Microsoft Defender AV must be configured to turn on email scanning.

This policy setting allows the configuration of email scanning. When email scanning is enabled, the engine will parse the mailbox and mail files according to their specific format in order to analyze the mail bodies and attachments. Several email formats are currently supported, for example: pst (Outlook), dbx mbx mime (Outlook Express), binhex (Mac). If this setting is enabled, email scanning will be enabled. If this setting is disabled or not configured, email scanning will be disabled.

Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Scan >> "Turn on email scanning" is set to "Enabled".

Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Scan

If the value "DisableEmailScanning" is "REG_DWORD = 0", this is not a finding. If the value is "1", this is a finding.

Alternate Check (if Microsoft Intune applied this setting):

Navigate to "HKLM\Software\Policies\Microsoft\Windows Defender\Policy Manager".

If the value "AllowEmailScanning" is "REG_DWORD = 1", this is not a finding. If the value is "0", this is a finding.

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> Scan >> "Turn on email scanning" to "Enabled".