teams. Microsoft will surface those signals inside the meeting experience so participants and admins get an integrated view of which streams look genuine and which look generated.
The Microsoft 365 Roadmap entries describe the integration as a way for organizations to strengthen meeting security with synthetic audio and video detection solutions provided by certified third-party providers. Microsoft’s role, per the roadmap, is to provide Teams integration and experiences to act on the detection signals those providers trigger, rather than to run the detection itself in-house.
What impersonation protection will do
In addition to media analysis, Teams will detect deceptive meeting organizers and participants. When the system spots a potential impersonation attempt, it surfaces warnings and risk indicators aimed at helping users recognize suspicious identities before joining or while participating. The feature is designed to make it easier to judge whether an organizer or attendee is who they claim to be.
Where these features sit in the current Teams security push
Microsoft has added these deepfake detection and impersonation features to Teams alongside other security changes in recent months.
- External user locking via the Defender portal, announced in December and set to reach admins in January, aimed at disrupting social engineering and ransomware-style abuse of Teams.
- Automatic blurring of QR codes sent by external senders, introduced last month, to cut down on phishing and fraud attempts.
- A Teams meeting protection policy rolled out in August that lets admins block identified external bots from joining meetings.
- A September announcement that users will be able to report suspicious guest invitations directly from Teams starting in November, so security teams can spot and block phishing attempts that abuse guest invites.
Taken together, these changes point to a broader strategy of giving admins more control over meeting access, content sharing, and participant verification.
What this means for organizations using Teams
For security and IT teams, the November rollout introduces a couple of practical decisions. Teams using a supported detection provider will need to confirm that their provider is on Microsoft’s certified list and understand which signals get surfaced inside the meeting UI. Admins who have already turned on the bot-blocking policy or the QR code blur will have one more layer to configure around impersonation warnings.
For everyday meeting participants, the practical effect is more visible cues: a warning when the organizer or another attendee may be impersonating someone, and risk indicators when a stream looks manipulated. Both are designed to help users make a more informed call before they share information or join a call prompted by an outside party.
FAQ
When will Teams support third-party deepfake detection?
Microsoft plans to roll the feature out worldwide and make it generally available in November, according to new entries on the Microsoft 365 Roadmap.
How will deepfake detection signals appear in Teams?
Certified third-party providers will analyze meeting audio and video for signs of synthetic or manipulated media and send detection signals to Teams, which will then surface and act on those signals through integrated in-meeting experiences and controls.
What is the new Teams impersonation protection feature?
It is a security feature that detects potential impersonation attempts by meeting organizers and participants and surfaces warnings and risk indicators to help users recognize suspicious identities before joining or during a meeting.