8.5 Zero-Hour Auto Purge (ZAP)

Zero-Hour Auto Purge (ZAP)

By the end of this subsection, you will understand how ZAP works as post-delivery remediation, know the gap it creates and how to monitor it, and track ZAP actions with KQL.

How ZAP works

ZAP is the safety net. When an email passes all scanning at delivery but is later identified as malicious (new threat intelligence, updated ML model, manual submission analysis), ZAP retroactively removes or moves it from the user’s mailbox.

The ZAP sequence:

1. Email delivered to inbox (passes all scanning at delivery time)
2. Hours later: Microsoft threat intelligence updates the URL/file verdict to malicious
3. ZAP checks all delivered emails against the updated verdict
4. ZAP takes action: moves to Junk, soft deletes, or replaces the email

ZAP actions

The ZAP gap

ZAP is not instant. In Module 13, ZAP removed 4 of 23 phishing emails — but only 23 minutes after delivery. During those 23 minutes, 7 users clicked the link and 5 reached the phishing proxy. This is the ZAP gap: the time between email delivery and ZAP action.

Monitoring ZAP with KQL

1
2
3
4
5
6
7
8
9

EmailPostDeliveryEvents
| where TimeGenerated > ago(30d)
| where ActionType in ("ZAP", "ZapCompleted")
| extend ZapAction = tostring(parse_json(ActionDetails).action)
| summarize
    ZapCount = count(),
    AvgDelayMinutes = round(avg(datetime_diff('minute', TimeGenerated, DeliveryTime)), 0)
    by ZapAction, bin(TimeGenerated, 1d)
| sort by TimeGenerated desc

ZAP configuration and interaction with other controls

ZAP is enabled by default for all Exchange Online mailboxes. It is not a policy you configure per se — but its behavior is affected by other configurations:

Correlation: ZAP + Safe Links + initial detection

The three controls work in sequence:

1. Initial detection blocks emails at delivery (best outcome — user never sees the email)
2. Safe Links protects at click time (user received the email but the URL is scanned when clicked)
3. ZAP removes post-delivery (user received and potentially read the email, but it is removed before further interaction)

The Module 13 timeline illustrates this: initial detection caught 0 of 23 (CAPTCHAed URL). Safe Links warned 7 clickers (5 clicked through). ZAP removed 4 after 23 minutes. The 19 that remained in inboxes were the exposure window. Each control layer reduces the exposure, but none alone is sufficient.

ZAP effectiveness over time

Track ZAP’s contribution to your overall email security over 30 days:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

EmailPostDeliveryEvents
| where TimeGenerated > ago(30d)
| where ActionType has "ZAP"
| summarize
    TotalZAP = count(),
    PhishZAP = countif(ActionTrigger has "Phish"),
    MalwareZAP = countif(ActionTrigger has "Malware"),
    SpamZAP = countif(ActionTrigger has "Spam")
    by bin(TimeGenerated, 7d)
| sort by TimeGenerated asc