Advanced Hunting adds Teams MessageContents table for message investigations
Microsoft Defender for Office 365 is introducing a new MessageContents table in Advanced Hunting for Microsoft Teams messages. The table will let authorized security analysts query message snippets and metadata during threat investigations, with worldwide rollout scheduled from late September through mid-October 2026.
- New MessageContents table for Teams hunting
Defender XDR · Hunting and detectionAdvanced Hunting will expose a MessageContents table containing Teams message snippets and metadata for authorized analysts investigating threats. The capability rolls out worldwide from late September to mid-October 2026 and requires appropriate permissions.
Verify that intended analysts have the appropriate permissions to access the new table, and account for the rollout window when planning Teams threat-hunting workflows.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
Updates this week
No tracked updates
There are no documentation or Message Center changes recorded for this week.