Defend Against QR Code Threats: Microsoft Teams to Auto-Scan for Malicious URLs in Oct 2026
A new security feature will automatically check QR codes in Teams messages for harmful URLs and alert users, starting in October 2026.
Key points
- The feature launches globally in early October 2026 and finishes by early November.
- It works automatically for organizations using Teams with Defender for Office 365.
- Teams will warn users if a QR code contains a dangerous web address.
Microsoft Teams will soon scan QR codes embedded in messages to detect malicious URLs. This security enhancement, announced on October 7, begins its global rollout in early October 2026. The update is designed to protect users from phishing attempts that use images instead of clickable links. System administrators do not need to configure this feature manually for it to take effect.
In plain English
Attackers often hide dangerous links inside QR codes to bypass standard text-based filters. This tactic, known as quishing, tricks users into scanning an image that redirects them to fraudulent sites. Microsoft’s new tool extracts the web address hidden within the QR code image. It then checks that destination against known threats before the user interacts with the link.
The background
This update builds on existing protections in Microsoft Defender for Office 365. Previously, Teams offered a feature that obscured QR codes from external senders until users chose to reveal them. That previous control added a manual step to prevent accidental scanning. The new system operates differently by analyzing the content of the code after the message is delivered to the recipient.
What changes now
Teams will examine QR codes in both internal and external conversations. If the system identifies a harmful URL, it displays a warning on the relevant message. Organizations with Defender for Office 365 Plan 1 or Plan 2 can also use Zero-hour Auto Purge. This tool quarantines internal chats or channel messages identified as malware or high-confidence phishing after they have already been delivered.
What to do and how to stay safe: Microsoft Teams
- Review your current Defender for Office 365 settings to ensure ZAP is enabled for internal messages.
- Monitor Message Center notices for updates regarding the October 2026 rollout timeline.
- Train staff to recognize that QR codes in chats may still require caution until the feature is active.
- Verify that your organization’s subscription includes Defender for Office 365 Plan 1 or Plan 2.
General security guidance from the Vector Update newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
When will this feature be available to all users?
The global rollout starts in early October 2026 and is expected to be completed by early November 2026.
Do I need to turn this feature on manually?
No, organizations using Teams with Defender for Office 365 will receive this enhancement automatically with no separate setup required.
Does this replace the previous QR code protection?
No, this is different from the previous feature that obscured external QR codes; together they address different stages of exposure.
