MC1187837 – M365 Change Digest

One-line summary

Starting January 6, 2026, Zero-hour auto-purge (ZAP) will be enabled by default for Teams in Defender for Office 365 Plan 1, automatically quarantining malicious messages.

Similar updates

Details

RoadmapIds

529816

Summary

Starting January 6, 2026, Zero-hour auto-purge (ZAP) will be enabled by default in Microsoft Defender for Office 365 Plan 1, automatically moving malicious Teams messages to admin quarantine. Tenants can opt out before January 6, 2026, and admins manage quarantined content via the Security portal.

Platforms

Android, Desktop, iOS, Linux, Mac, Web

Body (from Message Center)

[Introduction]

Starting January 6, 2026, Zero-hour auto-purge (ZAP)—a feature that moves malicious messages from internal Microsoft Teams chats and channels to admin quarantine—will be turned on by default for Microsoft Defender for Office 365 Plan 1. This enhancement helps protect your organization by removing phishing or malware URLs from Teams conversations and placing them in the admin quarantine within the Microsoft 365 Security portal. For details on managing quarantined Teams messages, refer to Use the Microsoft Defender portal to manage Microsoft Teams quarantined messages.

Screenshot: Example of Admin quarantine showcasing all quarantined Teams messages

user settings

This message is associated with Microsoft 365 Roadmap ID 529816.

[When this will happen:]

General Availability (Worldwide): Rollout begins early January 2026 and will complete by mid-January 2026.
Default ON setting effective January 6, 2026, unless your tenant opts out before that.

[How this affects your organization:]

Who is affected:

All tenants using Microsoft Defender for Office 365 Plan 1 with Microsoft Teams.

What will happen:

ZAP will automatically move internal Teams messages detected as phishing or malware to the admin quarantine tab in the Security portal.
By default, ZAP protection for Teams will be ON for all tenants.
Existing ZAP settings apply; no policy changes are required unless you choose to opt out.
End users will not see quarantined messages in Teams; admins can review and manage quarantined content in the Security portal.

[What you can do to prepare:]

Review ZAP settings in the Microsoft 365 Security portal before January 6, 2026.
If you want to opt out of the default ON setting, do so via ZAP settings in the Security portal between December 6, 2025, and January 5, 2026.
Communicate this change to your helpdesk and update internal documentation as needed.

Learn more:

[Compliance considerations:]

No compliance considerations identified; review as appropriate for your organization.

[Feedback:]

We value your input. Please leave feedback directly from this Message Center post by selecting Thumbs up or Thumbs down, and adding a comment. (Optional) Include your email address in the text box so the responsible team can follow up if needed.

Raw JSON (for debugging)

Expand/collapse the full payload below.

Show/hide raw

{
  "snapshot_item": {
    "action_required_by": null,
    "ai_action_required_by": "2026-01-06T00:00:00Z",
    "ai_actions": [
      "Review ZAP settings in Security portal",
      "Opt out if desired before January 6, 2026",
      "Inform helpdesk and update documentation"
    ],
    "ai_master_tags": [
      "Security"
    ],
    "ai_model": "gpt-4.1",
    "ai_summary": "Starting January 6, 2026, Zero-hour auto-purge (ZAP) will be enabled by default for Teams in Defender for Office 365 Plan 1, automatically quarantining malicious messages.",
    "ai_topics": [
      "Defender",
      "Teams"
    ],
    "category": "planForChange",
    "details_map": {
      "Platforms": "Android, Desktop, iOS, Linux, Mac, Web",
      "RoadmapIds": "529816",
      "Summary": "Starting January 6, 2026, Zero-hour auto-purge (ZAP) will be enabled by default in Microsoft Defender for Office 365 Plan 1, automatically moving malicious Teams messages to admin quarantine. Tenants can opt out before January 6, 2026, and admins manage quarantined content via the Security portal."
    },
    "id": "MC1187837",
    "importance": 5,
    "is_major_change": true,
    "last_modified": "2025-11-18T22:51:17Z",
    "ms_products": [
      "Defender"
    ],
    "platforms": "Android, Desktop, iOS, Linux, Mac, Web",
    "roadmap_ids": [
      "529816"
    ],
    "services": [
      "Microsoft Defender XDR"
    ],
    "severity": "normal",
    "tags": [
      "New feature",
      "User impact",
      "Admin impact"
    ],
    "title": "Microsoft Defender for Office 365 Zero-hour auto-purge (ZAP) Teams protection capabilities to Defender for Office Plan 1"
  }
}