Deploy Microsoft 365 apps, Company Portal and Microsoft AutoUpdate to Macs with Jamf Pro

Jamf Pro manages the Mac, but Microsoft ships the apps your users live in, plus Company Portal, which Jamf's Microsoft integrations depend on, and Microsoft AutoUpdate (MAU), which keeps them all patched. In this post I'll build the delivery in Jamf Pro: package sources, App Installers versus policies, an MAU profile, activation, and how to prove each piece worked.

How the pieces fit together#

• Microsoft 365 for Mac needs a Microsoft 365 plan that includes the desktop apps, such as Business Premium or E5. Office LTSC for Mac is the volume-licensed alternative (support for LTSC for Mac 2021 ends on 13 October 2026), and two Office versions can't be installed side by side.
• Company Portal isn't used to enroll Jamf Macs in Intune. Jamf Device Compliance registration runs through it, and it contains the Microsoft Enterprise SSO plug-in that Platform SSO uses.
• Microsoft AutoUpdate comes with the Office apps and Company Portal and reads managed preferences from the com.microsoft.autoupdate2 domain.

Keep macOS current too: on an older macOS release the apps keep working but stop receiving updates, security fixes included.

Step 1: Choose how Jamf Pro delivers the apps#

For your own packages, Microsoft's Most current packages for Office for Mac page links to the suite installer and the individual app installers on the Office Content Delivery Network (CDN). Microsoft describes the suite installer as size-optimised, and Microsoft's suite-wide Office preferences can stop individual apps (OneDrive, for example) from being installed with it; those exclusions work only with the suite package. If you deploy Teams separately, check whether the package you pick includes it.

Step 2: Deploy Company Portal first#

Install Company Portal before the things that depend on it: the Device Compliance registration policy and the Single Sign-On Extensions profile. Scope those to a smart computer group with the criterion Application Title is Company Portal.app, so the SSO profile never lands on a Mac without the app.

Step 3: Deploy Microsoft 365 for Mac#

Option A: App Installers#

1. In Jamf Pro, go to Computers › Mac Apps and click New.
2. Choose Jamf App Catalog as the app source, search for the title, add it and accept the terms.
3. Pick a category and the target smart group, then choose automatic installation or Make available in Self Service.
4. Review the title's update and notification settings, then save.

Check Jamf's App Installers software titles list for each Microsoft title you need.

Option B: Package and policy#

1. Upload Microsoft's suite package in Settings › Computer management › Packages. Uploading through the web interface needs a cloud distribution point as your principal distribution point.
2. In Computers › Policies, create a policy triggered by Enrollment Complete and Recurring Check-in, frequency Once per computer, with the package and an Update Inventory maintenance step.
3. Scope it to your target group, excluding Macs that already report Microsoft Word.app, and add a custom event (for example install-m365) for help desk reinstalls.

A user installing Office by hand needs admin rights; a Jamf policy runs as root, so standard users are fine.

Step 4: Configure Microsoft AutoUpdate with a profile#

In Computers › Configuration Profiles, create a profile with the Application & Custom Settings payload and upload a property list for the preference domain com.microsoft.autoupdate2. This example uses Current Channel, installs updates automatically, hides the MAU window and sets a five-day deadline:

<?xml version="1.0" encoding="UTF-8"?>
<plist version="1.0">
<dict>
  <key>ChannelName</key>
  <string>Current</string>
  <key>HowToCheck</key>
  <string>AutomaticDownload</string>
  <key>IgnoreUIOpenAfterInstall</key>
  <true/>
  <key>UpdateDeadline.DaysBeforeForcedQuit</key>
  <integer>5</integer>
</dict>
</plist>

Step 5: Activation and sign-in#

Microsoft 365 for Mac activates when the user signs in with a work account whose licence includes the desktop apps. Two things make that painless:

• Pre-fill the account with the OfficeActivationEmailAddress key (string) in the com.microsoft.office domain, using Jamf's $EMAIL payload variable as the value.
• Deploy the Enterprise SSO plug-in or Platform SSO, as described in Platform SSO and the Microsoft Enterprise SSO plug-in on Jamf-managed Macs. Most Microsoft apps use the Microsoft Authentication Library (MSAL), which participates in SSO by default.

If an app stays unlicensed, check the user's licences in the Microsoft 365 admin center, then Microsoft's Troubleshoot activation issues for Office for Mac guidance. Office LTSC for Mac activates with Microsoft's volume licence serializer package instead.

Verify#

In Jamf Pro, the computer's History › Policy Logs should show the install policy as completed (for App Installers, check the deployment status). On the Mac:

sudo jamf policy -event install-m365
sudo jamf recon
defaults read "/Applications/Microsoft Word.app/Contents/Info.plist" CFBundleShortVersionString
defaults read "/Library/Managed Preferences/com.microsoft.autoupdate2"
"/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/msupdate" --list

Good looks like this: Word reports a current build, the managed preferences show your ChannelName and HowToCheck values, msupdate --list shows nothing pending (or only updates waiting for the deadline), and Outlook opens without an activation prompt.

Tips & gotchas#

MAU also updates Defender for Endpoint, so the same profile governs Defender deployed with Jamf Pro. Next, set up Jamf Pro Device Compliance.

References#

• Deployment options for admins for Office for Mac (Microsoft Learn)
• Configuring preferences for Microsoft AutoUpdate (Microsoft Learn)
• App Installers (Jamf Pro Documentation)
• App Installers Software Titles (Jamf App Catalog)