I have found that many don’t appreciate that Exchange Online uses anti virus engines from multiple providers, apart from Microsoft.
“We have partnerships with multiple anti-malware technology providers, so messages are scanned with the Microsoft anti-malware engines, two added signature based engines, plus URL and file reputation scans from multiple sources. Our partners are subject to change, but EOP always uses anti-malware protection from multiple partners. You can’t choose one anti-malware engine over another.:
per – How many anti-malware partners do you have? Can I choose which malware engines we use?
So email will be scanned by three (3) engines in total. One from Microsoft and another two from third parties.
CIAOPS 