Skip to main content
Version: 3.0.0-preview

CIS.M365.2.4.4 - (L1) Ensure Zero-hour auto purge for Microsoft Teams is on (Only Checks ZAP is enabled)

Ben MilesChristopher Edwards
Contributed by Ben Miles with Christopher EdwardsAll contributors →

Overview​

2.4.4 (L1) Ensure Zero-hour auto purge for Microsoft Teams is on

Zero-hour auto purge (ZAP) is a protection feature that retroactively detects and neutralizes malware and high confidence phishing. When ZAP for Teams protection blocks a message, the message is blocked for everyone in the chat. The initial block happens right after delivery, but ZAP occurs up to 48 hours after delivery.

Rationale​

ZAP is intended to protect users that have received zero-day malware messages or content that is weaponized after being delivered to users. It does this by continually monitoring spam and malware signatures taking automated retroactive action on messages that have already been delivered.

Impact​

As with any anti-malware or anti-phishing product, false positives may occur

Remediation action​

To enable Zero-hour auto purge for Microsoft Teams:

  1. Navigate to Microsoft 365 Defender
  2. Click to expand System select Settings > Email & collaboration > Microsoft Teams protection
  3. Set Zero-hour auto purge (ZAP) to On (Default).
PowerShell​
  1. Connect to Exchange Online using Connect-ExchangeOnline.
  2. Run the following cmdlet:
Set-TeamsProtectionPolicy -Identity "Teams Protection Policy" -ZapEnabled $true

Test Metadata​

FieldValue
Test IDCIS.M365.2.4.4
SeverityMedium
SuiteCIS
ProductDefender
Related productsTeams
FeatureZero-hour auto purge
AreaEmail and collaboration protection
Resource typeTenant
User impactLow
Implementation costLow
MITRE ATT&CKT1566 Phishing
Supports benchmarkCIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 2.4.4
Benchmark levelL1
Benchmark profilesE5 Level 1
Supports controlscis-m365:2.4.4, nist-800-53-r5:SI-3
PowerShell testTest-MtCisZAP
ServicesExchangeOnline
Compatible licensesTHREAT_INTELLIGENCE

Source​