An IT-support call in Teams needs a verified ticket before remote access
Check the caller’s organization and support case through your known helpdesk before installing an agent or sharing account approvals.
In brief
Microsoft’s September 2026 analysis describes attackers impersonating IT support through external Teams interactions. A call arriving in a familiar work application is not proof the caller is your organization’s helpdesk.
A known ticket and independent callback can establish the support context before a remote session begins.
Do not let urgency supply authority
An unexpected caller may refer to mail trouble or another disruption to sound timely. Confirm through your established support channel. Do not use a number or link newly supplied by that caller as the independent check.
Control the requested session
For a verified case, understand the technician’s task and the approved tool. Do not reveal passwords or read sign-in codes aloud. Installation of a remote agent can create access beyond the current call, so follow the organization’s actual process.
If access was granted
Contact the real IT/security team and stop sensitive work as directed. Preserve the call context and installed tool details. Closing Teams does not necessarily stop a separately installed remote-management service.
Before you act
External Teams communication has legitimate uses. The issue is unverified authority and requested access, not that every external message is malicious.
What to do next
- Check whether you requested support and whether an existing ticket matches the caller.
- Verify through the helpdesk route already used by your organization.
- Reject an unverified remote session and report it, preserving the caller and timing privately.
