r/DefenderATP 20d ago

Microsoft Teams Classic keeps getting installed on Intune-managed devices

Hi everyone,

Microsoft Defender Vulnerability Management is detecting Microsoft Teams Classic on an increasing number of our Intune-managed Windows devices.

We previously deployed a remediation to remove Teams Classic, but the number of affected devices continues to rise. It appears that the application is being installed again after removal.

Has anyone experienced this issue recently?

I’m trying to determine:

  • What could be reinstalling Teams Classic?
  • Could Microsoft 365 Apps, Teams Machine-Wide Installer, user profile provisioning, or another update mechanism be responsible?
  • What is the recommended method to permanently remove Teams Classic from all user profiles?
  • Is there an Intune remediation or detection method that prevents it from returning?
  • How can we identify the exact installation source?

The affected application appears in MDE as “Update Microsoft Teams Classic.”

Any guidance or working remediation scripts would be greatly appreciated.

4 Upvotes

2 comments sorted by

1

u/1stITMAN 20d ago

Check your MDM sccm or intune and make sure it has been retired

1

u/pure94 16d ago

Teams machine wide installer maybe? Would make sense that it keeps coming back. It's a separate install so will need to remove that first then nuke it from the profile