Mail Security lets you offload Mailbox server scanning to enhance server performance. Most of the scanning is performed on the Hub Transport and Edge Transport servers.
Mail Security scans email messages at the Mailbox only when the following occurs:
An incoming email message does not have a stamp that indicates that it has already been scanned.
The Mailbox server has more current definitions than those used to scan the message at the Hub Transport or Edge Transport servers.
You schedule background scanning.
You disable the "Exclude outbound scanning on mailbox server" setting.
This option is enabled by default.
You send an Outlook Web Access message.