Microsoft Defender for Endpoint keeps detecting that Teams needs to be updated

Question

Microsoft Defender for Endpoint keeps detecting that Teams needs to be updated

OoMunoz 25

Microsoft Defender for Endpoint keeps detecting that Teams needs to be updated even though it's updated (New teams latest version) and Classic Teams has been uninstalled. Trying to figure out exactly how Defender is detecting this...Is it a registry setting that it detects or anything else?

Thank you.

JimmyYang-MSFT 58,646 Reputation points Microsoft External Staff

2024-04-17T10:01:11.99+00:00

@OoMunoz Based on my research, the "new teams" version will be on its own update version and the classic teams app will remain on older versions and thus report in defender as needing updates.
kguntaka 6,645 Reputation points Microsoft External Staff Volunteer Moderator

2024-04-19T13:23:06.3466667+00:00

Hi OoMunoz,

Thank you for reaching out to us on the Microsoft Q&A forum.

Can you please specify the Learn Path/Module that you are going through?

Thank you.
OoMunoz 25 Reputation points

2024-04-19T21:20:05.2266667+00:00

Hello kguntaka,

I'm sorry, I didn't mean to add "Microsoft 365 Training" when creating this question. If this is not the correct place to submit questions regarding an ongoing Teams detection in MS Defender for Endpoint, please point me to the correct location.

Thank you.
Stewart 10 Reputation points

2024-06-07T01:35:10.68+00:00
Hi All,

I had this fault, cleared as follows:

The Situation

a. The new Teams was installed Computer wide, Great!!

b. But I discovered Teams, Classic in this case, had been installed under Users personal accounts. Everybody is now using the New Teams, so classic no longer used and not updated. Bad!!!

So this is what I did to fix it.

From MS Defender for EndPoint, select the Dashboard

Under the "Exposure Score section choose "Improve Score"

Now you should see a new windows "Security Recommendations" with a, "Update Microsoft Teams" recommendation, along with potentially other recommendations in a list.

Click on the "Update Microsoft Teams" recommendation to expand a new window specific to "Update Microsoft Teams". I noted that on my computer I had to move my mouse around in the "Update Microsoft Teams" row to find a section of the row that allowed me to click the "Update Microsoft Teams option?

Once in the "Update Microsoft Teams" window, select Exposed Devices. Now you have a list of devices causing the "Update Microsoft Teams" issue. Progress!!

Now From the MS Defender for EndPoint, from the side bar menu Assets, select Devices.

Select one of the Devices in Point 6 and expand.

For that selected device, select "Security Recommendations" and select the "Update Microsoft Teams" row.

Now select "Report Inaccuracy" and choose the reason "Recommendation was already applied" DO NOT CLICK SUBMIT. NEVER CLICK SUBMIT.

Wait a second or so, above the Submit button, an Insight section shows the offending user and specifically what version of Teams is triggering the alert.

Being a tiny organisation, we just deleted those rogue installs under the users' profile. Fault gone.

Conclusion
I acknowledge if you have hundreds of computers with many users, how you fix this I am not sure. But hopefully my contribution advances the discussion as to one reason you may be getting this alert.

Thanks,
Stewart
Anonymous

2024-09-09T12:39:40.81+00:00

@Stewart what a great help your reply has been. I have had issues locating the installs of applications like the classic Teams and others, and your suggestion has been a great advantage in locating them.

Accepted answer

2 additional answers

Your answer

JimmyYang-MSFT 58,646 Reputation points Microsoft External Staff

2024-04-17T10:01:11.99+00:00

@OoMunoz Based on my research, the "new teams" version will be on its own update version and the classic teams app will remain on older versions and thus report in defender as needing updates.
kguntaka 6,645 Reputation points Microsoft External Staff Volunteer Moderator

2024-04-19T13:23:06.3466667+00:00

Hi OoMunoz,

Thank you for reaching out to us on the Microsoft Q&A forum.

Can you please specify the Learn Path/Module that you are going through?

Thank you.
OoMunoz 25 Reputation points

2024-04-19T21:20:05.2266667+00:00

Hello kguntaka,

I'm sorry, I didn't mean to add "Microsoft 365 Training" when creating this question. If this is not the correct place to submit questions regarding an ongoing Teams detection in MS Defender for Endpoint, please point me to the correct location.

Thank you.
Anonymous

2024-09-09T12:39:40.81+00:00

@Stewart what a great help your reply has been. I have had issues locating the installs of applications like the classic Teams and others, and your suggestion has been a great advantage in locating them.

Answer 1

Förster, Nik 75

since it hasn't been posted here. Had the same issue with old Teams installations in old userprofiles, triggering defender vulnerabilities. First i made an Intune policy, that removes old Profiles older than X amount of days. Furthermore MS just published an Article with uninstallation scripts for exaclty that topic: https://learn.microsoft.com/en-us/microsoftteams/teams-client-uninstall-script

Just deployed it, one machine already processed successfully. Lets see what Defender says when it updates.

OoMunoz 25 Reputation points

2025-03-14T12:50:04.0033333+00:00

Thank you, this is exactly what we had to do at the end. Once those older profiles had been removed and used the script to uninstall Teams on others, we saw most, if not all, entries in Defender go away.
Timo - The Admiral 1 Reputation point

2025-03-16T16:13:50.02+00:00

Hi Nik,

You used the script from MS to prevent problems with TMA? https://learn.microsoft.com/en-us/microsoftteams/teams-client-uninstall-script

You build a policy to remove the complete user profile when not logged-in for x days. Correct?

Regards Timo
Förster, Nik 75 Reputation points

2025-03-17T08:44:37.5066667+00:00

@Timo - The Admiral

I didn't use that. All of my active users have a newer version than 24215.1007.3082.1590 and therefore have no issue with TMA after script execution. The Script just removes classic clients, not app-instances with their corresponding TMAs.

Yes i did. It is in the shared computer settings catalog in intune. I still have some Defender alerts left, but i think those will clear out over time

Answer 2

kguntaka 6,645 Microsoft External Staff Volunteer Moderator

Hi OoMunoz,

In addition to JimmyYang-MSFT,

You are facing the issue due to one of the following reasons:

Update Detection: Defender may be detecting a need for an update due to version discrepancies between the new Teams and the classic Teams app.
Classic Teams: The classic version remains on older versions, which could be why Defender reports it as needing updates. It seems to be a common issue, and the solution might involve checking for any remnants of the classic Teams app or ensuring that the update channels for the new Teams are correctly configured.

You can reach out to Microsoft Q&A forum to submit questions.

Hope it will help.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

OoMunoz 25 Reputation points

2024-04-22T13:19:16.74+00:00

Thank you kguntaka**,**

I have verified and confirmed we are on the correct update channel for New Teams, and it's successfully getting updates from Microsoft, but then my question is how does Defender still detect remnants of Classic Teams if we believe we have fully removed it from a system that is still getting flagged by Defender? What is Defender exactly detecting? Is it detecting specific registry entries? I believe we have gone through a thorough removal process for Classic Teams, but we still seem to be missing something....It also doesn't help when Defender doesn't give you a clue other than "Teams needs to be updated".
kguntaka 6,645 Reputation points Microsoft External Staff Volunteer Moderator

2024-04-23T11:25:21.31+00:00
Hi OoMunoz,

The detection by Microsoft Defender of remnants from Classic Teams could stem from various factors. Consider the following points:

Registry Settings: Lingering registry entries associated with Classic Teams may trigger Defender alerts. It's common for uninstalled programs to leave behind such keys.

Teams Machine-Wide Installer: Even after uninstalling Classic Teams, remnants of the Teams Machine-Wide Installer could persist, prompting Defender to signal an update requirement.

Manual Uninstallation: Sometimes, manual removal of Classic Teams becomes necessary, particularly if automated removal encounters obstacles like permissions or configuration settings.

Documentation and Support: Microsoft offers comprehensive documentation on uninstalling Classic Teams and addressing Teams Machine-Wide Installer issues. Following these guidelines is advised for proper removal.

Refer here:  Uninstalling classic Microsoft Teams.

Please contact the support in the following link to get help related to Microsoft Defender for Endpoint.

Contact Microsoft Defender for Endpoint support

Microsoft Defender for Endpoint Training - Microsoft Q&A
Timo - The Admiral 1 Reputation point

2024-09-16T06:53:47.5466667+00:00

Hello all, especially @kguntaka

Thanks for all the tips, but simply hiding the old Teams from the Defender report does not solve the basic problem.

A policy in the Teams admin portal ensures that only the new Teams is used. Microsoft itself writes that if this policy is used, the late Teams will be uninstalled “We'll attempt to uninstall classic Teams after a period of time. ”

https://learn.microsoft.com/en-us/microsoftteams/teams-classic-client-end-of-availability

However, this is not happening or is only happening on some devices. How to attempt to uninstall legacy Teams is unfortunately not stated, nor by what deadline.

All in all, a very annoying situation without a clear statement from Microsoft.

Regards Timo

Answer 3

Rakesh Gurram 15,715 Microsoft External Staff Moderator

Hi Timo - The Admiral

Thank you for reaching out to us on the Microsoft Q&A forum.

This topic is currently not supported in the Q&A forums.

We recommend initiating a new discussion through the Microsoft Defender for Endpoint where our moderators are readily available there to assist you and provide guidance.

Timo - The Admiral 1 Reputation point

2024-10-09T10:16:52.4633333+00:00

Hi @Rakesh Gurram

I must stongly disagree. https://admin.microsoft.com/#/MessageCenter/:/messages/MC806095
Note says: Classic Microsoft Teams: Uninstallation paused for Windows only

Auto unistallation can have neagtive impact on the Outlook Teams plugin. A manual fix is provieded when problem occurs, but no further update if a general solution will be provided.

Regards Timo

Share via

Microsoft Defender for Endpoint keeps detecting that Teams needs to be updated

2 additional answers

Your answer