Microsoft Defender for Office 365 Zero-hour auto-purge (ZAP) Teams protection capabilities to Defender for Office Plan 1

Starting January 6, 2026, Zero-hour auto-purge (ZAP) will be enabled by default in Microsoft Defender for Office 365 Plan 1, automatically moving malicious Teams messages to admin quarantine. Tenants can opt out before January 6, 2026, and admins manage quarantined content via the Security portal. Introduction Starting January 6, 2026, Zero-hour auto-purge (ZAP)—a feature that moves malicious messages from internal Microsoft Teams chats and channels to admin quarantine—will be turned on by default for Microsoft Defender for Office 365 Plan 1. This enhancement helps protect your organization by removing phishing or malware URLs from Teams conversations and placing them in the admin quarantine within the Microsoft 365 Security portal. For details on managing quarantined Teams messages, refer to Use the Microsoft Defender portal to manage Microsoft Teams quarantined messages. Screenshot: Example of Admin quarantine showcasing all quarantined Teams messages View image in new tab This message is associated with Microsoft 365 Roadmap ID 529816. When this will happen: General Availability (Worldwide): Rollout begins early January 2026 and will complete by mid-January 2026. Default ON setting effective January 6, 2026, unless your tenant opts out before that. How this affects your organization: Who is affected: All tenants using Microsoft Defender for Office 365 Plan 1 with Microsoft Teams. What will happen: What you can do to prepare: Learn more: Compliance considerations: No compliance considerations identified; review as appropriate for your organization. ZAP will automatically move internal Teams messages detected as phishing or malware to the admin quarantine tab in the Security portal. By default, ZAP protection for Teams will be ON for all tenants. Existing ZAP settings apply; no policy changes are required unless you choose to opt out. End users will not see quarantined messages in Teams; admins can review and manage quarantined content in the Security portal. Review ZAP settings in the Microsoft 365 Security portal before January 6, 2026. If you want to opt out of the default ON setting, do so via ZAP settings in the Security portal between December 6, 2025, and January 5, 2026. Communicate this change to your helpdesk and update internal documentation as needed. […]

The post Microsoft Defender for Office 365 Zero-hour auto-purge (ZAP) Teams protection capabilities to Defender for Office Plan 1 appeared first on M365 Admin.