Microsoft Teams: Defender for Office 365 will scan QR codes in Teams messages after delivery and warn on (or, with Teams ZAP, block) malicious links — worldwide rollout early October to early November 2026 (MC1490905)
Microsoft told Microsoft 365 admins on 7 October 2026 (Message Center MC1490905) that Defender for Office 365 is extending Teams URL protection to links hidden inside QR codes. After a message is delivered, Defender extracts URLs from QR code images, checks them, and puts a warning on the affected message in both internal and external chats when a link is malicious. Organisations with Defender for Office 365 Plan 1 or Plan 2 and zero-hour auto purge (ZAP) for Teams turned on may also have eligible malicious internal messages blocked. URLs taken from QR codes will show up in the Advanced Hunting MessageUrlInfo table with UrlLocation set to QRCode. The feature is part of existing Teams URL protection and needs no end-user setup; general availability runs from early October to early November 2026. QR code phishing hides a malicious address in an image so text-based link scanning misses it. Sources: Microsoft 365 Message Center (public archive copy); Microsoft Learn; wire: Cyber Security News 10 Oct.
- Product
- Microsoft Teams with Microsoft Defender for Office 365
- Versions
- n/a — service feature rolling out worldwide early October to early November 2026
- Exploited in Australia?
- unknown
- Patch to
- No patch. Check that Teams ZAP is on in Defender for Office 365 if you want blocking, not just warnings; tell the SOC that QR code detections will appear in MessageUrlInfo (UrlLocation = QRCode) and add them to hunting and triage; keep staff guidance that QR codes asking for sign-in or document review are suspect.
Primary: MC1490905 — Defender for Office 365: post-delivery protection for malicious QR codes in Microsoft Teams (published 7 Oct 2026; Message Center archive copy) · Vendor: Microsoft Learn — Defender for Office 365 support for Microsoft Teams (URL warnings, ZAP, hunting tables) · Cyber Security News — Microsoft Teams to warn users about malicious links hidden in QR codes (10 Oct 2026)