Updates to the Zero-hour auto purge (ZAP) alerts

Originally posted by Microsoft Apr 21, 2022 Microsoft 365 Apps 0 Comments

We will be updating the current zero-hour auto purge (ZAP) alerts and introduce a new ZAP alert that will notify you if a message has not been removed by ZAP.

Updates to the ZAP alerts will include:

• Scoping the success ZAP alerts for only ZAP related scenarios. You will no longer be alerted as part of the ZAP alert for Dynamic Delivery scenarios.
• A new failure ZAP alert is being introduced. You will receive an alert when a message was not successfully removed from the mailbox. Manual action will be required to remediate the message. The alert will be correlated and linked to both Automated Investigation and Response (AIR) and Incidents. The alert will be on by default and can be configured in alert policies.

This message is associated with Microsoft 365 Roadmap ID 93206.

When this will happen:

We expect these updates to roll out in late May and expect to be complete by late June.

How this will affect your organization:

Due to these new changes, you can expect a change in the volume of the successful ZAP alerts. The new ZAP failure alert will be on by default and can be configured in the alert policy settings. You can review both default alerts in the portal. However, if you’re exporting these alerts into external systems, you will need to include the new alert generated by the new policy.

What can you do to prepare:

Review the following resources below to learn more:

• Microsoft 365 alert policies
• Zero-hour auto purge in Microsoft Defender for Office 365

Message ID: MC362281