(L1) Ensure Zero-hour auto purge for Microsoft Teams is on (Only Checks ZAP is enabled)

Contributed by Ben Miles with Christopher EdwardsAll contributors →

Part of CIS · Defender · Zero-hour auto purge · All checks

Run this check

Invoke-Maester -TestId CIS.M365.2.4.4

Overview

2.4.4 (L1) Ensure Zero-hour auto purge for Microsoft Teams is on

Zero-hour auto purge (ZAP) is a protection feature that retroactively detects and neutralizes malware and high confidence phishing. When ZAP for Teams protection blocks a message, the message is blocked for everyone in the chat. The initial block happens right after delivery, but ZAP occurs up to 48 hours after delivery.

Rationale

ZAP is intended to protect users that have received zero-day malware messages or content that is weaponized after being delivered to users. It does this by continually monitoring spam and malware signatures taking automated retroactive action on messages that have already been delivered.

Impact

As with any anti-malware or anti-phishing product, false positives may occur

Remediation action

To enable Zero-hour auto purge for Microsoft Teams:

1. Navigate to Microsoft 365 Defender
2. Click to expand System select Settings > Email & collaboration > Microsoft Teams protection
3. Set Zero-hour auto purge (ZAP) to On (Default).

PowerShell

1. Connect to Exchange Online using Connect-ExchangeOnline.
2. Run the following cmdlet:

Set-TeamsProtectionPolicy -Identity "Teams Protection Policy" -ZapEnabled $true

Related links

• Microsoft 365 Admin Center
• Zero-hour auto purge (ZAP) in Microsoft Teams
• Configure ZAP for Teams protection in Defender for Office 365
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 157

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.2.4.4
Severity	Medium
Suite	CIS
Product	Defender
Related products	Teams
Feature	Zero-hour auto purge
Area	Email and collaboration protection
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1566 Phishing
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 2.4.4
Benchmark level	L1
Benchmark profiles	E5 Level 1
Supports controls	cis-m365:2.4.4, nist-800-53-r5:SI-3
PowerShell test	Test-MtCisZAP
Services	ExchangeOnline
Compatible licenses	THREAT_INTELLIGENCE

Source

• Test: tests/cis/Test.CIS.M365.2.4.4.ps1
• Documentation: tests/cis/Test.CIS.M365.2.4.4.md