Microsoft Defender for Office 365
Email and collaborationMdo Support Teams Sec Ops Guide
In brief
The guide now links to the CallActivityEvents table, which contains raw data about activities during Microsoft Teams calls and meetings. The documentation date was also updated.
What Defender admins need to know
Administrators can use the guide to locate Teams call and meeting activity data.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
tier1 description: A prescriptive playbook for SecOps personnel to manage Microsoft Teams protection in Microsoft Defender for Office 365. ms.service: defender-office-365 ms.date: 2026-10-
05T00:28T00:00:00.0000000Z locale: en-us document_id: 92aff1cd-08c4-9c50-3fe1-dd32992345be document_version_independent_id: 92aff1cd-08c4-9c50-3fe1-dd32992345be- MessagePostDeliveryEvents: Contains raw data about ZAP events on Teams messages.
- MessageUrlInfo: Contains raw data about URLs in Teams messages.
- UrlClickEvents: Contains raw data about every allowed or blocked URL click by users in Teams clients.
- CallActivityEvents: Contains raw data about activities performed during Microsoft Teams calls and meetings in your organization.
SecOps team members can join these hunting tables with other workload tables (for example, EmailEvents or Device-related tables) to gain insight into end to end user activities.
@@ -17,7 +17,7 @@ ms.collection: - tier1 description: A prescriptive playbook for SecOps personnel to manage Microsoft Teams protection in Microsoft Defender for Office 365. ms.service: defender-office-365-ms.date: 2026-10-05T00:00:00.0000000Z+ms.date: 2026-10-28T00:00:00.0000000Z locale: en-us document_id: 92aff1cd-08c4-9c50-3fe1-dd32992345be document_version_independent_id: 92aff1cd-08c4-9c50-3fe1-dd32992345be@@ -118,6 +118,7 @@ SecOps team members can proactively hunt for potentially malicious Teams message - [MessagePostDeliveryEvents](/en-us/defender-xdr/advanced-hunting-messagepostdeliveryevents-table): Contains raw data about ZAP events on Teams messages.
- [MessageUrlInfo](/en-us/defender-xdr/advanced-hunting-messageurlinfo-table): Contains raw data about URLs in Teams messages.
- [UrlClickEvents](/en-us/defender-xdr/advanced-hunting-urlclickevents-table): Contains raw data about every allowed or blocked URL click by users in Teams clients.
+ - [CallActivityEvents](/en-us/defender-xdr/advanced-hunting-callactivityevents-table): Contains raw data about activities performed during Microsoft Teams calls and meetings in your organization.
SecOps team members can join these hunting tables with other workload tables (for example, EmailEvents or Device-related tables) to gain insight into end to end user activities.