![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(179.20000000000002, 7.000000000000001%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGM%3C/text%3E%3C/svg%3E)
Microsoft Security | Microsoft Defender | Microsoft Defender for Office 365
Protection against phishing, malware, and other threats targeting email and collaboration tools in Microsoft 365
Hello,
When images in external emails are not displayed, the root cause is usually one of the following:
External image blocking at client level Safe Links or Safe Attachments rewriting Content modification by a third party gateway HTML sanitisation by Exchange Online Protection
You need to isolate where the images are being removed or blocked.
Step 1. Confirm whether the images are embedded or externally hosted.
Ask the sender to confirm whether the images are:
Inline attachments using Content ID references Hosted externally and referenced via HTTP or HTTPS links
If the images are externally hosted, Outlook and Outlook on the web will block them by default until the user selects Download pictures. This is client side behaviour and not Defender enforcement.
Test by opening the message in Outlook on the web and selecting Download pictures. If the images render, no server side change is required.
Step 2. Inspect the original message headers and body.
In Exchange admin centre:
Run a Message Trace to confirm the message is not modified post delivery.
In Outlook:
Open the message and view the source. Check whether the img tags still exist and whether the source URLs are intact.
If the img tags are missing entirely, the third party gateway is stripping them before delivery.
Step 3. Check Safe Links rewriting.
If Defender for Office 365 is enabled:
Go to Microsoft 365 Defender portal. Navigate to Email and collaboration. Open Policies and rules. Review Safe Links policies.
If the external image URLs are being rewritten and the destination site is not reachable from client networks, the images will fail to render.
You can temporarily exclude the sender domain or URL domain from Safe Links to test.
Step 4. Verify Anti spam or Anti phishing policy actions.
In Defender portal:
Go to Threat policies. Review Anti spam inbound policy. Check whether the action includes dynamic content sanitisation.
Normally, Exchange Online does not strip images unless they are considered malicious or the message fails authentication severely.
Step 5. Validate the third party email gateway.
Since you are using a third party gateway, this is the most likely control point.
Confirm:
The gateway is not converting HTML to plain text. The gateway is not removing external image references. The gateway is not replacing image URLs with tracking links that are blocked internally.
Perform a controlled test by temporarily bypassing the third party gateway for the sender IP or domain and deliver directly to Exchange Online. If images render correctly, the gateway is the cause.
Step 6. Check Outlook client Trust Centre settings.
In Outlook desktop:
File Options Trust Centre Trust Centre Settings Automatic Download
Ensure that Do not download pictures automatically in HTML email is not enforced via Group Policy.
Conclusion.
Microsoft Defender rarely strips images unless they are malicious. In environments with a third party gateway, the issue is most commonly caused by HTML modification or URL rewriting at the gateway layer, or by client side automatic external image blocking.
Isolate by testing direct delivery and reviewing the raw MIME content to determine exactly where the image references are altered.