What this check looks at
Checks that zero-hour auto purge (ZAP) is on for Microsoft Teams, so chat messages later found to carry malware or phishing are removed.
Zero-hour auto purge (ZAP) removes messages after delivery when Microsoft’s verdict on them changes: a link turns malicious, a file is found to be malware. For email it is on by default. For Microsoft Teams, ZAP for chat and channel messages is controlled by the Teams protection policy in Defender for Office 365 Plan 2, and when on it quarantines the message and removes it from the conversation for everyone in it.
The check is not applicable without Defender for Office 365 Plan 2. It reads the Teams protection policy and passes when ZAP is on, fails when it is off.
Attackers now send phishing and malware through Teams, often from newly created external tenants posing as IT support or a supplier. Microsoft frequently recognises a campaign only after the first messages have been delivered. Without ZAP those messages stay in every chat they reached, waiting to be clicked hours later.
Why it matters
Attackers now send phishing through Teams chats from external tenants. ZAP pulls those messages back once Microsoft recognises them, up to 48 hours after delivery, before more people click.
A pattern seen widely since 2024: staff receive a flood of spam, then a Teams message from an external tenant called something like IT Helpdesk offering to fix it, with a link or a file. If that leads someone to install remote access software or open a loader, ransomware operators can be inside within hours. ZAP pulls the messages back for every recipient as soon as Microsoft identifies them.
ZAP for Teams costs nothing where the licence is held, and users only notice it when a malicious message disappears. Leaving it off means each Teams phishing message has to be found and cleaned up by hand, if anyone notices it at all.
CIS Microsoft 365 Foundations Benchmark 2.4.4 asks for zero-hour auto purge for Microsoft Teams to be on. NIST CSF 2.0 RS.MI-01 (incidents are contained), ISO 27001 A.8.7, CIS Controls v8 9.7 and NCSC CAF B4.b cover the same ground, and the Cyber Essentials Plus malware protection test checks how malicious content is handled.
How to fix it
Where: Microsoft Defender portal → Settings → Email & collaboration → Microsoft Teams protection
Before you start
- Needs Defender for Office 365 Plan 2.
Step by step
- Confirm the licence. ZAP for Teams needs Defender for Office 365 Plan 2 (Microsoft 365 E5, E5 Security or the Plan 2 add-on). Check in the Microsoft 365 admin centre under Billing > Licences.
- Open Microsoft Teams protection. In the Microsoft Defender portal, go to Settings > Email & collaboration > Microsoft Teams protection.
- Turn ZAP on. In the Zero-hour auto purge (ZAP) section turn it on. Check the quarantine policies for malware and high-confidence phishing are what you want (AdminOnlyAccessPolicy stops users releasing them) and select Save.
- Review the exclusions. Check whether any users, groups or domains are excluded from ZAP on the same page, and remove any exclusion without a documented reason.
- Or set it in PowerShell. Connect with Connect-ExchangeOnline and run Set-TeamsProtectionPolicy -Identity "Teams Protection Policy" -ZapEnabled $true. Get-TeamsProtectionPolicyRule | Format-List ExceptIf* shows any exclusions.
- Confirm the setting. Run Get-TeamsProtectionPolicy | Format-List ZapEnabled and check it is True. The next assessment passes.
With PowerShell
Set-TeamsProtectionPolicy -Identity "Teams Protection Policy" -ZapEnabled $true
What users will notice
Teams chat messages later found to contain malware or phishing are removed and quarantined.
How to confirm it worked
Get-TeamsProtectionPolicy shows ZapEnabled as True.
Frameworks and controls
This check maps to controls in 16 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| Cyber Essentials Plus | Malware protection test |
| NCSC CAF | B4.b Secure configuration |
| DSPT | Standard 9: IT protection |
| DORA | Art. 9 Protection and prevention |
| NIS2 | Art. 21(2)(e) Security in acquisition, development and maintenance, including vulnerability handling |
| Microsoft Cloud Security Benchmark | ES-2 Use modern anti-malware software |
| Zero Trust | Applications |
| SOC 2 | CC6.8 Preventing or detecting unauthorised or malicious software |
| PCI DSS 4.0.1 | 5.4.1 Personnel are protected against phishing attacks |
| NIST SP 800-171 | 3.14.2 Provide protection from malicious code |
| CMMC Level 2 | SI.L2-3.14.2 Malicious Code Protection |
| ISO 27001:2022 | A.8.7 Protection against malware |
| CIS M365 | 2.4.4 Ensure Zero-hour auto purge for Microsoft Teams is on |
| CIS Controls v8.1 | 9.7 Deploy and maintain email server anti-malware protections (IG3) |
| NIST CSF 2.0 | RS.MI-01: Incidents are contained |
| NCSC 10 Steps | Architecture and configuration |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Zero-hour auto purge in Microsoft Teams (Microsoft Learn)