Let’s start this new year about a specific use case for the recently introduced feature to configure administrative template settings via Microsoft Intune. That specific use case is to easily control and configure the Office update channel by using the Administrative Templates profile type within Microsoft Intune. Before, this configuration would require ingesting a custom ADMX and creating custom OMA-URI settings, for configuring the Office channel, based on the information in the ingested custom ADMX. That’s not necessary anymore, as Microsoft Intune now provides a built-in list of available administrative template policy settings. In this post I’ll show the configuration steps, followed by the configuration results on a Windows 10 device.
Configuration
Before looking at the actual configuration steps, it might be good to first refresh memories by looking at the naming of the update channels in the different locations. The following table shows the naming of the different channels in Microsoft Intune (and the Office apps) and in the actual ADMX. Good news! This is actually the last time that it’s really required to look at this information. As this post will show, it wasn’t even necessary for the configuration in this post. It will be useful for verifying the results. Microsoft Intune will now provide an easy method for configuring many ADMX-backed settings, without going through the actual ADMX anymore.
| Azure portal | ADMX setting |
| Monthly Channel | FirstReleaseCurrent |
| Monthly Channel (Targeted) | Current |
| Semi-Annual Channel | Deferred |
| Semi-Annual Channel (Targeted) | FirstReleaseDeferred |
| Insider Fast | InsiderFast |
When this would be a configuration of an ADMX-backed settings, the information in the table above would be really relevant during the configuration. Since recently Microsoft Intune contains a new profile type, named Administrative Templates. These profiles take care of the heavy work. In case of Office settings, which will be used in this post, these profiles even take care of ingesting the correct ADMX-files. The following six steps walk through the creation of an Administrative Templates profile type that will be used to configure the Office update channel. After the creation of the policies it can be assigned to a user and/or device group.
| 1 | Open the Azure portal and navigate to Microsoft Intune > Device configuration > Profiles to open the Device configuration – Profiles blade; |
| 2 | On the Device configuration – Profiles blade, select Create profile to open the Create profile blade; |
| 3 |
|
| 4 | On the <Name> blade, select Settings to open the <Name> – Settings blade; |
| 5 | On the <Name> – Settings blade, type Updates in the Search to filter items… field to filter the available settings to only update related settings and select Update Channel (as shown below) to open the Update Channel blade. |
| — |  |
| 6 |
Note: Keep in mind that enabling a setting and clicking OK will directly save the change to the created device configuration profile. This is a similar experience to how changes are managed when working with normal group policies. |
Note: In my device configuration profile I’ve also configured Enable Automatic Updates and Hide option to enable or disable updates to make sure that Office automatically checks for updates without an option for the user to disable Office updates.
Result
Now it’s really interesting to look at the result of the created configuration. For that, let’s first have a look at the registry. Below on the left is an overview of the registry key of the policy manager that contains the created Office configuration. It clearly shows the settings that should be configured, including the update branch. The update branch contains the ADMX-setting value of Current, which was shown in table above, and matches my configured value, in Microsoft Intune, of Monthly Channel. Below on the right is an overview of the registry key of the policy manager that contains the ingested Office ADMX.
 |
 |
Another interesting location is the standard location in the registry that contains policy settings. Below on the left is an overview of the configured update branch. The update branch also contains the ADMX-setting value of Current, which was shown in table above, and matches my configured value, in Microsoft Intune, of Monthly Channel. Below on the right is the actual configuration of an Office app shown. That clearly shows the Monthly Channel configuration.
 |
 |
Discover more from All about Microsoft Intune
Subscribe to get the latest posts sent to your email.
Nice write up. Hope to see the templates in my tenant soon 🙂
Thank you, RKast!
This is a great feature. Nice post!
Any idea how to keep track on the new polices that are added from now on?
Hi Jan,
Not sure yet. I haven’t seen a docs site related to that subject yet, so for now I would keep an eye on the what’s new page.
Regards, Peter
Hi, great article. I have a question (several) about the strategy to adopt in the customers. assuming I have 3 user groups (pilot, early adopters, prod), should I make 3 Office 365 apps (Channel Monthly, SACT, SAC) and deploy each to their respective group. or deploy a single monthly Office 365 Channel app + 3 policies as explained in your article (respectively a monthly policy channel on pilot group, a SACT on early and a SAC on prod)? and how do I manage the Office 365 Visio and Project apps deployed individually to users based on their ownership of the pilot, early, and prod groups? In this second scenario, what will be the behavior during the autopilot phase for a user Prod: office 365 install channel monthly, SAC policy channel, deployment Visio monthly …
Hi David,
It’s all about the complete picture. For example, it wouldn’t be smart to deploy the monthly channel, when the device eventually has to go to the SAC.
Regards, Peter
Hi Peter,
Where can I go on the client device to check if Office Updates are currently being managed by Intune on that device?
Thanks.
Hi Sunny,
You can see that in the fourth picture in the result section.
Regards, Peter
Hi Peter, i tried to change all the 11 settings @ Privacy\Trust Center.
The Registry settings are there (11×2), but in Intune i only see the succeeded message for 1 setting, “Send Office Feedback” (\Microsoft Office 2016\Privacy\Trust Center). Is this default, or do i have to wait for MS to sync it all around?
Hi Patrick,
I would expect a success message for the different settings.
Regards, Peter
Peter,
even with a new Profile i have the same issue, so collected all info and raised a ticket.
Only when it fails (for the System account when i assign it to a device) i can see all the info per setting.
Thank you for letting me know, Patrick. I’m curious what the response will be on your ticket!
Regards, Peter
After showing in detail (also on client side) was was going on they would come back to me.
A few hours later MS called back and told me this is a known behavior and will be fixed in the subsequent updates.
Thank you for the update, Patrick!
Hi Thank you for this,
My current O365 deployment in Intune Client Apps is set to Current, i would like to change it to Semi-Annual Enterprise. If i do that, will it disrupt my current users at all? I have a few that have updated to the latest version I just want to ensure they wont have any disruptions on their office apps.
Thank You
Hi Saud,
You can find the documented behavior here: https://docs.microsoft.com/en-us/deployoffice/change-update-channels
Regards, Peter
how is ADMX Template Updating M365 Office Product different from Using built in APP Configuration Manager ? i have a GRP based policy built to update M365 Product Monthly Channel (APP>Allapps>M365 App). Do we still need ADMX automatic update on the top of that ?
Hi Ian,
Not sure what you mean. Are you saying that you’ve got it configured already via GPO? If so, there is no need to configure it another time.
Regards, Peter
I know this is old, so I apologize if there is an update to this somewhere, but I just came across this and am confused. You are setting it to Current Channel and all of your Registry settings show Current, however your Office shows Monthly. Did I miss something? I think nowadays (2023), there is a Current Channel and a Monthly Enterprise Channel, so it appears to me that your Office is not indeed updating to Current.
Hi Rick,
That’s indeed something that changed over the years.
Regards, Peter
Is there a way to use the autoupdate and stay within one version of the semi Annual Channel, e.g. 2308 and only receive the security updates? This without manually adjusting the target version every month within the Intune profile.
Hi Markus,
You can delay the installation of the new updates by using the “Delay downloading and installing updates for Office” setting.
Regards, Peter
Hi Peter, thanks, that’s a good hint.