If you use WSUS to keep your antimalware definitions up to date, you can configure it to auto-approve definition updates.
If you double-click the amber symbol, you can verify that Forefront is not updating automatically by looking at the date at the bottom of the window.
This update method can be useful if there is a problem with your Configuration Manager infrastructure that prevents the delivery of updates.
You can manually download the latest definition updates from Microsoft and then configure clients to download these definitions from a shared folder on the network.
You can configure Configuration Manager software updates to deliver definition updates to client computers.
This is done by configuring automatic deployment rules.