Monitoring ZAP massive action

%3CLINGO-SUB%20id%3D%22lingo-sub-892868%22%20slang%3D%22en-US%22%3EMonitoring%20ZAP%20massive%20action%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-892868%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20all%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERecently%2C%20we%20have%20suffered%20an%20internal%20problem%20because%20of%20an%20action%20taken%20from%20ZAP.%20It%20was%20involving%20around%20200k%20mails%20in%20all%20the%20company%20and%20they%20were%20send%20to%20deleted%20items%20after%20approving%20an%20action%20in%20ZAP.%3CBR%20%2F%3EIs%20it%20possible%20to%20monitor%20or%20alert%20when%20a%20massive%20action%20is%20taken%20from%20ZAP%3F%3C%2FP%3E%3CP%3EWe%20do%20not%20want%20to%20have%20the%20same%20situation.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-892868%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAdmin%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESecurity%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-893991%22%20slang%3D%22en-US%22%3ERe%3A%20Monitoring%20ZAP%20massive%20action%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-893991%22%20slang%3D%22en-US%22%3E%3CP%3EI'm%20not%20aware%20of%20any%20such%20functionality%2C%20and%20even%20if%20such%20was%20available%2C%20it%20wont%20be%20of%20much%20use%20as%20you%20cannot%20influence%20ZAP's%20action.%20Yes%2C%20you%20can%20change%20the%20action%20post-fact%2C%20but%20that's%20not%20of%20much%20help%20when%20you%20have%20to%20recover%20200k%20messages.%20Best%20report%20this%20to%20Microsoft%20so%20they%20can%20learn%20from%20it%20and%20hopefully%20improve%20the%20accuracy.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-896280%22%20slang%3D%22en-US%22%3ERe%3A%20Monitoring%20ZAP%20massive%20action%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-896280%22%20slang%3D%22en-US%22%3E%3CP%3EHIi%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20for%20your%20answer.%3C%2FP%3E%3CP%3EI%20suppose%20that%20I%20would%20have%20to%20cross%20my%20fingers%20that%20we%20won't%20perform%20an%20action%20to%20massive%20emails%20like%20before.%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

Hi all,

 

Recently, we have suffered an internal problem because of an action taken from ZAP. It was involving around 200k mails in all the company and they were send to deleted items after approving an action in ZAP.
Is it possible to monitor or alert when a massive action is taken from ZAP?

We do not want to have the same situation.

 

Thanks!

2 Replies
Highlighted

I'm not aware of any such functionality, and even if such was available, it wont be of much use as you cannot influence ZAP's action. Yes, you can change the action post-fact, but that's not of much help when you have to recover 200k messages. Best report this to Microsoft so they can learn from it and hopefully improve the accuracy. 

Highlighted

HIi @Vasil Michev 

 

Thanks for your answer.

I suppose that I would have to cross my fingers that we won't perform an action to massive emails like before.