(Updated) Update on custom domain guidance for Teams Event emails

🚨 The Signal: Microsoft Teams event emails no longer require a custom domain for custom HTML editing. This change removes a previous security best practice, potentially increasing phishing risk and reducing sender trust for external recipients.

The Impact

External recipients are affected by a higher risk of phishing and reduced trust in Teams event emails.

• External recipients: Increased risk of phishing due to less recognizable sender identities.
• External recipients: Reduced trust in event communications from your organization.
• Security teams: Potential increase in helpdesk tickets regarding suspicious emails.

The Action

1. Review existing Teams event email configurations for custom domain usage.
2. Prioritize configuring a custom domain for all Teams event communications.
3. Communicate to users the importance of verifying sender identity for event emails.
4. Educate external recipients on how to identify legitimate event communications.

Domain: Teams · Impact: medium · Workload: Teams