What does zero-hour auto purge (ZAP) do in Microsoft 365?

Filters decide what to do with a message in a fraction of a second. Sometimes the verdict changes later: a link is weaponized after delivery, or a new malware signature arrives an hour after the attachment did. Zero-hour auto purge (ZAP) is how Microsoft 365 goes back and cleans up. This guide explains what ZAP does for each verdict, where it puts messages, how to see what it did, and the cases where it quietly does nothing.

What is zero-hour auto purge?

ZAP is a post-delivery clean-up feature in Exchange Online. Microsoft Learn describes it as retroactively detecting and neutralizing "malicious phishing, spam, or malware messages that were delivered to cloud mailboxes." It watches for spam and malware signature updates and acts on messages that are already in a mailbox.

The key facts, all from Microsoft's ZAP documentation at the time of writing (October 2026):

• Time window: "ZAP's search is limited to the last 48 hours of delivered email."
• Licensing: no special license for email. ZAP "works on all mailboxes hosted in Exchange Online."
• Not on-premises: ZAP "doesn't work in on-premises mailboxes protected by Microsoft 365."
• Folders: it also acts on messages in Deleted Items and in other folders, such as ones Inbox rules moved mail into, as long as the message wasn't deleted and a same-or-stronger action wasn't already applied.
• Silent: "Users aren't notified if ZAP detects and moves a message."

ZAP is one layer of Microsoft's built-in filtering. If you want the full picture of how a filter reaches a verdict in the first place, see how spam filters work.

What does ZAP do with each type of threat?

ZAP doesn't have one action. It follows the verdict and, for spam and phishing, the action you chose in the matching policy.

Two details catch admins out.

First, ZAP only moves or quarantines. Microsoft says that if the verdict's action is Add X-Header, Prepend subject line with text, Redirect message to email address or Delete message, "ZAP takes no action on the message." If you've set spam to prepend [SPAM] to the subject, ZAP won't touch spam that slipped through.

Second, the default actions differ by policy. In the default anti-spam policy, phishing goes to Junk Email. In the Standard and Strict preset policies, and in custom anti-spam policies created in the Defender portal, phishing is quarantined. Our guide to Microsoft 365 anti-spam policies covers those verdict actions, and preset security policies explains which policy wins.

Where are the ZAP settings?

ZAP is on by default in every policy, and Microsoft recommends leaving it on in Default, Standard and Strict. To confirm it hasn't been switched off:

1. In the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Anti-spam (https://security.microsoft.com/antispam).
2. Open each inbound policy and select Edit actions. In the Zero-hour auto purge (ZAP) section, check that Enable zero-hour auto purge (ZAP), Enable ZAP for phishing messages and Enable ZAP for spam messages are all selected.
3. Go to Threat policies > Anti-malware. In each policy's Protection settings, check Enable zero-hour auto purge for malware.
4. ZAP for high confidence phishing has no switch. Microsoft says it's enabled by default as part of Secure by Default.

In Exchange Online PowerShell, the matching properties are PhishZapEnabled and SpamZapEnabled on anti-spam policies and ZapEnabled on anti-malware policies:

Get-HostedContentFilterPolicy | Format-List Name,PhishZapEnabled,SpamZapEnabled
Get-MalwareFilterPolicy | Format-List Name,ZapEnabled

If ZAP quarantines a message, the quarantine policy assigned to that verdict decides whether the user can see it, release it and get a notification. Our guide to Microsoft 365 quarantine policies and notifications walks through those choices.

How can you tell whether ZAP moved a message?

The classic help desk ticket is "an email was in my inbox this morning and now it's gone." Users get no notice, and Microsoft notes that "ZAP isn't logged in the Exchange mailbox audit logs as a system action." Use these instead:

1. Mailflow status report. The Mailflow view shows the number of ZAP-affected messages for a date range. Use it to see whether ZAP activity spiked.
2. Threat Explorer. On the All email tab, filter the Additional action column by ZAP to see individual messages. Threat Explorer needs Defender for Office 365 Plan 2. Plan 1 has the more limited Real-time detections instead, and Microsoft's ZAP documentation only describes the Threat Explorer filter, so don't count on seeing per-message ZAP actions there (see our Plan 1 vs Plan 2 comparison).
3. Quarantine. Search for the message in Email & collaboration > Review > Quarantine. If it's there, the quarantine reason tells you which verdict applied.
4. The user's Junk Email folder. If the verdict action was Junk Email, ZAP moved it there rather than to quarantine.

A message trace confirms the message was delivered in the first place, which helps rule out a filtering decision at the gateway or at receipt.

When doesn't ZAP act?

ZAP isn't a guarantee. Microsoft's documentation lists several cases where it does nothing, or does less than you'd expect:

• The message is older than 48 hours. ZAP doesn't look further back.
• The verdict is spam and the message was already read. Spam ZAP only applies to unread mail.
• The verdict action isn't Junk or quarantine. X-header, subject prepend, redirect and delete actions mean ZAP skips the message.
• The mailbox is on-premises. ZAP only covers Exchange Online mailboxes.
• Safe Attachments Dynamic Delivery is still scanning. ZAP doesn't quarantine those messages. If a spam or phishing signal arrives mid-scan, it falls back to Move to Junk.
• An allowlist or mail flow rule overrides it. Microsoft names "Allowlists" and "Exchange mail flow rules (transport rules)" as features that might override ZAP.
• Advanced delivery exceptions. SecOps mailboxes (malware and high confidence phishing) and non-Microsoft phishing simulation URLs (high confidence phishing) are exempt by design.
• Your MX points elsewhere and a rule bypasses spam filtering. With an SCL -1 bypass rule, ZAP won't act on high confidence phishing.
• An admin submitted the message as clean. The resulting allow entries last, by default, 45 days after their last use, and ZAP won't act on matching malware or high confidence phishing.

Microsoft also says ZAP quarantines messages in mailboxes on hold, so litigation hold isn't a reason ZAP skipped a message.

How do allow lists and Safe Senders interact with ZAP?

Every exception you add reduces what ZAP can clean up later. Microsoft's allowlist guidance is blunt about Outlook Safe Senders: senders "bypass parts of the filtering stack," and "bypassing the filtering stack also interferes with zero-hour auto purge (ZAP)." A trusted supplier whose mailbox is compromised is exactly the case ZAP is meant to catch, and a Safe Senders entry stops it.

Microsoft ranks allow methods from most to least recommended: Tenant Allow/Block List entries, mail flow rules, Outlook Safe Senders, the IP Allow List, then allowed sender and domain lists in anti-spam policies. The further down that list you go, the more of the filtering stack you skip. If you need an exception, follow our guide to allowing a sender safely and keep it as narrow as you can.

Malware and high confidence phishing are the exception. Microsoft says messages identified as malware or high confidence phishing "are always quarantined, regardless of the allowlist option you use," apart from SecOps mailboxes in the advanced delivery policy.

Does ZAP still work behind a filtering gateway?

Yes, as long as the mailboxes are in Exchange Online. ZAP acts on what's in the mailbox, wherever the MX record points. What can break it is the way you integrate the gateway.

Microsoft's guidance for third-party filtering offers two options: Enhanced Filtering for Connectors, which it "highly recommend[s]", or an SCL -1 rule that bypasses spam filtering. The ZAP documentation adds the catch: when the MX points to another service and a mail flow rule bypasses spam filtering, ZAP doesn't act on high confidence phishing. Enhanced Filtering keeps Microsoft's filtering, and ZAP, working on gateway traffic. Our guide to configuring Enhanced Filtering covers the steps, and Microsoft 365 built-in filtering vs a gateway explains why the two layers complement each other.

The two layers do different jobs. A gateway in front of Microsoft 365 decides before delivery, so a message it quarantines never reaches the mailbox at all. ZAP is the second look after delivery. Running both, without a bypass rule, gives you the second chance.

What if ZAP moved a legitimate message?

False positives happen. Microsoft's advice is to report them through the normal submission process. Then:

1. Find the message in quarantine or in the user's Junk Email folder.
2. Check the headers before releasing. Paste them into the Email Header Analyzer and confirm SPF, DKIM and DMARC look right for the claimed sender.
3. Release it, or approve the user's release request. See how to release quarantined email in Microsoft 365.
4. Submit it to Microsoft from the Submissions page as I've confirmed it's clean, so the filter learns.
5. Resist adding a permanent Safe Senders entry. Fix the cause instead, such as a sender with broken authentication.

If the same sender keeps getting flagged, the problem is usually the sender's authentication, not ZAP. Our guide to false positives covers the common causes.

Next steps

• Check that ZAP is on in every anti-spam and anti-malware policy, including custom ones.
• Make sure your spam and phishing actions are Move to Junk Email or Quarantine, not subject prepend or X-header, so ZAP has something to do.
• Audit Outlook Safe Senders and anti-spam allowed sender lists, and remove entries you don't need.
• If you run a filtering gateway in front of Microsoft 365, replace any SCL -1 bypass rule with Enhanced Filtering for Connectors. iBlockSpam's Microsoft 365 setup uses a Partner connector with Enhanced Filtering for this reason.