cirsec Baselines
Esc
Microsoft 365 tenant · SharePoint, OneDrive & Teams

Keep zero-hour auto purge enabled for Teams messages

When it fails: Malicious Teams messages are not removed after delivery. A chat message later identified as malware or high-confidence phishing stays in the conversation, where users can still open it.

CB-M365-COLLAB-033mediumactivemanualprofile baseline

Description

Zero-hour auto purge (ZAP) is on in the Teams protection policy (ZapEnabled = True): when a Teams chat or channel message is identified as malware or high-confidence phishing after delivery, it is blocked for recipients and placed in quarantine. No Teams protection rule excludes users, groups or domains without a documented reason.

Rationale

Verdicts often arrive after delivery, once a URL is detonated or a campaign is recognized. ZAP removes the message retroactively, which is the only remediation that reaches every recipient before they click. It is on by default; the control guards against it being turned off or bypassed with broad exclusions.

Impact

Messages purged by ZAP disappear from the conversation for recipients and appear in quarantine, where admins can release false positives. None known otherwise.

Applies when

Requires: Microsoft Teams, Microsoft Defender for Office 365 Plan 1

Setting

LocationMicrosoft Defender portal > Email & collaboration > Policies & rules > Threat policies > Teams protection > Zero-hour auto purge (ZAP)
DefaultOn
RecommendedOn (ZapEnabled = True), no undocumented exclusions

Audit

  1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a Security Reader.
  2. Browse to Email & collaboration > Policies & rules > Threat policies > Teams protection.
  3. Check that Zero-hour auto purge (ZAP) is On and review the Exclude these participants section.
  4. With Exchange Online PowerShell (View-Only Organization Management or Global Reader): Get-TeamsProtectionPolicy | Format-List ZapEnabled and Get-TeamsProtectionPolicyRule | Format-List ExceptIfSentTo, ExceptIfSentToMemberOf, ExceptIfRecipientDomainIs.
  5. Fail if ZapEnabled is False, or if exclusions cover users or groups without a documented reason.

Remediation

  1. In the Defender portal, browse to Email & collaboration > Policies & rules > Threat policies > Teams protection, select Edit in the ZAP section, turn ZAP on, remove unjustified exclusions and Save. Role: Security Administrator.
  2. PowerShell equivalent: Set-TeamsProtectionPolicy -Identity "Teams Protection Policy" -ZapEnabled $true.
  3. Check that the quarantine policies for Teams malware and phishing let admins review purged messages.

References

Mappings

FrameworkIDRelationNote
NIST SP 800-53 Rev. 55.1.1SI-3related
NIST SP 800-53 Rev. 55.1.1SI-8related
CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0MS.TEAMS.7.1v1relatedRemoved from ScubaGear 2.0.0. It asked for malware scanning of Teams attachments; ZAP removes messages found malicious after delivery.
CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0MS.TEAMS.8.1v1relatedRemoved from ScubaGear 2.0.0, kept for traceability.

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1566.003
MITRE ATT&CKT1204.002
  • related CB-M365-COLLAB-032 Let users report suspicious Teams messages to the security team
  • related CB-M365-MAIL-024 Keep zero-hour auto purge on for malware, phishing and spam

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr