Identifying Zero-Hour Auto Purge (ZAP) Actions in Defender

SC-200 By islever Editorial Last updated

Configure detections Respond to alerts and incidents in Microsoft Defender for Endpoint

Short answer

A Use the Threat Protection Status report in Microsoft Defender for Office 365 to verify if Zero-Hour Auto Purge (ZAP) moved an email, as it tracks ZAP actions while Exchange logs do not record them.

Question

You have a Microsoft 365 tenant that uses Microsoft Exchange Online and Microsoft Defender for Office 365.
What should you use to identify whether zero-hour auto purge (ZAP) moved an email message from the mailbox of a user?
  1. the Threat Protection Status report in Microsoft Defender for Office 365 Correct Answer
  2. the mailbox audit log in Exchange
  3. the Safe Attachments file types report in Microsoft Defender for Office 365
  4. the mail flow report in Exchange

Key Takeaways

The main trap is assuming ZAP actions appear in Exchange mailbox audit logs; they do not. ZAP is a Defender feature, so its evidence is found in Defender's Threat Protection Status report or Threat Explorer.

This page explains why the Threat Protection Status report in Microsoft Defender for Office 365 is the correct method to identify ZAP email movements, distinguishing it from Exchange audit logs.

Common mistake: Candidates often choose Option B (mailbox audit log) because they assume all mailbox changes are audited there. However, ZAP is a system-level security action explicitly excluded from Exchange audit logs, making Option A the only valid source.

Expert Analysis

The question asks how to identify if Zero-Hour Auto Purge (ZAP) moved an email message from a user's mailbox. The key distinction here is between aggregate reporting and individual message tracking, specifically within the Microsoft Defender for Office 365 ecosystem.

The Threat Protection Status report (Option A) in Microsoft Defender for Office 365 provides visibility into ZAP actions. According to official documentation, this report includes views such as 'Mailflow' which shows the count of ZAP-affected messages, and 'Threat Explorer' (often accessed via or linked from these reports) allows filtering by 'Additional action' to see specific events where ZAP was triggered. This is the designated tool for verifying ZAP activity at both the tenant level (counts) and the individual message level (details).

Why the other options are incorrect:

  • Option B (Mailbox audit log): While ZAP involves moving mail, Microsoft explicitly states that ZAP actions are not logged as system actions in the Exchange mailbox audit logs. Therefore, auditing the mailbox will not reveal ZAP activity.
  • Option C (Safe Attachments file types report): This report focuses on attachment types and has been largely deprecated or superseded by broader threat protection reports. It does not provide specific ZAP movement data for emails.
  • Option D (Mail flow report in Exchange): This refers to the standard Exchange Online mail flow logs, which track delivery status but do not contain details about security-specific actions like ZAP performed by Defender for Office 365. Confusing this with the 'Mail Flow status report' in Defender is a common trap.

The critical boundary is that ZAP is a Defender feature, not an Exchange native feature, so its logs reside in Defender's reporting tools, not Exchange's audit or flow logs.

Official Reference

https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/zero-hour-auto-purge?view=o365-worldwide

This link opens the official vendor documentation in a new tab.

Exam Strategy

When dealing with Microsoft 365 security features, always map the feature to its owning platform. If a feature is part of 'Defender for Office 365', its logs and reports will be in the Defender portal, not in Exchange or Azure AD logs unless specifically integrated. Memorize that ZAP actions are NOT in the Exchange mailbox audit log to avoid this common distractor.

Frequently Asked Questions

Is ZAP activity logged in the Exchange mailbox audit log?

No. Microsoft explicitly states that Zero-Hour Auto Purge (ZAP) actions are not recorded as system actions in the Exchange mailbox audit logs.

Where can I see detailed ZAP events for a specific email?

You can use Threat Explorer in Microsoft Defender for Office 365, filtering by 'All email events' and checking the 'Additional action' column for 'ZAP'.

More SC-200 FAQ →

Community Votes

A
67%
B
33%

67% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 21 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 21

  1. us3r 👍 13 Answered A
    A) answer refers to Threat Explorer To determine if ZAP moved your message, you have the following options: Number of messages: Use the Mailflow view in the Mailflow status report to see the number of ZAP-affected messages for the specified date range. Message details: Use Threat Explorer (and real-time detections) to filter All email events by the value ZAP for the Additional action column. answer D (Exchange mailflow) ≠ Mailflow view in the Mailflow status report
  2. vincenttoolate 👍 8
    Yes, the answer D said "mail flow report in Exchange", this is not the same as "Mail Status Report" at Microsoft Defender for Office 365. A is correct as per: https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/view-email-security-reports?view=o365-worldwide#threat-protection-status-report "The report provides the count of email messages with malicious content, such as files or website addresses (URLs) that were blocked by the anti-malware engine, zero-hour auto purge (ZAP), and Defender for Office 365 features like Safe Links, Safe Attachments, and impersonation protection features in anti-phishing policies."
  3. rdy4u 👍 5
    To determine if ZAP moved your message, you have the following options: • Number of messages: Use the Mailflow view in the Mailflow status report to see the number of ZAP-affected messages for the specified date range. • Message details: Use Threat Explorer (and real-time detections) to filter All email events by the value ZAP for the Additional action column. D should be.,=
  4. Anko6116 👍 5 Answered A
    Correct seems to be A based on provided article. Section: How to see if ZAP moved your message. https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/zero-hour-auto-purge?view=o365-worldwide B - does not make sense to check Safe Attachments when we're looking for mails. C & D: ZAP is not logged in the Exchange mailbox audit logs as a system action.
  5. Mthaher 👍 5
    it should be D the mail flow report in Exchange . https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/zero-hour-auto-purge?view=o365-worldwide#how-to-see-if-zap-moved-your-message
Show 16 more comments
  1. HAjouz 👍 4 Answered B
    While the Threat Protection Status report in Microsoft Defender for Office 365 provides an overview of threats detected and actions taken, it doesn't specifically track individual email movements caused by zero-hour auto purge (ZAP). The mailbox audit log in Exchange is more precise for this purpose because it logs detailed actions on emails, including those moved by ZAP. This allows you to see exactly when and why an email was moved from a user's mailbox.
  2. Metasploit 👍 3 Answered A
    A by process of elimination. Not the following: b = ZAP is not logged as system action in auditlog in exchange c = The Safe attachment file types report has been deprecated and is now replaced by the Threat Protection Status Report. d= The mail flow report in "Exchange". Not the "Mail Flow status Report". The mail flow reports in "Exchange" are not relevant here.
  3. Whatsamattr81 👍 2
    Keyword here is 'an' email message. Not how many email messages. Number of messages: Use the Mailflow view in the Mailflow status report to see the number of ZAP-affected messages for the specified date range. Message details: Use Threat Explorer (and real-time detections) to filter All email events by the value ZAP for the Additional action column. To check 'an email', use Threat Explorer first
  4. UmarCyber 👍 2
    To determine if ZAP moved your message, you can use either the Threat Protection Status report or Threat Explorer (and real-time detections). So the answer is - A https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/zero-hour-auto-purge?view=o365-worldwide
  5. prjreddit 👍 2 Answered A
    The answer is A. The mail flow report does show the flow of all mail on aggregate - so you do see the number of mails moved by ZAP - but the questions state a mail from a specific user - that you see in the Threat Explorer.
  6. danlo 👍 2
    ZAP is not logged in the Exchange mailbox audit logs as a system action.
  7. AbdulMueez 👍 2
    The answer is A
  8. Nikki0222 👍 2
    A correct
  9. chepeerick 👍 2
    option A
  10. diego205 👍 1 Answered B
    Explicação: O ZAP é um recurso do Microsoft Defender for Office 365 que: Remove automaticamente mensagens maliciosas ou phishing da caixa de entrada do usuário após a entrega, caso o conteúdo seja reclassificado como ameaça. Essa ação acontece no nível do Exchange, movendo o e-mail para o quarentena/lixo ou pasta de spam. Para verificar se o ZAP agiu, você precisa: ✔️ Acessar o log de auditoria da caixa de correio no Exchange Online. Esse log mostra: Quando uma mensagem foi movida. Quem/qual sistema realizou a ação. A ação "ZAP" aparece registrada como um evento de movimentação automática.
  11. Lone__Wolf 👍 1
    Yes.. The correct option to identify whether ZAP moved an email message from the mailbox of a user is the Threat Protection Status report in Microsoft Defender for Office 365. This report provides information about the actions taken by Microsoft Defender for Office 365, including ZAP, to protect the tenant against malicious email messages. The zero-hour auto purge (ZAP) is not logged as a system action in the Exchange mailbox audit logs. So B is incorrect.
  12. MonicaKarim 👍 1 Answered A
    The Mail Flow report in the Exchange Admin Center (EAC) is useful for understanding general email traffic patterns, delivery issues, and trends, but it does not provide detailed information about ZAP actions. To confirm if ZAP moved a message, use: Microsoft 365 Defender > Threat Explorer (most detailed)
  13. Oryx360 👍 1 Answered B
    It is the Mailbox Audit Log and all the other answers are wrong: Zero-hour auto purge (ZAP) is a feature in Exchange Online Protection (EOP) that detects and removes emails containing malware even after they have been delivered to mailboxes.
  14. Ramkid 👍 1
    Correct Answer, Just check this https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/zero-hour-auto-purge?view=o365-worldwide#how-to-see-if-zap-moved-your-message
  15. amsioso 👍 1
    https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/view-email-security-reports?view=o365-worldwide#threat-protection-status-report
  16. BenLam 👍 1 Answered A
    https://learn.microsoft.com/en-us/defender-office-365/zero-hour-auto-purge Zap is not logged in audit logs.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Least-privilege roles for Microsoft 365 Defender action approvals

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide