Microsoft Defender XDR: Investigate suspicious Microsoft Teams calls and meetings with advanced hunting

Microsoft Defender XDR’s CallActivityEvents table enables security teams with Defender for Office 365 Plan 2 to investigate suspicious Microsoft Teams calls and meetings by analyzing activities, initiators, organizers, and related messages. Available worldwide from November 2026, it integrates with advanced hunting, event streaming API, and Microsoft Sentinel for enhanced threat detection. When investigating a suspicious Microsoft Teams call or meeting, your security team needs to understand what happened, who initiated the activity, and the organization associated with the initiator. The CallActivityEvents table in Microsoft Defender XDR advanced hunting provides visibility into activities performed during Teams calls and meetings in your organization. Security teams can use this information to investigate suspicious activity, review related messages, and correlate findings with other security signals. This capability is available to organizations with Microsoft Defender for Office 365 Plan 2.  Rollout schedule General Availability (Worldwide): Beginning in early November 2026 and expected to complete by mid-November 2026 Impact on your organization Who is affected Security operations and threat hunting teams in organizations with Microsoft Defender for Office 365 Plan 2 Platforms and services Microsoft Defender XDR advanced hunting Microsoft Teams What will happen Your security team can use the CallActivityEvents table on the Advanced hunting page in the Microsoft Defender portal to: Understand what happened by reviewing activities performed during Teams calls and meetings, including whether an activity succeeded or failed and whether it was performed on the initiator or another participant. Investigate who initiated an activity by reviewing the initiator’s identity, account and membership types, organization, tenant region, and Teams client platform. Identify the organizer by reviewing the identity and tenant of the user who organized the call or meeting. Review related messages by joining CallActivityEvents with the MessageEvents table using ThreadId to examine recorded messages exchanged in the associated call or meeting chat. Broaden investigations by correlating call and meeting activity with other available advanced hunting data. Call and meeting activity data will also be available through the event streaming API and Microsoft Sentinel API, allowing security teams to incorporate the data into existing security monitoring and investigation workflows. Action required and recommendations […]

The post Microsoft Defender XDR: Investigate suspicious Microsoft Teams calls and meetings with advanced hunting appeared first on M365 Admin.