Microsoft Teams protection

Zero-hour auto purge (ZAP)

ZAP allows content from internal Team messages and channels to be removed by Microsoft after they were originally delivered. External messages are not covered currently by ZAP.

Quarantine policies

Specify the quarantine policy to apply to malware and high confidence phishing messages within teams.

Exclude these participants

Specify users you don't want to ZAP messages for, note that if the message is in a group or a team, all users must be in the exclusion list or it is blocked for everyone.

Below you can see examples of ZAP working and putting a message in quarantine when one user of the IT team isn't an exclusion, while the other flowchart is showing ZAP taking no actions when all members are an exclusion.

Group with every user excludedGroup with only some excluded

flowchart LR
    mm(Malicious message)
    q(Quarantine)
    z[[ZAP Process]]

    subgraph it["IT Team"]
        subgraph Exclusions
            d(Dan)
            j(Jan)
            s(Stan)
        end
    end
    mm-..->it
    it--oz
    z --x q

flowchart LR
    mm(Malicious message)
    q(Quarantine)
    z[[ZAP Process]]

    subgraph it["IT Team"]
        direction TB
        subgraph Exclusions
            d(Dan)
            j(Jan)
        end
        s(Stan)
    end
    mm-..->it
    it--oz
    z-->q