Badges on profile cards in Teams

🚨 The Signal: Microsoft Teams profile cards will now display existing Awards and Certifications from Microsoft 365 profiles. This exposes additional user professional data, potentially increasing the attack surface for social engineering.

The Impact

All users with populated Awards and Certifications data face increased social engineering risk due to expanded public profile information.

• End users: More personal data visible, increasing social engineering risk.
• Security teams: Need to assess data exposure and potential for targeted attacks.
• HR/Compliance: Review policies on public display of professional credentials.

The Action

1. Review existing Microsoft 365 profile data for Awards and Certifications.
2. Assess the sensitivity of this data and its public visibility implications.
3. Communicate to users about the new visibility of their professional data.
4. Update internal security awareness training to include social engineering risks related to expanded profile data.

Domain: Teams · Impact: medium · Workload: Teams