# (L1) Ensure Zero-hour auto purge for Microsoft Teams is on (Only Checks ZAP is enabled)

(L1) Ensure Zero-hour auto purge for Microsoft Teams is on (Only Checks ZAP is enabled). A Maester check for Defender, Zero-hour auto purge.

Source: https://maester.dev/docs/tests/CIS.M365.2.4.4

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/nzlostboy" title="Ben Miles · Original author"><img src="https://github.com/NZLostboy.png" alt="Ben Miles" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/korthal-maiyn" title="Christopher Edwards · Co-contributor"><img src="https://github.com/Korthal-Maiyn.png" alt="Christopher Edwards" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/nzlostboy">Ben Miles</a> with <a href="/contributors/korthal-maiyn">Christopher Edwards</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Defender · Zero-hour auto purge · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.2.4.4
```

## Overview

2.4.4 (L1) Ensure Zero-hour auto purge for Microsoft Teams is on

Zero-hour auto purge (ZAP) is a protection feature that retroactively detects and neutralizes malware and high confidence phishing. When ZAP for Teams protection blocks a message, the message is blocked for everyone in the chat. The initial block happens right after delivery, but ZAP occurs up to 48 hours after delivery.

#### Rationale

ZAP is intended to protect users that have received zero-day malware messages or content that is weaponized after being delivered to users. It does this by continually monitoring spam and malware signatures taking automated retroactive action on messages that have already been delivered.

#### Impact

As with any anti-malware or anti-phishing product, false positives may occur

#### Remediation action

To enable Zero-hour auto purge for Microsoft Teams:

1. Navigate to [Microsoft 365 Defender](https://security.microsoft.com)
2. Click to expand **System** select **Settings** > **Email & collaboration** > **Microsoft Teams protection**
3. Set **Zero-hour auto purge (ZAP)** to **On (Default)**.

##### PowerShell

1. Connect to Exchange Online using `Connect-ExchangeOnline`.
2. Run the following cmdlet:

```powershell
Set-TeamsProtectionPolicy -Identity "Teams Protection Policy" -ZapEnabled $true
```

#### Related links

* [Microsoft 365 Admin Center](https://admin.microsoft.com)
* [Zero-hour auto purge (ZAP) in Microsoft Teams](https://learn.microsoft.com/defender-office-365/zero-hour-auto-purge?view=o365-worldwide#zero-hour-auto-purge-zap-in-microsoft-teams)
* [Configure ZAP for Teams protection in Defender for Office 365](https://learn.microsoft.com/defender-office-365/mdo-support-teams-about?view=o365-worldwide#configure-zap-for-teams-protection-in-defender-for-office-365-plan-2)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 157](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.2.4.4 |
| Severity | Medium |
| Suite | CIS |
| Product | Defender |
| Related products | Teams |
| Feature | Zero-hour auto purge |
| Area | Email and collaboration protection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566 Phishing |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 2.4.4 |
| Benchmark level | L1 |
| Benchmark profiles | E5 Level 1 |
| Supports controls | cis-m365:2.4.4, nist-800-53-r5:SI-3 |
| PowerShell test | [Test-MtCisZAP](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.2.4.4.ps1) |
| Services | ExchangeOnline |
| Compatible licenses | THREAT_INTELLIGENCE |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.2.4.4.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.2.4.4.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.2.4.4.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.2.4.4.md)