Microsoft Defender for Office 365
Email and collaboration

Zero Hour Auto Purge

In brief

The documentation now states more clearly that campaign-based remediation can affect messages older than 48 hours, typically within a few hours to a few days after delivery.

What Defender admins need to know

No administrator action is required; the clarification helps set expectations for remediation timing.

Summaries are generated from the documentation change itself.

Documentation change

The comparison below shows only the changed extract. Use the full-page view for complete context.

ZAP addresses these issues by continually monitoring spam and malware signature updates in the service, and is seamless for users. ZAP finds and takes automated action on messages that are already in a user's mailbox. ZAP acts on delivered mail through two paths:

  • Per-message reevaluation rescans individual messages within 48 hours of delivery.
  • Campaign-based remediation retroactively acts on messages later identified as part of a malicious campaign, including messages older than 48 hours. This remediation typically happens within a few hours to a few days after delivery.

Users aren't notified when ZAP moves a message.