My memory is a little hazy as I approach my 40th year on this earth next week, but it doesn't seem too long ago that Teams was added into Defender for Office 365. And when I think of the two together, I typically think about Safe Attachments and Safe Links, and their application via built-in security policies, or through custom policies within the Microsoft 365 Defender Portal. But now - after Microsoft Secure a few months back - we have seen the introduction of 'Collaboration Security for Microsoft Teams'. Sounds awesome. And I almost had to crack a smile whilst I was sitting there in that hotel room in Paris doing Secure since I actually worked on parts of it over recent months through inner ring testing without ever knowing what it was meant to be, or what the totality of it was. By definition CSMT is 'the full feature set that customers use to protect their email environments across prevention, detection, and response to Microsoft Teams'. In other words its bringing Teams fully into it's Extended Detection and Response (EDR) solution which is Microsoft 365 Defender, which correlates signals and alerts across others domains such as identities and endpoints. Why is this important? In the words of Microsoft 'Attacks like phishing and ransomware that for decades have primarily used email as an entry point, are now also targeting users on collaboration tools with growing frequency' which makes sense given that Teams is now used by over 300 million users worldwide - many of whom it is fair to say are not protected to the extent they could be. So who can use CSMT?, 'If you are a customer of Microsoft E5, Microsoft E5 Security, or Microsoft Defender for Office 365 (Here meaning Plan 2, not Plan 1) you can take advantage of [this set of new capabilities] immediately and improve the security of your Microsoft Teams'. Very exciting then. Now this blog post was in fact meant to come out a month ago and was meant to be the lead off to a whole CSMT series: but a bug in my Ring 4 test environment meant I had to do attack simulation first. C'est la vie. We are going to enable CSMT and report a suspicious message for our security admins.