Defender Shim included in the Office 16.77 (and later) BusinessPro Suite Installer
Page Last Updated: September 12, 2023 @ 11:15am Pacific Time
Heads-up!
Starting with the Microsoft 365 and Office 16.77 BusinessPro Suite Installer the new Defender app will be installed by default.
This app is known as a 'shim' - in other words, it's a small app that acts as an entry-point for end-users to install the full version of Defender.
Message Center
Rude Q&A
Microsoft 365 tenant admins were notified about this change on July 26, 2023 through Message Center post MC661225
1. Why did you include a shim rather than the full app?
Not everyone will want Defender, and we didn't want to add another ~300 MB to the download of the installer.
2. How does the shim app download the full version of Defender?
When launched by the end-user, the shim app will register itself with Microsoft AutoUpdate (appId: WDAVSHIM) and then call the 'msupdate' CLI to start the install.
The version of the shim is 101.00000.0044 which is logically older than the full version of Defender, so Microsoft AutoUpdate will perform an app update.
3. Who is the target audience for this version of Defender?
The version of Defender downloaded through the shim is designed for consumers who have a Microsoft 365 Personal or Family subscription.
4. As a Mac Admin, I don't want this shim to be installed. What are my options?
If you currently deploy the BusinessPro Suite Installer and want to continue using it, you should push out the 'InstallDefender' managed preference via MDM.
If you set this preference to FALSE, the BusinessPro Suite Installer will not install the shim. See the Microsoft official documentation for more information.
Alternatively, you can use the Standard Suite Installer. This option installs Word, Excel, PowerPoint, Outlook, OneNote, OneDrive, and Microsoft AutoUpdate. It does not include Teams nor the Defender shim.
5. How do I get rid of the shim if I accidentally installed it?
You should run 'rm -rf /Applications/Microsoft\ Defender.app' through a policy. There are no other files to remove.