# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-COLLAB-033
title: Keep zero-hour auto purge enabled for Teams messages
finding:
  title: Malicious Teams messages are not removed after delivery
  description: A chat message later identified as malware or high-confidence phishing stays in the conversation, where users can still open it.
status: active
profiles: [baseline]
risk:
  severity: medium
assessment: manual
tags: [teams, zap, malware, phishing, defender-for-office-365]

applicability:
  requires:
    - Microsoft Teams
    - Microsoft Defender for Office 365 Plan 1

description: |
  Zero-hour auto purge (ZAP) is on in the Teams protection policy (`ZapEnabled` = `True`): when a
  Teams chat or channel message is identified as malware or high-confidence phishing after delivery,
  it is blocked for recipients and placed in quarantine. No Teams protection rule excludes users,
  groups or domains without a documented reason.
rationale: |
  Verdicts often arrive after delivery, once a URL is detonated or a campaign is recognized. ZAP
  removes the message retroactively, which is the only remediation that reaches every recipient before
  they click. It is on by default; the control guards against it being turned off or bypassed with
  broad exclusions.
impact: |
  Messages purged by ZAP disappear from the conversation for recipients and appear in quarantine,
  where admins can release false positives. None known otherwise.

setting:
  location: Microsoft Defender portal > Email & collaboration > Policies & rules > Threat policies > Teams protection > Zero-hour auto purge (ZAP)
  default_value: "On"
  recommended_value: On (ZapEnabled = True), no undocumented exclusions

audit:
  manual: |
    1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a Security
       Reader.
    2. Browse to **Email & collaboration** > **Policies & rules** > **Threat policies** > **Teams
       protection**.
    3. Check that **Zero-hour auto purge (ZAP)** is **On** and review the **Exclude these participants**
       section.
    4. With Exchange Online PowerShell (View-Only Organization Management or Global Reader):
       `Get-TeamsProtectionPolicy | Format-List ZapEnabled` and
       `Get-TeamsProtectionPolicyRule | Format-List ExceptIfSentTo, ExceptIfSentToMemberOf, ExceptIfRecipientDomainIs`.
    5. Fail if `ZapEnabled` is `False`, or if exclusions cover users or groups without a documented
       reason.

remediation:
  manual: |
    1. In the Defender portal, browse to **Email & collaboration** > **Policies & rules** > **Threat
       policies** > **Teams protection**, select **Edit** in the ZAP section, turn **ZAP** on, remove
       unjustified exclusions and **Save**. Role: Security Administrator.
    2. PowerShell equivalent:
       `Set-TeamsProtectionPolicy -Identity "Teams Protection Policy" -ZapEnabled $true`.
    3. Check that the quarantine policies for Teams malware and phishing let admins review purged
       messages.

references:
  - title: Microsoft Defender for Office 365 support for Microsoft Teams
    url: https://learn.microsoft.com/defender-office-365/mdo-support-teams-about
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Zero-hour auto purge in Microsoft Defender for Office 365
    url: https://learn.microsoft.com/defender-office-365/zero-hour-auto-purge
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Set-TeamsProtectionPolicy
    url: https://learn.microsoft.com/powershell/module/exchangepowershell/set-teamsprotectionpolicy
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
mappings:
  - framework: cis-m365
    framework_version: "7.0.0"
    id: "2.4.4"
    relation: equivalent
  - framework: cisa-scuba-m365
    framework_version: "2.0.0"
    id: MS.TEAMS.7.1v1
    relation: related
    note: Removed from ScubaGear 2.0.0. It asked for malware scanning of Teams attachments; ZAP removes messages found malicious after delivery.
  - framework: cisa-scuba-m365
    framework_version: "2.0.0"
    id: MS.TEAMS.8.1v1
    relation: related
    note: Removed from ScubaGear 2.0.0, kept for traceability.
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: SI-3
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: SI-8
    relation: related
threats:
  - framework: mitre-attack
    id: T1566.003
  - framework: mitre-attack
    id: T1204.002
related_controls:
  - id: CB-M365-COLLAB-032
    type: related
  - id: CB-M365-MAIL-024
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24