Enable anti-malware and auto-purge

Anti-malware policy blocks common malicious file types regardless of content (executables, scripts). Zero-hour Auto Purge (ZAP) retroactively removes mail from inboxes when Defender later identifies it as malware or phish — critical when threat signatures arrive minutes after delivery.

A scan reports where your tenant stands on this check — pass, fail with a step-by-step fix, or not applicable if your licensing doesn’t include the feature. When Tenant Strike can’t read a setting with read-only access, it says unverified and gives you a one-command way to confirm it yourself — it never guesses.