Question

Your organization uses Microsoft Defender for Office 365 Plan 1. Several users report receiving a phishing email that was delivered to their inboxes 30 minutes ago. Investigation confirms the message was malicious and identical copies reached 40 mailboxes. You need to automatically remove the already-delivered malicious messages from all affected mailboxes with the least administrative effort. Which action should you take?

Accepted Answer

Confirm that zero-hour auto purge (ZAP) for phishing is enabled in the anti-spam and anti-phishing policies so the messages are retroactively moved to Junk/quarantine.

Answer

Create a mail flow rule (transport rule) that deletes messages matching the sender address.

Answer

Instruct each affected user to manually delete the message and empty their Deleted Items folder.

Answer

Run a content search in the Microsoft Purview portal and perform a search-and-purge action.