External Unmanaged Teams Account Created Chat With Internal User

Tun Tun Naing@tuntun

•updated Aug 23, 2026•17•0•24

Detects new Microsoft Teams chats created by external unmanaged Microsoft accounts, identified by a .cid. prefixed UserId, targeting internal users. It is intended to identify possible impersonation, social engineering, or BEC-style activity.