Microsoft is adding an extra layer of protection for QR codes that arrive in Teams messages from people outside the organization. Images containing QR codes sent by external users will now appear blurred by default. This should help reduce phishing and fraud risk.
For users, an image with a QR code from an external sender is not fully visible right away. If they recognize the sender and trust the content, they can reveal the image and then view or scan the QR code as usual.
The blur is only a precaution. It does not mean Teams has found the QR code to be harmful, so trusted conversations with external partners, customers, or suppliers continue to work as before. It should give users a moment to pause and check who sent the image before they scan anything.
A bit annoying: whether a revealed image stays visible depends on the platform and the current user session.
- If users reveal the code on desktop, it’s still blurred on mobile and web.
- If users reveal it on desktop, the reveal is stored for the current session. If they restart their Teams client, it's blurred again. The same happens on other platforms.
It seems Microsoft assumes users may have forgotten the previous trusted sender after a restart or platform switch, so Teams blurs the image again, just in case. 🤷♂️
The protection applies automatically to QR code images received from external senders. Users do not need to turn anything on (they also cannot turn anything off). Administrators have no control over this updated user experience.
The updated experience will be available for Teams on desktop, web, and mobile. The rollout should be complete by late October 2026.
No comments yet