MS Defender - Installation Error version 101.25072 on macOS

I’ve seen similar reports with the 101.25072 build on macOS. The error often isn’t network-related but tied to the installer package itself. A few things to try:

Fully uninstall the current Defender client (use the official uninstall script from Microsoft).

Reboot and download a fresh copy of the installer directly from the Microsoft Security portal rather than updating in place.

Check macOS system logs (Console.app) during install—sometimes Rosetta 2 or permission issues (system extensions not approved) cause the failure.

If you’re on macOS Sonoma or later, verify that system extension approvals are granted in System Settings > Privacy & Security.

If it still fails, I’d recommend opening a support ticket with Microsoft—this looks like a packaging issue specific to the new release, and it may need a patched installer.

Same for me, this is the installation error from the logs:

[2025-09-02 07:36:56.105370 +0000][StopUI]: [I]: Stopping UI
[2025-09-02 07:36:56.183523 +0000][StopUI]: [I]: Stop: killall: warning: kill -kill 1274: Operation not permitted

.... "code":"UIStopRejected", "text":"Cannot stop Defender UI process, tamper protection in state "block""

Followings are NOT worked for me:

Setting the tamper mode to "audit" (mdatp config tamper-protection enforcement-level --value audit)

Killing all defender process (not trivial) before installation

This worked:

offboarded the device (script method)

downloaded an onboard installation package: installed without problem

onboarded the device (script method)

(maybe offboard/onboard is not necessery, just running the latest installation package is enough)

Issue is still persistent. MBP M1 15.6.1.
Tried updating manually via terminal mdatp definitions update and reopened Auto-Update - Task and Error stays. Atleast definitions are up-to-date 

According to our own research, this is caused by the Defender Tamper Protection.

Happens with both MAU and manual installation:

"version": "101.25072.0011", "severity": "E", "code":"UIStopRejected", "text":"Cannot stop Defender UI process, tamper protection in state "block"

If you set the Tamper Protection to "Audit" instead of "Block", update will go through without issues.

Of course, this isn't any way ideal solution and waiting for a proper fix, without compromising the security policies we have in place.

I am having same issue, opened a ticker with MS, lets see what they say

Getting the same error. On intel running Macos 15.6.1 (24G90)

Is there any script for it?

Same issue here on M1 Mac.

Logs from AutoUpdate states that it fails due to "Invalid Hash" after download:

2025-09-01 13:15:19 [Microsoft Update Assistant] <Info> DownloadTask.DownloadBegin: {"UpdatePkg":"wdav-upgrade.pkg","UpdateID":"CFB7EF38-C76F-4EE6-8ED4-96567A5B0435","ExceedsChainedSize":"NO","IsSilent":"NO","PreviousUpdateID":"","AppID":"WDAV00","BundleVersion":"101.25062.0004","UpdateVersion":"101.25072.0010","LatestOnOfferBlocked":"NO"}
2025-09-01 13:15:19 [Microsoft Update Assistant] <Info> NOT.COLLECTED: {"Payload":"Downloading. URL: https://officecdnmac.microsoft.com/pr/1ac37578-5a24-40fb-892e-b89d85b6dfaa/MacAutoupdate/wdav-upgrade.pkg"}
2025-09-01 13:15:33 [Microsoft Update Assistant] <Info> NOT.COLLECTED: {"Payload":"Fetching file Success. File: https://officecdnmac.microsoft.com/pr/1ac37578-5a24-40fb-892e-b89d85b6dfaa/MacAutoupdate/wdav-upgrade.pkg"}
2025-09-01 13:15:33 [Microsoft Update Assistant] <Error> ErrorsAndWarnings: {"Error":"Invalid Hash","File":"wdav-upgrade.pkg","Operation":"Download","AppID":"WDAV00"}
2025-09-01 13:15:33 [Microsoft Update Assistant] <Info> ErrorsAndWarnings: {"Error":"Failed to download https://officecdnmac.microsoft.com/pr/1ac37578-5a24-40fb-892e-b89d85b6dfaa/MacAutoupdate/wdav-upgrade.pkg. Reason: 'Error Domain=com.microsoft.autoupdate Code=501 \"(null)\"'","Operation":"Download"}
2025-09-01 13:15:33 [Microsoft Update Assistant] <Warning> ErrorsAndWarnings: {"Error":"Failed. Msg: {\n    DownloadURL = \"officecdnmac.microsoft.com/pr/1ac37578-5a24-40fb-892e-b89d85b6dfaa/MacAutoupdate/wdav-upgrade.pkg\";\n    ErrorCode = 501;\n    ErrorDomain = \"com.microsoft.autoupdate\";\n}","UpdateID":"CFB7EF38-C76F-4EE6-8ED4-96567A5B0435","Operation":"Download","AppID":"WDAV00"}
2025-09-01 13:15:33 [Microsoft Update Assistant] <Info> NOT.COLLECTED: {"Payload":"Updating Application State for App: WDAV00 to: 9 info: Sorry, there's a problem with the downloaded file, so you can't update now. Please try again later."}
2025-09-01 13:15:33 [Microsoft AutoUpdate] <Info> NOT.COLLECTED: {"Payload":"Updater state changed: 2"}

The same problem on M4 proc. version 15.6.1

Same for me on M3 running 15.6.1

Getting the same error. On intel running Macos 15.6.1 (24G90)