Starting September 2025, Microsoft Defender Antivirus will require the AVSignatureDue policy minimum to be 2 days (up from 1 day) to prevent false alerts. Organizations with settings below 2 days should update their configuration before rollout completes in mid-October 2025.
Applies to: Microsoft Defender XDR
Source: mc.merill.net — data via Merill Fernando's open archive (MIT).