When the customer sends a testing email using an internal SMTP server to internal recipients, the Office 365 Securlet does not scan the email
Release : 1.0
This is by design to preserve the bandwidth. The Office 365 Securlet does not scan internal emails twice. For internal emails, the Securlet will scan the sender's mailbox. For emails coming from the external sender, the Securlet will scan the recipient's mailbox. Since using an internal email sender to send email does not leave a record in the Sender's outbox, there is nothing for the Securlet to scan.
The customer can change the testing to use Graph API or other methods so the emails sent show up in the internal sender's mailbox.