How to Fix Microsoft ZAP Deleting False-Positive Emails
Question details
The user needs to understand how to handle and resolve situations where Microsoft Zero-hour Auto Purge (ZAP) incorrectly removes legitimate emails by classifying them as high-confidence phishing.
- Product
- Microsoft 365 / Exchange Online
- Device & OS
- not provided
- Scenario
- Legitimate business emails are being incorrectly flagged and purged from user inboxes after delivery.
- Observed behavior
- Exchange Online protection systems are unexpectedly deleting or quarantining valid incoming messages due to aggressive high-confidence phishing classifications.
Ensure you have Exchange Administrator, Security Administrator, or Global Administrator privileges in your Microsoft 365 tenant to access threat policies and message traces.
Investigate Quarantine and Threat Explorer Policies
Use the Microsoft 365 Defender portal to track the deleted emails, release false positives from quarantine, and review anti-spam settings.
Microsoft ZAP retroactively detects and purges malicious messages that bypass initial filters. When false positives occur, administrators must review quarantine rules and submit the safe messages back to Microsoft to train the filter.
Log in to the Microsoft 365 Defender portal using your admin credentials.
Go to 'Email & Collaboration' in the left menu, select 'Review', and then click on 'Quarantine'.
Locate the false-positive emails deleted by ZAP, select them, and choose 'Release' to deliver them back to the intended recipient's inbox.
During the release process, ensure you select the option to submit the email to Microsoft as a false positive, helping improve the classification algorithms.
Navigate to 'Policies & Rules' > 'Threat policies' > 'Anti-spam' to verify your organization's thresholds for high-confidence phishing are configured correctly.
Escalate to Microsoft Support or the Q&A Forum
If ZAP continues to aggressively delete legitimate emails from trusted senders, request a deeper investigation from Microsoft Exchange engineers.
Try WPS Office for a Lightweight Document Solution
While Microsoft 365 handles complex enterprise email infrastructure like ZAP and Exchange Online, you might be seeking a more straightforward, cost-effective solution for your daily document creation. WPS Office provides a free, highly compatible alternative to Microsoft Office, letting you create and edit documents, spreadsheets, and presentations without the heavy enterprise administration overhead.
- 1. Visit the Website: Go to the official WPS Office website to access the free installer.
- 2. Download the Installer: Click the 'Free Download' button compatible with your Windows, Mac, or Linux operating system.
- 3. Install and Use: Run the downloaded file to install the suite, and immediately start working on your office documents.
Frequently Asked Questions
What exactly is Microsoft ZAP (Zero-hour Auto Purge)?
ZAP is an automated email protection feature in Exchange Online that detects and neutralizes malicious phishing, spam, or malware messages that have already been delivered to a user's inbox.
Can I completely disable Microsoft ZAP for my organization?
While ZAP can be disabled for general spam, Microsoft strongly recommends leaving it enabled. ZAP for high-confidence phishing and malware cannot be entirely turned off through standard policies, as it protects tenants from critical security threats.
How can senders avoid having their emails flagged as high-confidence phishing?
Senders must ensure their domain authentication records (SPF, DKIM, and DMARC) are perfectly configured. Recipients can use the Tenant Allow/Block List to temporarily permit specific trusted senders while Microsoft analyzes submitted false positives.
