ORCA.121: Supported filter policy action used.
| ID | ORCA.121 |
| Severity | Medium |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Zero-hour auto purge |
| Security area | Email and collaboration protection |
| Resource type | Policy |
| User impact of fixing | Low |
| Effort to fix | Low |
| MITRE ATT&CK | T1566 |
| Reads from | Exchange Online |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Zero Hour Autopurge can assist removing false-negatives post detection from mailboxes. It requires a supported action in the spam filter policy.
Remediation action
Section titled “Remediation action”Change filter policy action to support Zero Hour Auto Purge.
Related Links
Section titled “Related Links”- Microsoft 365 Defender Portal - Anti-spam settings
- Zero-hour auto purge - protection against spam and malware
Mito check, based on ORCA. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.