Keep zero-hour auto purge on for malware, phishing and spam

Description

Zero-hour auto purge (ZAP) is on in every policy that applies to users:

• anti-malware policies: ZapEnabled $true;
• anti-spam policies: PhishZapEnabled $true and SpamZapEnabled $true, with spam and phishing actions that ZAP can carry out (Move message to Junk Email folder or Quarantine message, not Add X-header, Prepend subject line or Redirect);
• with Defender for Office 365, the Microsoft Teams protection policy: ZapEnabled $true.

Rationale

Many campaigns are only recognized minutes or hours after the first messages are delivered, for example when a link turns malicious after delivery. ZAP pulls those messages out of mailboxes retroactively. It is on by default, which makes a disabled ZAP a sign of an old troubleshooting change that was never reverted.

Impact

None known. A message moved by mistake can be released from quarantine or Junk Email.

Audit

1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a Security Reader.
2. Browse to Email & collaboration > Policies & rules > Threat policies. In Anti-malware, check Enable zero-hour auto purge for malware in every policy. In Anti-spam, check Zero-hour auto purge (ZAP) for phishing and spam in every inbound policy and the spam and phishing actions.
3. In Exchange Online PowerShell (read-only):

   Get-MalwareFilterPolicy | Format-Table Name, ZapEnabled
   Get-HostedContentFilterPolicy | Format-Table Name, PhishZapEnabled, SpamZapEnabled, SpamAction, PhishSpamAction, HighConfidencePhishAction
   Get-TeamsProtectionPolicy | Format-Table Name, ZapEnabled
   

4. Fail if one of the ZAP values is False in a policy that applies to users, or if a spam or phishing action is AddXHeader, ModifySubject or Redirect.

Remediation

1. In the Defender portal, edit each anti-malware and anti-spam policy, turn the ZAP options on and set the actions as in CB-M365-MAIL-030.
2. PowerShell equivalent (Security Administrator):

   Get-MalwareFilterPolicy | Set-MalwareFilterPolicy -ZapEnabled $true
   Get-HostedContentFilterPolicy | Set-HostedContentFilterPolicy -PhishZapEnabled $true -SpamZapEnabled $true
   Set-TeamsProtectionPolicy -Identity "Teams Protection Policy" -ZapEnabled $true
   

   (Preset policies cannot be edited and already have ZAP on.)

References

• Zero-hour auto purge (ZAP) in Exchange Online Microsoft, vendor-doc, accessed 2026-10-24
• Recommended settings for EOP and Microsoft Defender for Office 365 security Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft 365 security suite baseline CISA, standard, accessed 2026-10-24
• ORCA - Office 365 Recommended Configuration Analyzer (checks ORCA-120, ORCA-121) Microsoft (community project), tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-MAIL-030 Apply the recommended inbound anti-spam actions with no allowed senders or domains
• related CB-M365-MAIL-034 Turn on automated remediation of malicious message clusters in AIR
• related CB-M365-COLLAB-033 Keep zero-hour auto purge enabled for Teams messages

People and lifecycle