The roadmap just makes the whole thing user-facing so there's a status in Teams of where you currently are. But IT knew all along. And if IT didn't have tools deployed to get this info already count yourself lucky to work at an immature org security-wise.

I will say that "IT knows where I am" and "my manager / manager's manager / whatever sees where I am on Teams" would represent two very different personal annoyance levels at most companies I've worked at; at most places I've worked getting someone's location through IT required them to be doing something questionable or illegal (ie - working from an unapproved country) or breaking some obnoxious return-to-office policy, not just "hey is Bob out to lunch again or is he over in Building 6 so I can drive-by him with some questions real quick"

But I'll agree that Teams is packaging this information into something more digest-able for middle managers, and that's the rub. There are always manager types who have the epiphany that not everyone is working 100% of the time and it bothers them enough to call it out to subordinates, or if they don't like someone enough they might do a deep dive with IT. Teams already has this indicator to show if you're online, on mobile, in a meeting, AFK, or offline entirely. Its not that the information wasn't there, its just much more front-and-center for managers to be annoying about it.

IT having the information for security is one thing.

In the hands of power-hungry lower middle managers, it becomes a weapon.

First security job I had, the CISO had already declared that enforcing "no Youtube, porn, whatever" at work was a managerial problem and not a security problem [0]. And when management needed data from computers about an employee, they had to go through security -- they couldn't just fish around on their own. HR was involved, there was a paper trail, and requests were scope limited.

There are companies that do incredibly invasive employee monitoring, but those dystopias don't use EDR or whatever. They use some other vendor's spyware to replace management with creeping.

For some reason I'm reminded of the chains or cables used to keep operator hands (Posson's pull-backs) from being crushed in a press brake.

[0] The malware, etc that can come from those sites was a security problem -- but checking if creepy Bob was looking at boobs on company equipment or even just wasting time had nothing to do with infosec.

I followed several articles and the tree I found seems to end with this Neowin article https://www.neowin.net/news/microsoft-delays-controversial-l... but it doesn't actully clear up the sourcing. I.e. the quote in the article is the same roadmap item, yet the article talks directly to that as if it's the home SSID which will be put into Teams - where is that information in the quote it's describing? I'm not sure if they just didn't source that bit or if it's plain confusion about whether it's really limited to "connecting to your organizations Wi-Fi" which is then being picked up as a hot story.

Honestly, to me the feature seems so incredibly low-functionality that I'm surprised they're pushing it forward after all of the controversy it's generated. Like, sure, it might be nice to see if someone was out to lunch or in Building 17 or whatever without needing to message them, but at the cost of the whole "teams is spying on you" narrative and yuck-factor it pushes, I'm surprised they haven't pushed harder on either clarifying the functionality or just pulling it.

The understanding I always got from legal was "it's continually the company's legal liability under the RAY BAUM's Act whether the address is correct when the user dials 911 on/via the corporate systems, not the user's". Sometimes the conversation sounded like you could potentially have users sign something to transfer that liability, other times legal didn't seem to even want to entertain the idea as valid. Regardless, none of the companies ever ended up wanting to go that route for either concern of general friction/overhead or concern there would be employees pushing back that they don't want to sign it and instead would just want 911 to work (which is also a reasonable position for an employee to want to hold). I.e. implementing automatic VOIP location for some users but not others was either impossible on some systems or just seen as a nightmare to try to track/audit, even if they were willing to try to make every employee perfectly happy about it. A bit of a legally induced quagmire for a good intent (accurate 911 not being something a place could opt out of providing) which had trade offs in reality.

RAY BAUM's compliance requirements for for nomadic endpoints in went active in 2022 but most companies had already started trying to be compliant a little prior to that when fixed endpoints needed it anyways. Some companies of course don't bother, either knowingly or unknowingly assuming that compliance risk. Before that it wasn't really a topic.

That aside, if it is SSIDs it's dead simple to fake. If it's BSSIDs it's a little more difficult and not every AP may expose a way to spoof it (but it's not too difficult to find ones which will).

The tracking is still gross, but limited to opt-in on office WiFi seems a lot less dramatic of a headline, especially given the main concern people have is work from home

If a company policy says you have to opt in, not opting in means you're breaching the policy and might get fired. Entirely legal in at-will employment places, but potentially not in places with better worker protections.

Saying that, I just got announcement from my employer they will not be turning it on for now.

https://www.euronews.com/next/2026/01/27/france-to-ditch-us-...

That's not a bad thing.

But I think its totally unrealistic and impractical to deal with this kind of thing by being so choosy that you won't work for an org that uses Microsoft. Actually acting that way probably just means choosing to be unemployed (for the vast majority, at least).

I mean, that's not really how "opt-in" works for features that your company owns; you might have to "opt-in" technically but your company will probably make that a little more mandatory.

I do agree that the blog post, headline, and HN comments are as usual quite an overreaction, but this feature is pretty gross. It's also weird because the controversy/grossness-to-utility ratio seems awful, which either means that Microsoft product management has gotten as bad as everyone thinks it has or there's some future plan to make it more "robust."

Can't you just rename your home wifi SSID to be whatever your Work wifi is called?

If I were to try to implement the given task description, I'd start with assuming this would need to be "Enterprise gives an exports of BSSIDs and locations, Teams uses that table to set the location when you connect to your organization's AP". I'm not even sure how else to make this really work right.

If it really is SSID based, the feature would be relatively useless for most organizations even before discussion trying to spoof it. E.g. the last place I worked had ~3,500 physical addresses with APs (and many more individual buildings/"office" names), all with the same "Corp_Name_Employee" SSID because otherwise it's way more work to have unique SSIDs. So how would this feature even do what it's supposed to do based on SSID?

Maybe the enterprise exports a table of AP MAC addresses, mapped to locations. It could be the SSID stuff is just a way to spy on what non-office location you were at.

E.g. in the above deployment each Aruba AP could have up to 16 BSSIDs/MACs per radio, but we really had an average of ~5 in use per band at any given site. So a single 2.4 GHz + 5 GHz AP would have 10ish BSSIDs/MACs associated with it in the export (which would then roll up to be BSSIDs/MACs at that office).

Then any of the SSID stuff seems to be more pure speculation (at least from what I've been able to find sourced from Microsoft so far, they are very light on details). Maybe tEAMS does something with SSID, maybe it doesn't - but the roadmap item doesn't even mention that half of the behavior at all, the Neowin article at least looks to be just inserting stuff about SSIDs without any source (and this site doesn't seem to source much at all). It certainly could use SSID as a fallback when there is no location, but where are the articles finding the plan actually has anything about doing that and why would it help more than setting the status to "Remote".

At the end of the day BSSID isn't unspoofable either (companies that care that much probably just want mobile device management or to look at the wireless controller itself), but it at least enables the actual goal of saying which office to be achieved.

https://github.com/adamhrv/skylift

(Or phone tether, if you have a good data plan)

Also if they cared so much about where I was to punish me for it, I’d quit that company. The only companies I will work for are ones that treat me like an adult, it’s fairly simple.

Currently I manually check device IPs.

So, either this minimal description is A: an attempt to mask the feature's true purpose of dystopian pocket spying under an innocent-sounding cover, or B: negligently deploying a technical capability with far-reaching consequences without proper diligence or care.

Even if the goal was to enable a pocket panopticon for middle manager spying on WFH staff, in less than 10 seconds I came up with a list of other negative impacts and threat vectors which should freak out any large org's corporate security, legal, compliance and HR teams.

* Like lower level employees not in the 'shielded compartment' seeing that {M&A exec} is currently on {potential acquisition target company's} guest wifi. This kind of accidental location knowledge leak has actually happened between MSFT and Google via a freak analog coincidence and it changed the course of a huge acquisition. This feature makes that accident 1000x more likely.

* Or an employee sues for being dismissed and their lawyer proves through discovery that a manager could have seen they were connected to the wifi of a competitor they might have been interviewing with or an abortion clinic or gay bar, etc.

* Or as part of a harassment claim an employee says the company's required app showed them the phrase "Big Titz Rule!!!" because it was the name of a wifi network another employee was connected to.

Just having an opt-out or hours limit is woefully inadequate. Even if those should prevent senior execs and M&A teams location being accidentally visible to employees not in a trust circle (or worse contractors, vendors or customers looped into a Teams group), it STILL creates huge new threat surfaces. At a minimum the 'feature' needs ways to limit it to only show wifi network names: A. On an approved list, B. Matching a regex pattern, C. limited within a list of IP sub-domains, etc. And at many companies, as part of compliance, all those wifi network names will need to be passed through the "problematic words" list maintained by the HR and security teams (and in many companies hits on those lists trigger auto-reports which will now create discoverable "evidence" in any future lawsuit keyword search).

The unintended-but-foreseable consequences stretch for miles. And this isn't the MSFT Office/Teams group's first self-inflicted trip to this rodeo. I just don't understand how they keep repeating the Same. Obvious. Mistakes.

Ultimately if you are at the type of company which practices presenteeism, then the technology used is immaterial