Microsoft Teams

Is Microsoft Teams safe?

For ordinary work chat and meetings, yes. Teams does not track you across other apps for advertising, it sits behind Microsoft's strong sign-in protections, and there is little of the stranger contact that makes consumer messaging apps risky. We score it 63/100, behind Zoom (71) and WhatsApp (67).

The catches are specific. Messages are not end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary, so Microsoft and, on a work account, your employer can get at them. Microsoft's own cloud security has been heavily criticised by a US government review. And Teams has become a favourite tool for criminals who pose as IT support to get inside companies.

Who can read your Teams messages

Teams encrypts chats, files and calls while they travel and while they are stored, but Microsoft holds the keys. That is normal for workplace software, because companies need to keep records, search them in lawsuits and recover them when staff leave.

So on a work or school account, assume your organisation can read everything. Administrators set how long chats are kept, can place them on legal hold and can export private one-to-one conversations through compliance tools. Deleting a message in the app does not mean it is gone from the company's records.

End-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary exists but is narrow. According to Microsoft's documentation, it is off by default for one-to-one calls and must be allowed by an administrator. For meetings, the organiser needs a Teams Premium licence. In both cases recording, live captions and Copilot stop working. Text chats have no end-to-end option at all.

What Microsoft collects

Apple's privacy label for Teams lists no "Data Used to Track You" and no third-party advertising. Precise and coarse location, contact details, contacts, photos, audio and other content, user and device IDs and usage data are linked to you for app features and analytics. Compared with Slack, which also uses some data for its own marketing, that is a fairly restrained label.

The wider Microsoft 365 suite is less clean. In January 2026 privacy group noyb reported that Austria's data protection authority (DSB) had ruled that Microsoft 365 Education placed tracking cookies on a pupil's device without consent and ordered Microsoft to stop within four weeks. An earlier DSB decision, in October 2025, found Microsoft had breached the pupil's right of access.

Microsoft's security record

In April 2024 the US Cyber Safety Review Board published its review of a 2023 intrusion in which Chinese state hackers, tracked as Storm-0558, used a stolen Microsoft signing key to forge access to Exchange Online mailboxes of 22 organisations and 503 people, including US officials. The board blamed "a cascade of security failures at Microsoft" and said its security culture "was inadequate and requires an overhaul". Microsoft did not detect the intrusion itself; the State Department did.

That case involved email, not Teams. It matters here because Teams runs on the same Microsoft cloud and the same identity system. Microsoft has since launched a company-wide security programme, but the review is the main reason we do not score Teams higher on security.

The fake help-desk problem

Microsoft's own security team published a long report in October 2025 on criminals abusing Teams. The pattern is consistent:

• An employee's inbox is flooded with thousands of junk emails.
• Someone then messages or calls on Teams, using a name like "Help Desk", offering to fix it.
• The victim is asked to start Quick Assist or install a remote-access tool, and the attacker deploys malware or ransomware.

Microsoft attributes this to groups including Storm-1811 and Storm-1674, and Sophos has linked it to the 3AM ransomware gang. Others have sent fake Teams meeting invitations to steal sign-in codes, and in July 2025 Malwarebytes found a fake Teams installer for Mac spread through search ads.

How to use Teams safely

1. Treat any unexpected "IT support" message or call on Teams, especially from an external organisation, as suspicious. Contact your IT team through a channel you already know.
2. Never start Quick Assist or install remote-access software because someone on a call asked you to.
3. Download Teams only from Microsoft or your device's app store, not from a search ad.
4. Keep personal and sensitive conversations off a work account.
5. If you run Teams for an organisation, restrict external access to trusted domains and turn on multi-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary for everyone.

How we scored it

Privacy (65) is helped by the absence of ad tracking, and content safety (65) by the lack of public content, though help-desk impersonation pulls it down. Security (60) is the weakest factor: no end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary for chats and a damning 2024 review of Microsoft's cloud security. The regulatory record (65) reflects the EU antitrust commitments and the Austrian rulings on Microsoft 365 Education, none with a fine.