We will be updating the current zero-hour auto purge (ZAP) alerts and introduce a new ZAP alert that will notify you if a message has not been removed by ZAP. This message is associated with Microsoft 365 Roadmap ID 93206.
We are enhancing the successful ZAP (zero-hour auto purge) alert and introducing a new ZAP failure alert.
Updates to the ZAP alerts will include:
- Scoping the success ZAP alerts for only ZAP related scenarios. You will no longer be alerted as part of the ZAP alert for Dynamic Delivery scenarios.
- A new failure ZAP alert is being introduced. You will receive an alert when a message was not successfully removed from the mailbox. Manual action will be required to remediate the message. The alert will be correlated and linked to both Automated Investigation and Response (AIR) and Incidents. The alert will be on by default and can be configured in alert policies.
- Defender for Office 365
- Microsoft 365 Defender
When this will happen
We expect these updates to roll out in late May and expect to be complete by late June.
- Microsoft 365 > Office 365 security > Prevent > Zero-hour auto purge (ZAP) in Exchange Online
Message ID: MC362283
Created: 21 April 2022
Updated: 21 April 2022
Platform: US Instances, Web, World tenant