Microsoft Defender for Office 365 Zero-hour auto-purge (ZAP) Teams protection capabilities to Defender for Office Plan 1

Introduction

Starting January 6, 2026, Zero-hour auto-purge (ZAP)—a feature that moves malicious messages from internal Microsoft Teams chats and channels to admin quarantine—will be turned on by default for Microsoft Defender for Office 365 Plan 1. This enhancement helps protect your organization by removing phishing or malware URLs from Teams conversations and placing them in the admin quarantine within the Microsoft 365 Security portal. For details on managing quarantined Teams messages, refer to Use the Microsoft Defender portal to manage Microsoft Teams quarantined messages.

Screenshot: Example of Admin quarantine showcasing all quarantined Teams messages

This message is associated with Microsoft 365 Roadmap ID 529816.

When this will happen:

• General Availability (Worldwide): Rollout begins early January 2026 and will complete by mid-January 2026.
• Default ON setting effective January 6, 2026, unless your tenant opts out before that.

How this affects your organization:

Who is affected:

• All tenants using Microsoft Defender for Office 365 Plan 1 with Microsoft Teams.

What will happen:

• ZAP will automatically move internal Teams messages detected as phishing or malware to the admin quarantine tab in the Security portal.
• By default, ZAP protection for Teams will be ON for all tenants.
• Existing ZAP settings apply; no policy changes are required unless you choose to opt out.
• End users will not see quarantined messages in Teams; admins can review and manage quarantined content in the Security portal.

What you can do to prepare:

• Review ZAP settings in the Microsoft 365 Security portal before January 6, 2026.
• If you want to opt out of the default ON setting, do so via ZAP settings in the Security portal between December 6, 2025, and January 5, 2026.
• Communicate this change to your helpdesk and update internal documentation as needed.

Learn more:

• Configure ZAP for Teams protection in Defender for Office 365
• Use the Microsoft Defender portal to manage Microsoft Teams quarantined messages

Compliance considerations:

No compliance considerations identified; review as appropriate for your organization.

Feedback:

We value your input. Please leave feedback directly from this Message Center post by selecting Thumbs up or Thumbs down, and adding a comment. (Optional) Include your email address in the text box so the responsible team can follow up if needed.