Fake "IT Help Desk" Chats on Teams: How to Stop the Quick Assist Scam

What Microsoft found

In a September 2026 report, Microsoft Threat Intelligence described attackers working from a separate Microsoft 365 organization who start a Teams chat or call while posing as IT or help desk staff. The lures included things like a "Microsoft Security Update," a "Spam Filter Update," "Account Verification," or a warning that an account was about to be deactivated. Sometimes they phoned as well, so the instructions never appeared in the chat.

The goal was always the same: get the employee to open a remote-support tool, such as Quick Assist, read back the short code, and click Allow. Once they had control, the attackers quietly installed their own software, looked around the network and tried to reach the company's most important systems.

A follow-up report in October 2026 investigated two more break-ins that started the same way, with Teams messages and calls impersonating help desk staff and a user-approved Quick Assist session. In one case, the attackers later copied data out of the company. Microsoft notes the attackers used company-themed account names and support-sounding display names to look familiar.

Two points from Microsoft are worth repeating plainly:

It's not a Teams bug. Microsoft says the activity "did not exploit a vulnerability in Microsoft Teams" and relied on social engineering, meaning persuading a person.

Teams already warns people. Microsoft says Teams shows external labels, Accept or Block prompts, message previews and phishing indicators at first contact. The scam works by convincing someone to ignore them.

The reports describe larger organizations, but the opening move needs only one employee, one Teams account and one click. That's why it matters for small businesses too.

What the warning signs look like

Teams marks people from outside your organization. Microsoft's guide to how Teams shows people outside your organization explains that these labels appear next to names in chats, calls, search results and profile cards. Your own coworkers have no badge. Someone from an organization you haven't marked as trusted shows as "External," with a note that their organization "hasn't yet been added to your org's trusted list." Microsoft's October report also shows a Teams call marked "External" and "Scam suspected."

The rule for staff is simple: your real IT person doesn't show up with an External label. If "IT Support" has that badge, stop.

Step 1: Lock down external Teams chat

By default, Teams lets your staff chat and meet with people in any other Microsoft 365 organization. Microsoft's external access admin guide confirms that "by default, all external domains are allowed." Microsoft's own advice in the September report is to restrict Teams external access to trusted domains only.

Whoever manages your Microsoft 365 can do this in a few minutes:

Sign in to the Teams admin center and go to Users > External access.

For people in external organizations, choose Allow only specific external domains.

Add the domains of the vendors, clients and partners you actually talk to on Teams. Everyone else is then blocked.

If you never use Teams with outside people at all, choose Block all external domains.

Look at the setting for unmanaged Teams accounts (personal and free Teams accounts). Turn it off, or at least clear the box that lets those accounts start conversations with your staff.

Microsoft notes that both the organization setting and each user's policy must allow external access, so you can also leave it on for just the one or two people who need it. Even with these settings, staff can still block and report any outside contact right from the chat request.

Step 2: Restrict or remove Quick Assist

Quick Assist comes with Windows and is a legitimate tool. Microsoft's Quick Assist documentation is clear about the risk: "Anyone that has control over your device can perform actions on your device, and potentially install malicious applications."

Your options, from lightest to strongest:

If nobody uses it, remove it. Microsoft says that if your organization uses another remote-support tool, or doesn't use Quick Assist, disabling or removing it is "a best practice." On each computer, go to Settings > Apps > Installed apps > Quick Assist, select the three dots and choose Uninstall. Your IT provider can remove it from every computer at once with a single command from Microsoft's documentation.

Block it at the network. Microsoft explains that blocking the main Quick Assist service address stops it from working on your network. Note that this also breaks Microsoft's Intune Remote Help, which uses the same service.

Use a managed tool instead. For businesses whose computers are managed in Intune, Microsoft recommends considering Intune Remote Help, which limits who can provide help and keeps logs of each session.

Whatever you choose, keep one approved remote-support tool and make sure staff know which one it is.

Step 3: Set a "we'll never message you first" rule

Microsoft's own guidance for Quick Assist is: "Never allow a connection to your device by someone claiming to be 'IT Support' unless you initiated the interaction with them." Microsoft also says it "will never contact you through unsolicited emails, phone calls, or other methods to request access to your device."

Turn that into a one-line company rule and share it at your next team meeting:

"Our IT support will never message or call you first asking for remote access. If anyone does, don't open anything. Hang up and tell us."

Add the specifics: who your IT person or provider is, the one remote tool you use and what an urgent problem actually looks like. Microsoft also suggests a help desk check phrase that real IT staff can say and an impostor can't.

Step 4: Add a call-back check

Microsoft recommends verifying any unsolicited support request "through a known internal channel" before joining a call, sharing a screen or starting a remote session. In practice:

End the chat or call. Don't argue or explain.

Call your IT person or provider back on a number you already have saved, not one given in the chat.

Ask whether they really contacted you. If they didn't, report the chat in Teams and block the person.

If someone already gave control, disconnect right away and tell your IT provider the same day. Microsoft advises treating that computer as compromised and changing any sign-in details that were used on it.

A five-minute checklist

Teams external access limited to the organizations you actually work with

Unmanaged Teams accounts blocked from starting chats

Quick Assist removed or blocked if you don't use it

One approved remote-support tool, and everyone knows which one

The "we'll never message you first" rule shared with staff

A saved call-back number for your IT support

For the email side of the same problem, see our small business email phishing security checklist.

How Local Business Search can help

Local Business Search provides small-business IT support, including Microsoft 365 and Teams setup. We can review your Teams external access settings, remove or replace Quick Assist, set up one safe remote-support tool and write a simple security rule your staff will actually remember.

We're also making done-for-you how-to videos that walk through each of these settings step by step. They're coming soon.