Forum Discussion
MS Defender - Installation Error version 101.25072 on macOS
FYI...MS has this posted on their service health status page. They have a fix in the works but sounds like it will be a "side channel" upgrade of some kind. I'm betting we'll be having to push a shell script via MDM that will end up doing a "rip and replace" of sorts.
https://admin.cloud.microsoft/?#/servicehealth/:/alerts/DZ1144032
UPDATE: Microsoft has published the fix. As near as I can tell, it involves pushing out an MDM profile to enable a tamper protection exclusion only for a special "upgrade helper" package Microsoft has provided. You then push out the pkg which sets tamper protection to audit mode, upgrades Defender, then turns tamper protection back on. Instructions and the helper package are found in the below link, which was published in the service health alert linked above.
https://github.com/microsoft/mdatp-xplat/tree/master/macos/upgrade_from_2506_helper
Same for me, this is the installation error from the logs:
[2025-09-02 07:36:56.105370 +0000][StopUI]: [I]: Stopping UI
[2025-09-02 07:36:56.183523 +0000][StopUI]: [I]: Stop: killall: warning: kill -kill 1274: Operation not permitted
.... "code":"UIStopRejected", "text":"Cannot stop Defender UI process, tamper protection in state "block""
Followings are NOT worked for me:
Setting the tamper mode to "audit" (mdatp config tamper-protection enforcement-level --value audit)
Killing all defender process (not trivial) before installation
This worked:
offboarded the device (script method)
downloaded an onboard installation package: installed without problem
onboarded the device (script method)
(maybe offboard/onboard is not necessery, just running the latest installation package is enough)