Back to Checks
m365

Messaging policy has security reporting enabled

teams_security_reporting_enabled
Service: teamsSeverity: medium
OfficialBuilt-inVerified
Categories:e3
Resource Type:NotDefined

Teams messaging policies enable end-user security reporting via AllowSecurityEndUserReporting, letting users report messages from chats, channels, and meetings for security review.

Prowler logoProwlerprowler-provider-m365

Risk

Disabled reporting hides phishing, malicious links, and social engineering in Teams.

This delays detection and response, enabling lateral movement and data exfiltration, and degrading confidentiality and integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks teams_security_reporting_enabled

Recommendation

Enable AllowSecurityEndUserReporting in relevant messaging policies and route submissions to security operations for timely triage.

Reinforce defense in depth with link/file protection and monitoring, train users to report suspicious content, and apply least privilege to administrative access.

Remediation

CLI

Set-CsTeamsMessagingPolicy -Identity Global -AllowSecurityEndUserReporting $true

Other

1Sign in to the Microsoft Teams admin center: https://admin.teams.microsoft.com
2Go to Messaging policies
3Open Global (Org-wide default)
4Turn on "Report a security concern"
5Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.teams.teams_client import teams_client


class teams_security_reporting_enabled(Check):
    """Check if users can report security concerns in Teams.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the check for Teams security reporting settings.

        This method checks if security reporting is properly configured in Teams settings.

        Returns:
            List[CheckReportM365]: A list of reports containing the result of the check.
        """
        findings = []
        global_messaging_policy = teams_client.global_messaging_policy

        if global_messaging_policy:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=global_messaging_policy,
                resource_name="Teams Security Reporting Settings",
                resource_id="teamsSecurityReporting",
            )

            teams_reporting_enabled = (
                global_messaging_policy.allow_security_end_user_reporting
            )

            if teams_reporting_enabled:
                report.status = "PASS"
                report.status_extended = (
                    "Security reporting is enabled in Teams messaging policy."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    "Security reporting is not enabled in Teams messaging policy."
                )

            findings.append(report)

        return findings

References