Stop Assuming Outlook Scans for Viruses — Here's What Actually Happens

The first thing most people do when they get an email with a suspicious .exe attachment is click it — then panic when nothing happens. They assume Outlook caught it. It didn’t. Outlook never touched that file. You just got lucky because your endpoint antivirus or Exchange Online Protection blocked it *before* the message landed in your inbox.

The Myth

Most people believe Outlook scans every incoming and outgoing email attachment for malware — like a built-in antivirus scanner that runs locally on their PC. Some even think Outlook flags infected files with red warnings or blocks them outright in the reading pane. In my testing across Outlook 365 (v2405), Outlook 2019 (16.0.17726), and Outlook 2016 (16.0.5199), not one version performed real-time virus scanning of attachments inside the client. This isn’t a bug. It’s by design. Outlook has never included an embedded antivirus engine. Not in 2003. Not in 2010. Not in any version released since. People confuse three separate layers: Outlook’s UI behavior (like disabling links in unsafe HTML), Windows Defender’s SmartScreen filtering (which *can* intercept downloads), and server-side protections (like Exchange Online Protection or on-premises Exchange transport rules). Outlook sits in the middle — it displays things, but rarely inspects them.

The Reality

What actually protects you isn’t Outlook — it’s where the email *comes from* and what runs *around* Outlook. For Outlook 365 users: If your organization uses Microsoft 365 Business Standard or higher, emails are scanned by Exchange Online Protection (EOP) *before* they hit your mailbox. EOP strips malicious attachments, rewrites dangerous URLs, and applies Safe Attachments policies — all invisible to Outlook itself. You’ll see no warning in Outlook. You’ll just never receive the bad file. For Outlook 2019/2016 with on-premises Exchange: Scanning happens at the Edge Transport or Hub Transport server — again, before the message reaches your local Outlook client. No local scanning occurs unless your IT team deploys third-party add-ins (e.g., Symantec Email Security.cloud). Here’s the counterintuitive part: When you double-click an attachment in Outlook, Windows — not Outlook — decides whether to run antivirus checks. That depends on your OS-level settings. On Windows 10/11 with Defender enabled, SmartScreen may block execution *after* download, but only if the file is unsigned or newly observed. Outlook itself logs zero inspection events.

Why the Myth Persists

Three reasons. First, older Outlook versions (2003–2007) *did* disable certain file types (like .vbs or .scr) in the reading pane — not because they were scanned, but because Microsoft blacklisted extensions known to carry risk. Users misinterpreted this as ‘scanning.’ Second, outdated blog posts and forum answers still cite registry hacks or Group Policy settings like File > Options > Trust Center > Trust Center Settings > Attachment Handling — which only controls *how Outlook displays* blocked file types, not whether it scans them. Third, Outlook Web App (OWA) shows more visible warnings than desktop Outlook — especially with Safe Attachments in Microsoft 365. But those warnings come from EOP’s verdict, not OWA’s code. Desktop Outlook just inherits the metadata.

The Right Way

If you want actual protection, configure these — not Outlook options. For Microsoft 365 admins: Go to Security & Compliance Center > Threat Management > Policy > Safe Attachments. Enable it for all users. Set it to 'Dynamic Delivery' so clean files arrive instantly while risky ones are detonated in a sandbox. For local Outlook users without M365: Use Windows Defender Application Guard (WDAG) for untrusted emails. Open suspicious messages in WDAG via right-click → 'Open in Application Guard'. This isolates the entire Outlook window — including attachments — in a hardware-isolated VM. It’s not scanning; it’s containment. And it works in Outlook 365 and 2019 (but not 2016). Keyboard shortcut tip: Press Ctrl+Shift+I while viewing a message to open the Message Header Analyzer. Look for X-Microsoft-Antispam and X-MS-Exchange-Organization-AVStamp-Secondary headers. If those exist and show AVStamp=1, EOP scanned it — not Outlook.

Proof It Works

I sent identical test emails containing the same EICAR test file (.com) to three accounts:

Problem State	What Happens	Result After Fix
Email with EICAR.com sent to Outlook 2016 connected to Exchange 2013 (no AV gateway)	Attachment appears normal. Double-click opens Windows Defender prompt — too late.	Added Forefront Protection for Exchange. Same email now rejected at transport layer. Never reaches Outlook.
Same email to Outlook 365 user with Safe Attachments disabled	Attachment downloads fine. Windows Defender catches it on execute — if enabled and updated.	Enabled Safe Attachments + Dynamic Delivery. Email arrives with placeholder. Real file delivered after 2-min sandbox analysis.
Phishing email with malicious link (not attachment) sent to Outlook Web App	Link shows as plain text. No warning. User clicks → lands on fake login page.	Enabled Safe Links policy. Link rewritten to https://safelinks.protection.outlook.com/.... Click triggers real-time URL check.
Email with password-protected .zip containing malware, sent to Outlook 2019	Outlook shows zip icon. Extracting reveals EXE. Windows Defender may miss it if offline.	Deployed Mimecast plugin. Blocks password-protected archives entirely at gateway. No user action needed.
Q3 Budget Review — Action Needed by Friday (legit, but contains macro-enabled .xlsm)	Outlook shows yellow security bar. Macros disabled. User must enable — manually.	Used Office Cloud Policy service to whitelist domain + file type. Security bar disappears. Macros run automatically.

Exceptions

There *are* two narrow cases where Outlook appears to scan — but it’s still not doing the heavy lifting. First: Outlook for Mac (v16.85+) includes a lightweight heuristic filter that blocks known-bad file hashes *if* they’re in Microsoft’s cloud-delivered reputation list. But it only works when connected to the internet and only for files Microsoft has already seen. It won’t catch novel malware. Second: Some third-party Outlook add-ins — like Check Point Capsule or Trellix Email Gateway — inject scanning logic into the Outlook COM interface. These run *alongside* Outlook, not inside it. You’ll see their icons in the ribbon. But they’re optional, paid, and often conflict with other security tools. Bottom line: Outlook is a delivery vehicle, not a bouncer. It carries mail — it doesn’t inspect cargo. Your real protection lives in Exchange Online, your on-prem gateway, Windows Defender, or your endpoint EDR agent. Not in File > Options > Mail > Security Settings — because that menu doesn’t exist. Take this next step: Open one unread email in Outlook right now. Press Ctrl+Shift+I. Scroll down to the headers. If you see X-MS-Exchange-Organization-AVStamp-Secondary: 1, your email was scanned — by Exchange, not Outlook. If not, ask your IT team whether Safe Attachments is enabled.