Security Policy Errors

Why Does Microsoft 365 Zero-Hour Auto Purge Action Show as None?

Adam Davis Sep 27, 2026 869 views

Question details

The user needs to understand why Zero-Hour Auto Purge (ZAP) detects malware or phishing in an email but fails to remove or quarantine it, displaying an action of 'None'.

Why Does Microsoft 365 Zero-Hour Auto Purge (ZAP) Action Show as None?

Product: Microsoft 365 / Exchange Online
Device & OS: not provided
Scenario: Reviewing email security logs and noticing ZAP actions are not being enforced on malicious emails.
Observed behavior: ZAP detects a threat in an email but displays an action of 'None', leaving the message in the inbox instead of quarantining or deleting it.

Before you start

Ensure you have administrator access to the Microsoft 365 Defender portal and the ability to extract internet message headers from affected emails in Outlook.

Solution 1Recommended

Collect Internet Message Headers and Open a Microsoft Support Case

Since ZAP is a backend Microsoft 365 security feature, unresolved 'None' actions typically require Microsoft's engineering team to investigate the specific message headers.

Zero-Hour Auto Purge (ZAP) is designed to retroactively detect and neutralize malicious emails that have already been delivered. When the action shows as 'None', it often indicates a policy conflict, a Safe Senders override, or a backend routing issue.

Because admin logs alone do not provide the full picture of the routing history, support engineers need the original internet message header to trace the email's path and policy evaluations accurately.

Open the affected email

Launch Microsoft Outlook or Outlook on the web and double-click the affected email to open it in a separate window.

Extract the message header

In Outlook desktop, go to File > Properties. Locate the 'Internet headers' box at the bottom of the Properties window and copy all the text inside it.

Save the header securely

Paste the copied header text into a secure text document (like Notepad) and save it to your local drive.

Open a Microsoft Support request

Log in to the Microsoft 365 admin center, navigate to Support, and create a new service request describing the ZAP failure.

Provide headers privately

Share the saved text file containing the message header with the support agent through their secure private channel.

Collect Internet Message Headers and Open a Microsoft Support Case

Privacy Warning: Never share internet message headers containing sensitive internal routing or personal email addresses on public community forums.

Solution 2

Verify Tenant Security Policies and Overrides

Sometimes ZAP actions are bypassed due to conflicting local configurations, such as Safe Senders lists or Exchange mail flow rules.

Free Microsoft Office alternative

Looking for a Lighter Office Suite? Try WPS Office

While Microsoft 365 handles complex enterprise email routing and security like ZAP, you might not need such a heavy subscription for everyday document creation. WPS Office offers a free, lightweight, and highly compatible alternative to Microsoft Word, Excel, and PowerPoint.

1. Visit the WPS Office website: Go to the official WPS Office website on your computer.
2. Download the software: Click the 'Free Download' button to get the installer for your Windows, Mac, or Linux operating system.
3. Install and use: Run the installer, complete the quick setup, and start opening your Microsoft Office documents seamlessly.

Fully compatible with Microsoft Office formats (.docx, .xlsx, .pptx).Free to download and use for essential document, spreadsheet, and presentation tasks.Lightweight software that consumes fewer system resources and opens files instantly.Familiar user interface makes migrating from Microsoft Office seamless.

microsoft office alternative - wps office

Frequently Asked Questions

What is Zero-Hour Auto Purge (ZAP) in Microsoft 365?

ZAP is an email protection feature in Exchange Online that retroactively detects and neutralizes malicious phishing, spam, or malware messages that have already been delivered to a user's inbox.

Why would a ZAP action bypass a malicious email?

This can happen if the message was manually moved out of the inbox, if the mailbox is placed on legal hold, or if a tenant-level mail flow rule or Safe Senders list overrides the ZAP security policy.

How do I find an internet message header in Outlook?

Open the specific email in Outlook desktop, click on the File tab, select Properties, and look at the 'Internet headers' box at the bottom of the window. You can copy all the text inside to share with technical support.

Microsoft Office Security Issues