Security & Modernization | Legacy ToolPane.aspx in Project Server Subscription Edition

Microsoft has not publicly announced a modern PWA replacement for Project Server Subscription Edition, so the supported posture is to retain the classic PWA architecture while keeping the underlying SharePoint Server farm fully patched and protected with AMSI and endpoint security.

Current product direction

The published Project Server Subscription Edition documentation explicitly says there are “no major features or enhancements” to Project Web App in that release. Its documented architecture still places Project Web App in the front-end tier and associates Project Server with SharePoint site collections and services.^1^ ^2^

Microsoft’s current upgrade documentation also continues to describe upgrading existing PWA sites rather than migrating them to a new modern PWA.^3^

Therefore:

• There is no published commitment or schedule for replacing ToolPane.aspx or the classic PWA web-part framework.
• This does not establish that Microsoft will never modernize PWA; it only reflects currently published product information.
• Project Online’s retirement does not apply to Project Server Subscription Edition, which retains the familiar on-premises PWA experience.^4^

Required operational security posture

These procedures require SharePoint farm-administrator and local server-administrator access. Validate updates and configuration changes in a representative non-production farm before production rollout.

1. Apply the latest applicable SharePoint Server Subscription Edition security update across the entire farm.
   • Back up the farm and databases according to your recovery plan.
   • Install the update on every SharePoint server during a maintenance window.
   • Run the SharePoint Products Configuration Wizard as required.
   • Confirm every server completed patching and reports the intended build before returning the farm to service.
   For the July 2025 incident specifically, KB5002768 fixed CVE-2025-53770 and CVE-2025-53771 on Subscription Edition; build 16.0.18526.20508 identifies that package.^5^ Because SharePoint security updates are cumulative, use the latest applicable update rather than treating KB5002768 as the current patch baseline.^6^
2. Enable and validate AMSI request scanning.
   • On SPSE Version 25H1 or later: Central Administration → Security → AMSI Configuration.
   • Select each PWA-hosting web application and enable scanning.
   • Use Full Mode where operational testing shows acceptable compatibility and performance; it scans request bodies for all endpoints except explicit exclusions.
   • On earlier supported builds: Central Administration → Application Management → Manage web applications → select the web application → Manage Features → SharePoint Server Antimalware Scanning.
   AMSI became mandatory and non-disableable starting with the September 2025 Public Update. It is an additional request-inspection layer, not a substitute for security updates or server antivirus.^7^ On updated farms that provide it, run the documented validation cmdlet from the SharePoint Management Shell:

      Test-DefenderAndAmsiWorkProperly
   

   Version 25H2 documents this cmdlet for validating Defender components and SharePoint AMSI integration.^8^
3. Rotate ASP.NET machine keys when directed by the applicable security advisory or incident response. For CVE-2025-53770, Microsoft called for rotation after installing the update or enabling AMSI. Run the following for each SharePoint web application, then restart IIS separately on every SharePoint server:^6^

      $webApp = "https://pwa.contoso.com"
   
      Set-SPMachineKey -WebApplication $webApp
      Update-SPMachineKey -WebApplication $webApp
   
      # Run locally on every SharePoint server after deployment:
      iisreset.exe
   

   iisreset.exe interrupts active requests, so schedule it within the maintenance window.
4. Maintain endpoint detection and monitoring. Deploy Microsoft Defender for Endpoint or an equivalent solution on all SharePoint servers and investigate alerts such as possible web-shell installation, SharePoint exploitation, or suspicious IIS worker-process behavior.^6^

If AMSI cannot be enabled while an urgent patch is pending, Microsoft’s emergency guidance is to disconnect the server from the Internet. If that is impossible, restrict unauthenticated access through a VPN, authenticated proxy, or authentication gateway until patching is complete.^6^

For a binding statement about an unreleased PWA roadmap, raise a Microsoft support request through your organization’s support agreement; public documentation currently provides no modernization commitment.

References

1. What's new for IT pros in Project Server Subscription Edition
2. Project Server Subscription Edition architecture
3. Plan for upgrade to Project Server Subscription Edition
4. Project Web App (PWA - MSP) discontinue? - Microsoft Q&A
5. Description of the security update for SharePoint Server Subscription ...
6. Customer guidance for SharePoint vulnerability CVE-2025-53770
7. Configure AMSI integration with SharePoint Server
8. New and improved features in SharePoint Server Subscription Edition Version 25H2