Use Group Policy to enable Office 365 clients to receive updates via ConfigMgr

This week something completely different, compared to the last couple of weeks. This week I want to take a quick look at enabling Office 365 clients to receive updates via ConfigMgr. More specifically, use Group Policy for configuring Office 365 clients to receive updates via ConfigMgr. There is a lot of information available about configuring the Office 365 clients via the initial installation and configuration (configuration.xml), but what about the existing Office 365 clients?

In this post I will provide the required information about using Group Policy to enable the existing Office 365 clients to receive update via ConfigMgr. I will show the Group Policy settings, related to updating the Office 365 clients, and I’ll show how those settings relate to the initial installation and configuration settings. Of course, once I know the registry keys, used by the Group Policy, I can also use Configuration Baselines to do something similar. However, that’s not part of the scope of this post, but I will mention a few Group Policy settings that are ideal candidates for that.

Prerequisites

Let’s start with a few important prerequisites for managing Office 365 client updates with ConfigMgr, mainly related to versions of products. Before enabling the Office 365 client to receive updates via ConfigMgr, make sure the following version requirements are in place:

• System Center Configuration Manager current branch 1602 or later;
• Windows Server Update Services (WSUS) 4.0 or later;
• Office 365 client with version 16.0.6741.2014 or later;
• This functionality is now available for First Release for Deferred Channel and Current Channel. Deferred Channel is expected in June 2016.

Group Policy settings

Before looking at the available Group Policy settings, make sure to download and install the Office 2016 Administrative Template files from the Microsoft Download Center. Once installed, the Office 365 client update settings can be found at Computer Configuration\Policies\Administrative Templates\Microsoft Office 2016 (Machine)\Updates.

Overview of Group Policy settings

Below is an overview of the Group Policy settings, that can be used to configure the Office 365 client update settings, including how those settings translate to the settings in the installation and configuration files (configuration.xml) and the available values.

Setting	Value	XML example
Enable Automatic Updates	Not Configured | Enabled | Disabled	Enabled=”TRUE”
Hide option to enable or disable updates	Not Configured | Enabled | Disabled	N/A
Hide Update Notifications	Not Configured | Enabled | Disabled	N/A
Office 365 Client Management	Not Configured | Enabled | Disabled	OfficeMgmtCOM=”TRUE”
Update Channel	Not Configured | Enabled | Disabled Channel identifier: [Specify one of the following Current | Business | Validation | FirstReleaseCurrent]	Branch=”Current”
Update Deadline	Not Configured | Enabled | Disabled Deadline: [Specify UTC deadline format MM/DD/YYYY HH:MM]	Deadline=”08/05/2016 20:30”
Update Path	Not Configured | Enabled | Disabled Location for updates: [Specify location on the network, local on the device, or on Internet]	UpdatePath=”\\server\share”
Target Version	Not Configured | Enabled | Disabled Update version: [Specify version number]	TargetVersion=”16.1.2.3”

Note: The Group Policy settings are written in the registry in the following key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\office\16.0\common\officeupdate.

Configure Office 365 client to use ConfigMgr for updates

The most important Group Policy setting, for enabling the Office 365 client to receive updates via ConfigMgr, is shown in blue italic. That setting, Office 365 Client Management, will make sure that the Office COM object takes commands from ConfigMgr to download and install Office 365 client updates.

Configure end-user experience

There are also a few Group Policy settings that can configure a little bit of the end-user experience. Enabling the Hide option to enable or disable updates setting, makes sure that the end-user can’t disable the update behavior of the Office 365 client and the combination of enabling the Enable Automatic Updates setting and disabling the Hide Update Notifications setting, makes sure that the end-user receives notifications about pending updates for the Office 365 client. That combination is definitely recommended.

Configure update channel

There is also a Group Policy setting that can configure the update channel of the Office 365 client. Enabling the Update Channel setting, enables the channel identifier. That identifier can be used to configure the update channel, by specifying Current, Business, Validation or FirstReleaseCurrent. With configuring the update channel keep in mind that the following information is applicable to the updates delivered to the channels.

Channel	GPO/XML	Feature updates	Security updates	Non-security updates
Current Channel	Current	Monthly	Monthly	Monthly
First Release for Deferred Channel	Validation	Every four months	Monthly	Monthly
Deferred Channel	Business	Every four months	Monthly	Every four months

Note: The FirstReleaseCurrent value, is referring to the First Release for Current Channel, which is the Office Insider Program.

Other Group Policy settings

The remaining Group Policy settings, the Update Deadline, the Update Path and the Target Version, are only relevant when ConfigMgr is not used for deploying Office 365 client updates.

More information

For more information about configuring the Microsoft Office 365 client and specifically the update configuration, please refer to:

• Manage Office 365 client updates with System Center Configuration Manager: https://technet.microsoft.com/en-us/library/mt628083.aspx
• Reference for Click-to-Run configuration.xml file: https://technet.microsoft.com/en-us/library/jj219426.aspx
• Overview of update channels for Office 365 ProPlus: https://technet.microsoft.com/en-us/library/mt455210.aspx
• Change management for Office 365 clients: https://technet.microsoft.com/en-us/library/mt584223.aspx