Microsoft Defender w/ Teams

Question

In teams when a user reports a call it automatically populates in Microsoft defender, but why does nothing occur when a user blocks a call. If a user blocks a call via teams, it's because the user believes it to be malicious or vishing. Why is there no automation to flag the call in these instances. If I was on an IT team, I would want to get info on members who block potential vishing calls or domains that are phishing. This could possibly be the same scenario as in outlook a user who blocks certain domains because they believe it is phishing could possibly not populate in Microsoft Defender. I have not experienced this firsthand with outlook like I have with Teams. Seems like a flag I would like to see if I were someone in the security team.

Answer 1

Hi ITSBruce

May I ask what type of account you are using? Is it Personal or Business?

Blocking a caller in Teams and reporting a call are separate actions. Based on Microsoft documentation, reported Teams calls can be reviewed in Microsoft Defender, but there is no documented indication that blocking a caller automatically generates a Defender alert, incident, or submission. Security visibility is tied to the Report Call feature rather than Block Caller.

This could be a useful product enhancement, especially if multiple users block the same caller suspected of vishing. To submit feedback:

• In Microsoft Teams, select Settings and more (...) > Help > Give feedback.
• Choose Suggest a feature.
• Describe the scenario and request that Teams caller block events be surfaced in Microsoft Defender/XDR for security monitoring.
• Submit the feedback for review by the product team.

You can also submit feedback through the Microsoft Feedback Portal (Windows + F). Since this is a public forum, no one here can directly intervene with product roadmap, raising your voice in the correct channel increases your chance to have your idea reviewed.