Microsoft Teams Will Flag Deepfakes in Your Meetings This November

The next Teams meeting you join might come with a quiet new feature: a verdict on whether the people on the call are real. Microsoft has added two new security capabilities to the Microsoft 365 Roadmap for Teams, tracked as roadmap ID 573451, that will let certified third-party detection tools scan meeting audio and video for signs of synthetic or manipulated media, and add a separate impersonation protection feature that flags suspicious meeting organizers and participants. Both are listed as in development, with rollout beginning in November 2026.

This is a notable shift in how the meeting platform thinks about trust. For years, the security question in video meetings was about who had the link. Now it is about whether the face and voice on the other end were generated by software. The timing is no accident: AI-generated voices and faces have become convincing enough that criminals are using them to raid corporate bank accounts, and the meeting room has become a crime scene.

How the deepfake detection will work

The important detail is the division of labor. Microsoft is not building its own deepfake detector. Instead, Teams will act as the integration layer: certified third-party providers analyze the meeting's audio and video for signs of synthetic or manipulated content, then send detection signals to Teams, which surfaces them through in-meeting experiences and controls.

As Microsoft puts it in the roadmap entry, organizations can enhance meeting security with synthetic audio and video detection solutions provided by certified third-party providers. The providers do the analysis. Teams provides the platform integration and the interface for acting on the signals. This means the feature's effectiveness will depend on which detection vendors Microsoft certifies and which ones an organization chooses to deploy. Microsoft has not named the certified providers, and it has not said whether the integration will require an additional license, two gaps IT teams will be watching closely.

The roadmap entry lists the scope as Desktop, Mac, and the web, in the Worldwide Standard Multi-Tenant cloud. The plan includes a targeted release phase followed by general availability in November 2026. As with all roadmap entries, those dates are targets that can shift, not promises stamped in stone.

The second feature: impersonation protection

The companion feature is built directly into Teams rather than supplied by a third party, and it targets identity rather than media. When Teams detects a potential impersonation attempt, it will surface warnings and risk indicators designed to help users recognize suspicious identities and make more informed decisions when joining or participating in a meeting.

That distinction matters. Deepfake detection asks whether the audio and video are synthetic. Impersonation protection asks whether the person claiming to be your CFO actually is, even if the media itself looks clean. Together they cover the two halves of the modern meeting scam: fake media and false identity.

The security question in video meetings used to be about who had the link. Now it is about whether the face and voice on the other end were generated by software.

Why now: the meeting room has become a crime scene

The announcements land against a backdrop of increasingly brazen attacks. In 2024, the engineering firm Arup confirmed it had lost about $25 million after a finance employee in Hong Kong joined a video call in which every other participant, including the CFO, turned out to be a deepfake. The employee made the transfers because the meeting looked and sounded legitimate. Back in 2022, the FBI warned that deepfake personas were being used in remote job interviews to land positions, sometimes to funnel salaries to sanctioned regimes. The scams have only grown more sophisticated since.

Microsoft has been hardening Teams against adjacent threats for months. The company said in December that administrators would be able to lock external users through the Defender portal starting in January to counter cybercrime groups, including ransomware gangs, abusing Teams in social engineering attacks. More recently, Teams began blurring QR codes sent by external senders as a defense against phishing, and a new meeting protection policy rolled out in August that lets admins automatically block identified external bots from joining meetings. The deepfake and impersonation features are the next layer in that stack.

What IT administrators should plan for

For enterprise IT teams, the roadmap entry is a planning trigger, not a finished product. Organizations that want the deepfake detection will need to pick a supported provider, deploy its application, grant the required permissions, and configure meeting policies before any of it works. That is real administrative overhead, and it will compete for attention with everything else already on the 2027 security roadmap.

There are also open questions that only deployment experience will answer. How often will the detectors produce false positives, and what happens to a legitimate meeting when one fires? Will participants see a warning in the moment, or will only admins get the signal? How does detection behave across accents, low-bandwidth audio, and compressed video? These details will determine whether the feature becomes a trusted safeguard or another alert that fatigued users learn to dismiss.

The bigger picture

Step back and the pattern is clear: collaboration platforms are turning into identity verification platforms. The meeting is no longer just a place to talk; it is a channel where money moves, hiring decisions happen, and sensitive information changes hands. Once criminals realized that, the platforms had no choice but to treat every participant as unverified until proven otherwise.

November is close, and the targeted release will be the first real test of whether third-party deepfake detection can survive contact with the chaos of real enterprise meetings. If it works, expect every major collaboration vendor to follow within quarters. If it does not, the industry will learn that detection is harder than integration, and the arms race between generators and detectors will simply move to a bigger stage.