{
  "id": "CB-M365-COLLAB-033",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-033",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-033.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-033.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-COLLAB-033",
    "title": "Keep zero-hour auto purge enabled for Teams messages",
    "finding": {
      "title": "Malicious Teams messages are not removed after delivery",
      "description": "A chat message later identified as malware or high-confidence phishing stays in the conversation, where users can still open it."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "teams",
      "zap",
      "malware",
      "phishing",
      "defender-for-office-365"
    ],
    "applicability": {
      "requires": [
        "Microsoft Teams",
        "Microsoft Defender for Office 365 Plan 1"
      ]
    },
    "description": "Zero-hour auto purge (ZAP) is on in the Teams protection policy (`ZapEnabled` = `True`): when a\nTeams chat or channel message is identified as malware or high-confidence phishing after delivery,\nit is blocked for recipients and placed in quarantine. No Teams protection rule excludes users,\ngroups or domains without a documented reason.\n",
    "rationale": "Verdicts often arrive after delivery, once a URL is detonated or a campaign is recognized. ZAP\nremoves the message retroactively, which is the only remediation that reaches every recipient before\nthey click. It is on by default; the control guards against it being turned off or bypassed with\nbroad exclusions.\n",
    "impact": "Messages purged by ZAP disappear from the conversation for recipients and appear in quarantine,\nwhere admins can release false positives. None known otherwise.\n",
    "setting": {
      "location": "Microsoft Defender portal > Email & collaboration > Policies & rules > Threat policies > Teams protection > Zero-hour auto purge (ZAP)",
      "default_value": "On",
      "recommended_value": "On (ZapEnabled = True), no undocumented exclusions"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a Security\n   Reader.\n2. Browse to **Email & collaboration** > **Policies & rules** > **Threat policies** > **Teams\n   protection**.\n3. Check that **Zero-hour auto purge (ZAP)** is **On** and review the **Exclude these participants**\n   section.\n4. With Exchange Online PowerShell (View-Only Organization Management or Global Reader):\n   `Get-TeamsProtectionPolicy | Format-List ZapEnabled` and\n   `Get-TeamsProtectionPolicyRule | Format-List ExceptIfSentTo, ExceptIfSentToMemberOf, ExceptIfRecipientDomainIs`.\n5. Fail if `ZapEnabled` is `False`, or if exclusions cover users or groups without a documented\n   reason.\n"
    },
    "remediation": {
      "manual": "1. In the Defender portal, browse to **Email & collaboration** > **Policies & rules** > **Threat\n   policies** > **Teams protection**, select **Edit** in the ZAP section, turn **ZAP** on, remove\n   unjustified exclusions and **Save**. Role: Security Administrator.\n2. PowerShell equivalent:\n   `Set-TeamsProtectionPolicy -Identity \"Teams Protection Policy\" -ZapEnabled $true`.\n3. Check that the quarantine policies for Teams malware and phishing let admins review purged\n   messages.\n"
    },
    "references": [
      {
        "title": "Microsoft Defender for Office 365 support for Microsoft Teams",
        "url": "https://learn.microsoft.com/defender-office-365/mdo-support-teams-about",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Zero-hour auto purge in Microsoft Defender for Office 365",
        "url": "https://learn.microsoft.com/defender-office-365/zero-hour-auto-purge",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-TeamsProtectionPolicy",
        "url": "https://learn.microsoft.com/powershell/module/exchangepowershell/set-teamsprotectionpolicy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.TEAMS.7.1v1",
        "relation": "related",
        "note": "Removed from ScubaGear 2.0.0. It asked for malware scanning of Teams attachments; ZAP removes messages found malicious after delivery."
      },
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.TEAMS.8.1v1",
        "relation": "related",
        "note": "Removed from ScubaGear 2.0.0, kept for traceability."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-3",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-8",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1566.003"
      },
      {
        "framework": "mitre-attack",
        "id": "T1204.002"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-COLLAB-032",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-024",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}