Microsoft Defender for Endpoint keeps detecting that Teams needs to be updated

OoMunoz 5

Microsoft Defender for Endpoint keeps detecting that Teams needs to be updated even though it's updated (New teams latest version) and Classic Teams has been uninstalled. Trying to figure out exactly how Defender is detecting this...Is it a registry setting that it detects or anything else?

Thank you.

JimmyYang-MSFT 53,846 Reputation points Microsoft Vendor

2024-04-17T10:01:11.99+00:00

@OoMunoz Based on my research, the "new teams" version will be on its own update version and the classic teams app will remain on older versions and thus report in defender as needing updates.
kguntaka 3,095 Reputation points Microsoft Vendor

2024-04-19T13:23:06.3466667+00:00

Hi OoMunoz,

Thank you for reaching out to us on the Microsoft Q&A forum.

Can you please specify the Learn Path/Module that you are going through?

Thank you.
OoMunoz 5 Reputation points

2024-04-19T21:20:05.2266667+00:00

Hello kguntaka,

I'm sorry, I didn't mean to add "Microsoft 365 Training" when creating this question. If this is not the correct place to submit questions regarding an ongoing Teams detection in MS Defender for Endpoint, please point me to the correct location.

Thank you.
Stewart 10 Reputation points

2024-06-07T01:35:10.68+00:00
Hi All,

I had this fault, cleared as follows:

The Situation

a. The new Teams was installed Computer wide, Great!!

b. But I discovered Teams, Classic in this case, had been installed under Users personal accounts. Everybody is now using the New Teams, so classic no longer used and not updated. Bad!!!

So this is what I did to fix it.

From MS Defender for EndPoint, select the Dashboard

Under the "Exposure Score section choose "Improve Score"

Now you should see a new windows "Security Recommendations" with a, "Update Microsoft Teams" recommendation, along with potentially other recommendations in a list.

Click on the "Update Microsoft Teams" recommendation to expand a new window specific to "Update Microsoft Teams". I noted that on my computer I had to move my mouse around in the "Update Microsoft Teams" row to find a section of the row that allowed me to click the "Update Microsoft Teams option?

Once in the "Update Microsoft Teams" window, select Exposed Devices. Now you have a list of devices causing the "Update Microsoft Teams" issue. Progress!!

Now From the MS Defender for EndPoint, from the side bar menu Assets, select Devices.

Select one of the Devices in Point 6 and expand.

For that selected device, select "Security Recommendations" and select the "Update Microsoft Teams" row.

Now select "Report Inaccuracy" and choose the reason "Recommendation was already applied" DO NOT CLICK SUBMIT. NEVER CLICK SUBMIT.

Wait a second or so, above the Submit button, an Insight section shows the offending user and specifically what version of Teams is triggering the alert.

Being a tiny organisation, we just deleted those rogue installs under the users' profile. Fault gone.

Conclusion
I acknowledge if you have hundreds of computers with many users, how you fix this I am not sure. But hopefully my contribution advances the discussion as to one reason you may be getting this alert.

Thanks,
Stewart
Tom Creasey 0 Reputation points

2024-09-09T12:39:40.81+00:00

@Stewart what a great help your reply has been. I have had issues locating the installs of applications like the classic Teams and others, and your suggestion has been a great advantage in locating them.

3 answers

kguntaka 3,095 Reputation points Microsoft Vendor

2024-04-20T10:29:51.47+00:00
Hi OoMunoz,

In addition to JimmyYang-MSFT,

You are facing the issue due to one of the following reasons:

Update Detection: Defender may be detecting a need for an update due to version discrepancies between the new Teams and the classic Teams app.

Classic Teams: The classic version remains on older versions, which could be why Defender reports it as needing updates. It seems to be a common issue, and the solution might involve checking for any remnants of the classic Teams app or ensuring that the update channels for the new Teams are correctly configured.

You can reach out to Microsoft Q&A forum to submit questions.

Hope it will help.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.

1 person found this answer helpful.
OoMunoz 5 Reputation points

2024-04-22T13:19:16.74+00:00

Thank you kguntaka**,**

I have verified and confirmed we are on the correct update channel for New Teams, and it's successfully getting updates from Microsoft, but then my question is how does Defender still detect remnants of Classic Teams if we believe we have fully removed it from a system that is still getting flagged by Defender? What is Defender exactly detecting? Is it detecting specific registry entries? I believe we have gone through a thorough removal process for Classic Teams, but we still seem to be missing something....It also doesn't help when Defender doesn't give you a clue other than "Teams needs to be updated".

kguntaka 3,095 Reputation points Microsoft Vendor

2024-04-23T11:25:21.31+00:00

Hi OoMunoz,

The detection by Microsoft Defender of remnants from Classic Teams could stem from various factors. Consider the following points:

Registry Settings: Lingering registry entries associated with Classic Teams may trigger Defender alerts. It's common for uninstalled programs to leave behind such keys.

Teams Machine-Wide Installer: Even after uninstalling Classic Teams, remnants of the Teams Machine-Wide Installer could persist, prompting Defender to signal an update requirement.

Manual Uninstallation: Sometimes, manual removal of Classic Teams becomes necessary, particularly if automated removal encounters obstacles like permissions or configuration settings.

Documentation and Support: Microsoft offers comprehensive documentation on uninstalling Classic Teams and addressing Teams Machine-Wide Installer issues. Following these guidelines is advised for proper removal.

Refer here:  Uninstalling classic Microsoft Teams.

Please contact the support in the following link to get help related to Microsoft Defender for Endpoint.

Contact Microsoft Defender for Endpoint support

Microsoft Defender for Endpoint Training - Microsoft Q&A

Timo - The Admiral 1 Reputation point

2024-09-16T06:53:47.5466667+00:00

Hello all, especially @kguntaka

Thanks for all the tips, but simply hiding the old Teams from the Defender report does not solve the basic problem.

A policy in the Teams admin portal ensures that only the new Teams is used. Microsoft itself writes that if this policy is used, the late Teams will be uninstalled “We'll attempt to uninstall classic Teams after a period of time. ”

https://learn.microsoft.com/en-us/microsoftteams/teams-classic-client-end-of-availability

However, this is not happening or is only happening on some devices. How to attempt to uninstall legacy Teams is unfortunately not stated, nor by what deadline.

All in all, a very annoying situation without a clear statement from Microsoft.

Regards Timo
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Rakesh Gurram 9,060 Reputation points Microsoft Vendor

2024-10-09T09:16:19.35+00:00

Hi Timo - The Admiral

Thank you for reaching out to us on the Microsoft Q&A forum.

This topic is currently not supported in the Q&A forums.

We recommend initiating a new discussion through the Microsoft Defender for Endpoint where our moderators are readily available there to assist you and provide guidance.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Timo - The Admiral 1 Reputation point

2024-10-09T10:16:52.4633333+00:00

Hi @Rakesh Gurram

I must stongly disagree. https://admin.microsoft.com/#/MessageCenter/:/messages/MC806095
Note says: Classic Microsoft Teams: Uninstallation paused for Windows only

Auto unistallation can have neagtive impact on the Outlook Teams plugin. A manual fix is provieded when problem occurs, but no further update if a general solution will be provided.

Regards Timo
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Microsoft Defender for Endpoint keeps detecting that Teams needs to be updated

3 answers

Your answer