Microsoft is rolling out a new Teams admin report to help identify unexpected or abnormal communication patterns with external organisations.
The External domain anomalies report should provide an overview of how users in the tenant interact with people outside the organisation and flag sudden spikes or unusual engagement that fall outside normal patterns, helping ensure external collaboration remains secure and any unexpected activity can be investigated promptly.
The External Domain Anomalies Report in the Microsoft Teams admin center helps administrators identify unusual external collaboration patterns between users in the organization and external domains.
This detection focuses specifically on first-time external-to-internal contact. Ongoing or previously established relationships are not evaluated in the same way. The signal is designed based on observations that higher-risk scenarios often correlate with sudden increases in new external contact from a domain. By emphasising first-time interaction patterns rather than ongoing collaboration, the report highlights deviations from typical organisational behaviour.
The report is available in the Teams admin center > Analytics & reports > Protection reports. Administrators can select the Communication anomalies report, choose a date range of up to the last 10 days, and run it to review the findings.
Results show which external domains have displayed unusual communication activity, including the total number of anomalies detected and details about new one-to-one and group threads initiated by contacts from those domains. An option to block an external domain is also available directly within the report.
In addition to manually viewing the report, Teams administrators can enable automatic daily alerts summarising the top five external domains with unusual activity. Alerts are not enabled by default.
These alerts can be configured to post notifications to a specific Teams channel, keeping security teams informed without requiring them to check the report manually each day.
The rollout should be completed by April 2026.
