PhitalysFake Teams meetings: how to spot simulated presence
Published 20 August 2026 · Phitalys
Your team member has been "In a meeting" since 9 a.m. Yesterday too. All of last week as well. Their Teams status is impeccable, their calendar shows "Busy" — and yet deliverables are slipping, emails go unanswered, and nobody has ever actually seen them in any of those calls. The fake Teams meeting is one of the simplest ways to simulate presence: it requires no software, no technical skill, and it is almost invisible to a manager. This article explains how it works, why the calendar won't reveal it, which converging signals in your presence data give it away — and, above all, how to respond without turning a hunch into an accusation.
How it works: the anatomy of a fake Teams meeting
The mechanism takes three clicks. Teams automatically syncs presence status with the calendar: as soon as someone joins a meeting, their status switches to "In a meeting" without any action on their part. So it is enough to create a recurring meeting — every day from 9 a.m. to noon, say — and join it as the only attendee, camera off and microphone off, to display a continuous, credible busy status.
No gadget, no script: the person joins their own meeting from their computer or phone, then goes and does something else. From the outside, everything looks normal: the presence dot shows "In a meeting", the calendar is full, the status changes throughout the day. That is precisely what makes this technique more discreet than a manually forced status, which eventually freezes without transitions and gets noticed.
One clarification is needed up front: blocking recurring slots in your own calendar is also a perfectly legitimate practice. Many employees reserve focus time this way to make progress on deep work. A recurring slot proves nothing on its own; it is the convergence of several signals, over time, that deserves attention.
Why the calendar won't show it
A manager who checks a team member's shared calendar sees, in most configurations, nothing more than availability information: "Busy", sometimes the meeting subject, rarely anything else. They see neither the attendee list, nor who organised the meeting, nor — even less — whether a camera or microphone was ever switched on during the session.
On the presence side, Teams displays exactly the same "In a meeting" dot whether it is an executive committee with twelve attendees or a solitary meeting with no exchange at all. The status does not distinguish the nature of the meeting; it merely records that a session is in progress. In other words, the only two tools a manager relies on day to day — status and calendar — are exactly the ones this technique hijacks. The relevant information lives elsewhere, in signals the interface does not show.
The detectable signature of a fake Teams meeting
While a fake Teams meeting is invisible to the naked eye, it does leave an identifiable signature in Microsoft 365 usage data. Three characteristics show up in most cases:
- A lone organiser. The meeting is created and joined by the same person, who is its only attendee, session after session.
- A mechanical recurrence. The same slot repeats identically, day after day or week after week, without the natural variations of a real calendar.
- No media at all. No camera, no microphone, no screen sharing, across every occurrence — which clearly sets these slots apart from an actual working meeting.
Each of these elements, taken in isolation, is harmless. It is their repeated combination that becomes meaningful, especially when it coincides with an absence of output during the same hours: no email sent, no message, no document edited. The same logic applies to detecting mouse jigglers and other activity simulators — human work is irregular; simulation is not.
This convergence-based approach is what Phitalys' Microsoft 365 presence analysis implements: a read-only connection through the Graph API, with tenant admin consent and no software installed on employee devices. The fake meeting is one signal among the detection signals Phitalys monitors — alongside statuses frozen without transitions, unnaturally regular activity patterns, or out-of-hours activity without output. The result is never an automated verdict: it is a set of dated, explainable data points anyone can examine and discuss.
What to do as a manager: conversation first
Faced with a doubt, the worst reaction would be to turn an intuition into an accusation. An "always in a meeting" status can cover very different realities: a genuine need for focus time, a recurring meeting inherited from an old project and never deleted, an unevenly distributed workload, a temporary personal difficulty, or a disengagement that is first and foremost a management issue.
The first step is therefore an ordinary one-to-one: talk about workload, priorities, organisation, availability. In the vast majority of cases, that conversation is enough to understand — and often to resolve — the situation.
If the doubt persists and the issue becomes collective (perceived unfairness within the team, deliverables at risk, tension), factual reference points change the nature of the exchange: you are no longer discussing an impression, but dated elements the employee can explain, contextualise or contest. That is the real point of the approach: the reliability of the presence signal and fairness between colleagues — not the surveillance of an individual.
Compliance: the framework comes before the tool
Observing presence signals touches employees' personal data, and the framework must come before the tool. Employee monitoring is lawful in most jurisdictions only under strict transparency conditions. In France, the Labour Code requires that employees be informed beforehand of any system collecting data about them (Article L1222-4) and that the works council (CSE) be consulted before any activity-monitoring measure is deployed (Article L2312-38). Evidence produced by a system employees were never told about may be dismissed in litigation — the assessment always depends on the specifics of each case. Similar transparency and consultation duties exist in many other European countries.
Under GDPR, data-protection authorities call for minimisation and proportionality. That is the purpose of the safeguards built into Phitalys: only activity volumes are processed, never the content of emails, messages or documents; aggregates covering fewer than five people are masked; every access to individual-level data is logged; and detection modules are off by default, to be enabled explicitly once the internal framework is in place. These commitments are detailed on our security and compliance page.
One point of honesty to close: no tool can guarantee that a data point will be admissible before a judge, or that an HR decision will be legally sound. Before any disciplinary use of these signals, legal advice specific to your context remains necessary.
FAQ: three frequent questions
Is a recurring meeting where I am alone necessarily suspicious?
No. Reserving slots for deep work is a common and healthy practice. The difference plays out over time and through convergence: a strict recurrence, with never a camera, microphone or attendee, combined with a total absence of output during the same hours, constitutes a data point — not proof.
Do you need to install software on devices to detect these meetings?
No. Phitalys is agentless: a read-only connection through the Microsoft Graph API, authorised by a tenant administrator's consent. No software is deployed on workstations, and no content is ever read.
Can these signals justify a sanction?
They are not meant to decide anything on their own. They are dated, explainable elements designed to open a two-way conversation, not to deliver a verdict. Their possible use in a formal procedure depends on respecting the framework (informing employees, consulting employee representatives, proportionality) and on legal analysis specific to each situation.