Updated December 27, 2022: We have updated the rollout timeline below. Thank you for your patience.
Updated October 31, 2022: We have updated the rollout timeline below. Thank you for your patience.
Updated October 7, 2022: We have updated the rollout timeline below. Thank you for your patience.
Updated September 2, 2022: We have updated the rollout timeline below. Thank you for your patience.
Updated August 12, 2022: We have updated the rollout timeline below. Thank you for your patience.
Updated July 19, 2022: We have updated the rollout timeline below. Thank you for your patience.
Updated June 23, 2022: We have updated the rollout timeline below. Thank you for your patience.
Updated June 7, 2022: We have updated the rollout timeline below. Thank you for your patience.
We will be updating the current zero-hour auto purge (ZAP) alerts and introduce a new ZAP alert that will notify you if a message has not been removed by ZAP. This message is associated with Microsoft 365 Roadmap ID 93206.
We are enhancing the successful ZAP (zero-hour auto purge) alert and introducing a new ZAP failure alert.
Updates to the ZAP alerts will include:
- Scoping the success ZAP alerts for only ZAP related scenarios. You will no longer be alerted as part of the ZAP alert for Dynamic Delivery scenarios.
- A new failure ZAP alert is being introduced. You will receive an alert when a message was not successfully removed from the mailbox. Manual action will be required to remediate the message. The alert will be correlated and linked to both Automated Investigation and Response (AIR) and Incidents. The alert will be on by default and can be configured in alert policies.
Table of Contents
Effected Workload
- Defender
- Defender for Office 365
- Microsoft 365 Defender
When this will happen
We expect these updates to roll out in early November (previously mid-October) and expect to be complete by mid-January (previously early December).
How this will affect your organization
Due to these new changes, you can expect a change in the volume of the successful ZAP alerts. The new ZAP failure alert will be on by default and can be configured in the alert policy settings. You can review both default alerts in the portal. However, if you’re exporting these alerts into external systems, you will need to include the new alert generated by the new policy.
What can you do to prepare
Review the following resources below to learn more:
- Microsoft 365 alert policies
- Microsoft 365 > Office 365 security > Prevent > Zero-hour auto purge (ZAP) in Exchange Online
Message ID: MC362283
Created: 21 April 2022
Updated: 27 December 2022
Cloud instance(s): Worldwide (Standard Multi-Tenant), GCC High, GCC, DoD
Platform: US Instances, Web, World tenant