Check ID:
Provider: Microsoft 365
Service:
Severity: MEDIUM
Categories:
Resource type:
defender_zap_for_teams_enabledProvider: Microsoft 365
Service:
defenderSeverity: MEDIUM
Categories:
email-security, e5Resource type:
NotDefinedWhat this check verifies
Microsoft Defender for Office 365 Zero-hour auto purge (ZAP) is a protection feature that retroactively detects and neutralizes malware and high confidence phishing in Teams messages. When ZAP blocks a message, it is blocked for everyone in the chat. The initial block happens right after delivery, but ZAP can occur up to 48 hours after delivery.Risk
Without ZAP enabled, malicious content in Teams chats remains accessible for up to 48 hours after delivery, even after being identified as harmful. This extended exposure enables malware infections, phishing attacks compromising credentials and MFA tokens, and lateral movement via compromised accounts.Recommendation
Enable Zero-hour auto purge (ZAP) for Microsoft Teams to ensure malicious content is automatically removed from chats after detection, even if it was delivered before being identified as harmful.Remediation
- CLI
- Dashboard steps
Set-TeamsProtectionPolicy -Identity ‘Teams Protection Policy’ -ZapEnabled $true
References
- https://learn.microsoft.com/en-us/defender-office-365/zero-hour-auto-purge?view=o365-worldwide#zero-hour-auto-purge-zap-in-microsoft-teams
- https://learn.microsoft.com/en-us/defender-office-365/mdo-support-teams-about?view=o365-worldwide
Where this check fires
This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable byCheck ID = defender_zap_for_teams_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks