KB5002784: Enhances the AMSI Filter feature module

Description of the security update for SharePoint Server Subscription Edition: September 09, 2025 (KB5002784)

Improvements and fixes
This security update introduces the SharePoint Server Subscription Edition Version 25H2 feature update. This feature update will be included in all SharePoint Server Subscription Edition public updates going forward. For more information about this feature update, see New and improved features in SharePoint Server Subscription Edition Version 25H2.

This security update contains improvements and fixes for the following nonsecurity issues in SharePoint Server Subscription Edition:

• You can now use the Test-DefenderAndAmsiWorkProperly cmdlet in SharePoint Management Shell to verify that all Windows Defender components are installed and active, and that SharePoint AMSI (Antimalware Scan Interface) integration is functioning correctly.
• In order to use workflows in SharePoint Server, you must now have the latest update for SharePoint Workflow Manager installed.
• To strengthen security in SharePoint Server, users in the WSS_WPG group are now restricted from running administrative processes, such as the SharePoint Products Configuration Wizard (Psconfig). For more information, see Account permissions and security settings in SharePoint Servers.
• Updates the Machine Key Rotation Job schedule from monthly to weekly and make sure that it's automatically triggered after each update cycle finishes.
• Enhances the AMSI Filter feature module. Changes the default setting to be always on.
• Fixes an issue in which all matching requests are immediately blocked when throttling rules are configured.
• Updates the NuGet package Microsoft.Exchange.OfficeGraph.SpoolsScaleOutMapper to version 5.0.5​​​​​​​.
• Fixes an issue in which some characters cannot be displayed correctly in email messages if they use the GB18030 character set for outgoing email.