How to Add Malware Scanning to Microsoft 365 Without Changing MX Records

• MX records control where mail arrives, not how attachments get inspected. Tenant-connected scanning adds a separate inspection layer without redirecting mail through a new public destination.
• API-based, connector, gateway, and journaling architectures each differ in enforcement timing, failure domain, and rollback profile, and those differences matter more than the label.
• Enforcement timing is the real question. Find out whether a product holds a message until a verdict arrives or remediates after the user may have already accessed it.
• A phased pilot validates the architecture before tenant-wide rollout. Least-privilege permissions, a representative pilot group, latency measurement, and a documented rollback plan come before full enforcement.
• MetaDefender™ for Microsoft 365 adds prevention-first, file-in-depth protection without MX changes or hardware. It combines inline inspection for Exchange Online email with API-based inspection for supported Teams workflows, with SharePoint Online, and OneDrive planned to roll out in October 2026, helping reduce the exposure window and reliance on post-delivery remediation.

A Mail Exchange (MX) record tells external mail servers where to deliver email for a domain, but it does not determine how attachments are inspected once messages enter Microsoft 365. Organizations can therefore add inline inspection through Exchange Online connectors without changing the public mail destination, while API-based workflows inspect files uploaded to Teams, SharePoint Online, and OneDrive.

Because attachment inspection, policy enforcement, quarantine, and remediation operate within the tenant, organizations can introduce an additional security layer while Exchange Online remains the public mail destination. Microsoft Learn explains how connectors can create this controlled message-processing path within the existing mail flow.

• What stays unchanged: external senders continue delivering email to the existing MX destination, and accepted messages continue through established Exchange Online routing, transport rules, and connectors.
• How the integration connects: Exchange Online email can be inspected through connector-based inline processing, while Teams, SharePoint Online, and OneDrive use API-based workflows with tenant authorization, defined policy scope, and administrative logging.
• Where inspection occurs: inline email inspection can hold an attachment until a verdict is available, whereas API-based workflows inspect Teams, SharePoint Online, and OneDrive files after upload. For collaboration workloads, verify whether access is restricted while analysis is in progress.

Deployment models differ in how they affect mail routing, when they can enforce a verdict, how they behave during service disruption, and how easily they can be rolled back. Those operational characteristics should drive the buying decision.

Evaluate each option against observed enforcement behavior, ownership of the mail path, the period of potential user exposure, and the effort required to restore normal operations.

Safe Attachments detonates email attachments in a virtual environment before delivery. For SharePoint Online, OneDrive, and Teams, however, Microsoft’s built-in virus detection runs asynchronously after upload and uses heuristics to determine which files are scanned.

Multi-engine scanning, file sanitization, predictive analysis, and deeper file analysis address different stages of the file-threat lifecycle and can add inspection depth alongside Microsoft Defender for Office 365.

For collaboration workloads, the evaluation should establish when inspection begins, whether access is restricted while a verdict is pending, and whether the service covers content already stored in the tenant. Actual coverage will also depend on rollout scope, service availability, file-processing limits, and policy configuration.

Design the proof of concept around representative users, business-critical file types, and password-protected attachments, with success criteria for detection efficacy, routing behavior, processing latency, and rollback established before tenant-wide deployment.

• Confirm prerequisites and permissions: review accepted domains, connectors, transport rules, Defender policies, and requested application permissions, then restrict access according to least-privilege principles.
• Define a representative pilot group: select a limited group covering relevant attachment types, business workflows, and risk levels, with documented duration, stakeholders, and exit criteria.
• Configure attachment policies before enforcement: define handling for file types, archives, macros, encrypted content, and size limits, beginning in monitoring mode or with narrowly scoped enforcement before tightening controls.
• Test detection and sanitization safely: use approved benign test files and representative business documents to verify the full sequence from inspection through policy action, notification, and logging.
• Measure attachment-processing latency: capture baseline and pilot delivery times by file type and size, define acceptable latency thresholds, and track help-desk contacts and false positives.
• Plan failure behavior and rollback: define fail-open or fail-closed behavior for each policy and document the steps required to disable enforcement, revoke authorization, and confirm that normal mail flow has been restored.

• Archives and nested content: recursive inspection, archive depth, and decompression limits matter, and unscannable content shouldn't receive an implicit clean verdict when a processing limit is reached.
• Macros, scripts, and embedded objects: organizations can block, strip, sanitize, quarantine, or allow content based on sender trust and business need, distinguishing detection from proactively removing risky components.
• Password-protected attachments: because encrypted content cannot be inspected or sanitized without the password, MetaDefender for Microsoft 365 allows an authorized user to submit it securely. The decrypted file can then pass through inspection, sanitization and, when required, detonation before delivery, without routine administrator intervention.
• Clear notifications and exceptions: define what users see for delayed, blocked, quarantined, or password-protected attachments, backed by an auditable exception process with ownership and expiration.
• Reducing false positives: track recurring file types and senders that generate avoidable investigations, and use policy tuning and self-service password submission to eliminate repetitive manual triage.

Third-party file inspection can operate alongside Microsoft Defender for Office 365 effectively when policy ownership is explicit, control boundaries are understood, and both systems are configured to avoid conflicting actions.

• Complementary controls: Microsoft continues to provide protection across email, identity, URLs, reputation signals, and Safe Attachments, while multiscanning, sanitization, and advanced file analysis add depth at the file-content layer.
• Clear scope boundaries: this added layer strengthens file inspection and sanitization, while Microsoft 365 controls continue to cover phishing, BEC, URL protection, identity, endpoint, and broader XDR functions.
• Avoiding conflicting actions: define which system owns blocking, quarantine, sanitized delivery, and release approval, and test messages that trigger both controls to catch loops or duplicate alerts.
• Duplicate scanning vs. defense in depth: before removing an overlapping control, confirm whether it brings an engine set, analysis method, or audit function that the remaining control lacks.
• A unified investigation process: correlate message identifiers, attachment hashes, and inspection results in one console or SIEM workflow so analysts aren't triaging the same incident twice.