Updated May 23, 2022: We have identified that this message is a duplicate of MC362283 and will be removing it. We apologize for any confusion.
We will be updating the current zero-hour auto purge (ZAP) alerts and introduce a new ZAP alert that will notify you if a message has not been removed by ZAP. This message is associated with Microsoft 365 Roadmap ID 93206.
We are enhancing the successful ZAP (zero-hour auto purge) alert and introducing a new ZAP failure alert.
Updates to the ZAP alerts will include:
- Scoping the success ZAP alerts for only ZAP related scenarios. You will no longer be alerted as part of the ZAP alert for Dynamic Delivery scenarios.
- A new failure ZAP alert is being introduced. You will receive an alert when a message was not successfully removed from the mailbox. Manual action will be required to remediate the message. The alert will be correlated and linked to both Automated Investigation and Response (AIR) and Incidents. The alert will be on by default and can be configured in alert policies.
Affected Workload
- Defender
- Defender for Office 365
- Microsoft 365 Defender
When this will happen
We expect these updates to roll out in late May and expect to be complete by late June.
How this will affect your organization
Due to these new changes, you can expect a change in the volume of the successful ZAP alerts. The new ZAP failure alert will be on by default and can be configured in the alert policy settings. You can review both default alerts in the portal. However, if you’re exporting these alerts into external systems, you will need to include the new alert generated by the new policy.
What can you do to prepare
Review the following resources below to learn more:
Message ID: MC362281
Created: 21 April 2022
Updated: 23 May 2022
Platform: US Instances, Web, World tenant
