The behavior of Real-time Scan varies depending on how files are stored in OneDrive.

You can check the file storage type by the icon displayed next to the file, and the behavior for each type is as follows.

: The blue cloud icon next to a OneDrive file or folder indicates that the file is available online only.  Online-only files are not stored on the local computer and are therefore not subject to Real-time Scan or Intense Scan.

: When you open an online-only file, it is downloaded to the device and becomes available locally. Files that are available locally are subject to Real-time Scan and Intense Scan.

: Files configured with the "Always keep on this device" option are stored on the local device and can be scanned by Real-time Scan and Intense Scan.