Deploying and updating Microsoft 365 Apps with Configuration Manager

Configuration Manager can handle both halves of Microsoft 365 Apps: the first install and the updates that follow. Both work well once a few switches are in place, and both fail quietly when one is missing — usually as updates that show "not required". In this post I'll install Microsoft 365 Apps with the console's installer, hand its updates to the software update point, keep channels under control and show where to look when an update doesn't apply.

How it works#

• Install — the Office 365 Installer wizard (the console still uses Office 365 names in places) embeds the Office Customization Tool, downloads the files from the Office CDN to a content share and creates a script application.
• Updates — when Microsoft publishes a build to the Office CDN, it also publishes an update package to WSUS. Your software update point (SUP) synchronises it and you deploy it like any other update. The Configuration Manager client then instructs Click-to-Run, through an Office COM object, to download the content from a distribution point and install it.

An update is only required on a device when Configuration Manager management of Office updates is enabled there and the device is on the channel and architecture that update targets. After a fresh install, the Office Automatic Updates scheduled task must also have run once so that the channel is set.

Prerequisites#

• A working SUP. In Administration › Site Configuration › Sites, select the site, then Configure Site Components › Software Update Point. On Products, under Office, select Microsoft 365 Apps/Office 2019/Office LTSC; on Classifications, select Updates. Then synchronise.
• For the installer: internet access on the console computer, Read and Write access to the content share, and .NET Framework 4.7.1 or later on that computer (older versions can throw an exception in the customization tool).
• Software updates enabled in client settings, and a client cache large enough for Office content.

Step-by-step#

1. Install with the Office 365 Installer#

1. Go to Software Library › Overview › Office 365 Client Management and select Office 365 Installer.
2. On Application Settings, enter a name and a content location in the form \\server\share.
3. On Office Settings, choose Go to the Office Customization Tool, configure architecture, channel, apps and languages, then select Submit.
4. On Deployment, deploy now or later; the app appears in Software Library › Application Management › Applications.

Prefer to build it yourself? An application that runs setup.exe /configure configuration.xml from the Office Deployment Tool works too. The attribute that matters for updates is OfficeMgmtCOM:

<Configuration>
  <Add OfficeClientEdition="64" Channel="MonthlyEnterprise" OfficeMgmtCOM="TRUE">
    <Product ID="O365ProPlusRetail">
      <Language ID="en-us" />
    </Product>
  </Add>
  <Updates Enabled="TRUE" />
  <Display Level="None" AcceptEULA="TRUE" />
</Configuration>

2. Let Configuration Manager manage the updates#

An installer deployment doesn't necessarily switch on update management. Use one of these methods:

• Client settings (simplest): in Administration › Client Settings, open the device settings, select Software Updates and set Enable management of the Office 365 Client Agent to Yes. It stays greyed out until Enable software updates on clients is Yes.
• Office Deployment Tool: OfficeMgmtCOM="TRUE", as above.
• Group Policy: the matching setting in the Office administrative templates.

From version 2111, Enable update notifications from Microsoft 365 Apps in the same group controls the notification experience users get from Microsoft 365 Apps for these updates.

3. Choose languages#

Office update content is downloaded per language. On the Language Selection page of the ADR, Deploy or Download Software Updates wizard, select Office 365 Client Update, choose Edit and add every language installed on your clients. Languages missing from that list can be added through the AvailableUpdateLanguagesForO365 site control property; Microsoft documents the wbemtest procedure.

4. Deploy updates with an ADR#

From the Office 365 Client Management dashboard, choose Create an ADR and select Office 365 Client as the product. Add Superseded = No and Title filters for channel and architecture. Titles look like Microsoft 365 Apps Update - <channel> Version <yymm> for x64 based Edition (Build ...), but check real titles under Office 365 Updates first — channel names in titles have changed before. One ADR per channel and ring keeps reporting readable.

5. Change a device's channel#

Set the new channel with Group Policy or the Office Deployment Tool; Office moves without a reinstall. Make sure the target channel's update is deployed to those devices so the switch can complete through Configuration Manager.

Verify#

1. Client state:
   PowerShell

   Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration' |
     Select-Object VersionToReport, CDNBaseUrl, UpdateChannel, Platform

   CDNBaseUrl ends with the channel ID: 492350f6-... is Current Channel, 55336b82-... Monthly Enterprise, 7ffbc6bf-... Semi-Annual Enterprise.
2. Who needs it: in Software Library › Office 365 Client Management › Office 365 Updates, select an update and use View Required on the Summary tab to list the devices.
3. Client logs in C:\Windows\CCM\Logs: WUAHandler.log for the scan, UpdatesDeployment.log for deployment and enforcement, UpdatesHandler.log for download and install. Click-to-Run writes its own logs to C:\Windows\Temp, named after the computer and a timestamp.
4. Site logs: wsyncmgr.log for synchronisation, RuleEngine.log for the ADR, PatchDownloader.log for content downloads.
5. Dashboard: the Office 365 Client Management charts only fill in once the Office 365 configurations class is enabled in hardware inventory.

Tips & gotchas#

• "Not required" right after install usually means the channel isn't set yet. Run schtasks /run /tn "\Microsoft\Office\Office Automatic Updates 2.0", then the Software Updates Deployment Evaluation Cycle.
• Open apps aren't closed. If Office apps are running at enforcement, the install returns as needing a restart, so plan deadlines and restart settings accordingly.
• Internet-only devices. Content-enabled cloud management gateways don't support Microsoft 365 Apps update content. For those devices, set the Office 365 Client Agent setting to No in a custom client setting so they update from the Office CDN instead.
• Beta Channel must update from the Office CDN, not Configuration Manager.
• Co-managed devices: check who owns the Office Click-to-Run apps workload before troubleshooting — see moving co-management workloads to Intune.

References#

• Manage Microsoft 365 Apps with Configuration Manager
• Manage updates to Microsoft 365 Apps with Microsoft Configuration Manager
• Office 365 Client Management dashboard