Deploying and Managing Microsoft 365 Apps

What it is

Microsoft 365 Apps (Word, Excel, Outlook and the rest of the desktop suite) can be installed and managed in several ways. Microsoft Intune has a built in app type that uses the Office Deployment Tool (ODT) behind the scenes. You can also run the ODT directly, add Office to an Autopilot deployment, and manage policies and updates in the Microsoft 365 Apps admin center.

How it works

Deploying with Intune

Add an app of type Microsoft 365 Apps (Windows 10 and later) under Apps, Windows.

• Configure with the configuration designer (choose suite apps, architecture, update channel, version, languages and options), or enter XML data with a custom ODT configuration. Microsoft 365 Apps for business edition must use XML.
• Architecture: 32 bit or 64 bit. You can install 32 bit on 64 bit devices, but 64 bit only on 64 bit devices.
• Update channel: Current Channel, Monthly Enterprise Channel or Semi-Annual Enterprise Channel. Choose a channel and avoid mixing channel settings from other policies.
• Remove other versions: remove older MSI based Office installs.
• Shared computer activation for shared devices, and a license type (user based or device based).
• The app suite is installed through the Office Deployment Tool and downloaded from the Office CDN.
• Intune supports only the Microsoft 365 Apps suite, not the Home, Team or Holographic editions.

Cautions:

• If a settings catalog policy also sets the update channel or version, the two conflict and Office may reinstall.
• If you assign a required app with a different channel from the one on devices, the devices can flip channels at the next policy refresh. Create a new app with the new channel instead.
• For a custom XML install, the status reports only whether the installation ran, not whether Office is still present.

Using the Office Deployment Tool

The ODT is a command line tool (setup.exe) driven by an XML configuration file.

setup.exe /download configuration.xml
setup.exe /configure configuration.xml

You can build the XML with the Microsoft 365 Apps admin center or the Office Customization Tool. Use the ODT when you need full control, for example a local source or a Win32 app wrapper that Intune deploys. Wrapping the ODT as a Win32 app is also the recommended way to deploy Office during Autopilot.

Microsoft 365 Apps in Autopilot deployments

When Office is installed as part of Windows provisioning:

• Deploy Microsoft 365 Apps as a Win32 app (the ODT in an intunewin package) if the Enrollment Status Page must track it. The built in Microsoft 365 Apps app type can cause the ESP to hang when it installs while another tracked Win32 app is installing.
• In Autopilot device preparation, select the Office app in the policy so it installs during OOBE. There is no ESP.
• Assign the app to the device group used for Autopilot so it installs for every user.

Policies for Microsoft 365 Apps

With Cloud Policy, settings return with a 90 minute recheck for users in a group, and 24 hours for users outside one. Priority decides conflicts, with 0 the highest, and Cloud Policy wins over Group Policy.

Managing with the Microsoft 365 Apps admin center

The admin center (config.office.com, role Office Apps Administrator) lets you:

• See inventory of Office versions, channels and add-ins.
• Create servicing profiles, with cloud update that delivers monthly updates automatically for Current Channel or Monthly Enterprise Channel.
• Check app compatibility for add-ins and macros.
• Build deployment configurations and set the default update channel.

A worked scenario

A company wants Office installed for every new Autopilot laptop. Because the ESP must block until Office is ready, the admin wraps the ODT and a 64 bit configuration into a Win32 app and sets it as a blocking app. The built in Intune app type is used for existing devices. She sets Office policies, such as disabling macros from the internet, with Cloud Policy for users on any device, and uses a servicing profile to keep Current Channel updated.