External User Activity in Microsoft Teams

Rudra Verma@Rudraverma

•updated Feb 1, 2026•17•1•106

This rule detects chat or call activity by external users in Microsoft Teams whose source tenant is not present in a pre-defined whitelist. This could indicate unauthorized external communication or potential data exfiltration attempts.