Easily controlling the Office update channel by using administrative templates

Let’s start this new year about a specific use case for the recently introduced feature to configure administrative template settings via Microsoft Intune. That specific use case is to easily control and configure the Office update channel by using the Administrative Templates profile type within Microsoft Intune. Before, this configuration would require ingesting a custom ADMX and creating custom OMA-URI settings, for configuring the Office channel, based on the information in the ingested custom ADMX. That’s not necessary anymore, as Microsoft Intune now provides a built-in list of available administrative template policy settings. In this post I’ll show the configuration steps, followed by the configuration results on a Windows 10 device.

Configuration

Before looking at the actual configuration steps, it might be good to first refresh memories by looking at the naming of the update channels in the different locations. The following table shows the naming of the different channels in Microsoft Intune (and the Office apps) and in the actual ADMX. Good news! This is actually the last time that it’s really required to look at this information. As this post will show, it wasn’t even necessary for the configuration in this post. It will be useful for verifying the results. Microsoft Intune will now provide an easy method for configuring many ADMX-backed settings, without going through the actual ADMX anymore.

Azure portal ADMX setting
Monthly Channel FirstReleaseCurrent
Monthly Channel (Targeted) Current
Semi-Annual Channel Deferred
Semi-Annual Channel (Targeted) FirstReleaseDeferred
Insider Fast InsiderFast

When this would be a configuration of an ADMX-backed settings, the information in the table above would be really relevant during the configuration. Since recently Microsoft Intune contains a new profile type, named Administrative Templates. These profiles take care of the heavy work. In case of Office settings, which will be used in this post, these profiles even take care of ingesting the correct ADMX-files. The following six steps walk through the creation of an Administrative Templates profile type that will be used to configure the Office update channel. After the creation of the policies it can be assigned to a user and/or device group.

1 Open the Azure portal and navigate to Microsoft Intune > Device configuration > Profiles to open the Device configuration – Profiles blade;
2 On the Device configuration – Profiles blade, select Create profile to open the Create profile blade;
3

OfficeUpdates-CreateProfileOn the Create profile blade, provide the following information and click Create to open the <Name> blade;

  • Name: Provide a unique name for the device configuration profile;
  • Description: (Optional) Provide a description for the device configuration profile;
  • Platform: Select Windows 10 and later;
  • Profile type: Select Administrative Templates (Preview);
4 On the <Name> blade, select Settings to open the <Name> – Settings blade;
5 On the <Name> – Settings blade, type Updates in the Search to filter items… field to filter the available settings to only update related settings and select Update Channel (as shown below) to open the Update Channel blade.
OfficeUpdates-Settings
6

OfficeUpdates-UpdateChannelOn the Update Channel blade, select Enabled to enable the setting, select the required update channel with Channel Name and click OK.

Note: Keep in mind that enabling a setting and clicking OK will directly save the change to the created device configuration profile. This is a similar experience to how changes are managed when working with normal group policies.

Note: In my device configuration profile I’ve also configured Enable Automatic Updates and Hide option to enable or disable updates to make sure that Office automatically checks for updates without an option for the user to disable Office updates.

Result

Now it’s really interesting to look at the result of the created configuration. For that, let’s first have a look at the registry. Below on the left is an overview of the registry key of the policy manager that contains the created Office configuration. It clearly shows the settings that should be configured, including the update branch. The update branch contains the ADMX-setting value of Current, which was shown in table above, and matches my configured value, in Microsoft Intune, of Monthly Channel. Below on the right is an overview of the registry key of the policy manager that contains the ingested Office ADMX.

OfficeUpdates-Registry01 OfficeUpdates-Registry02

Another interesting location is the standard location in the registry that contains policy settings. Below on the left is an overview of the configured update branch. The update branch also contains the ADMX-setting value of Current, which was shown in table above, and matches my configured value, in Microsoft Intune, of Monthly Channel. Below on the right is the actual configuration of an Office app shown. That clearly shows the Monthly Channel configuration.

OfficeUpdates-Registry03 OfficeUpdates-Outlook01

23 thoughts on “Easily controlling the Office update channel by using administrative templates”

  1. Hi, great article. I have a question (several) about the strategy to adopt in the customers. assuming I have 3 user groups (pilot, early adopters, prod), should I make 3 Office 365 apps (Channel Monthly, SACT, SAC) and deploy each to their respective group. or deploy a single monthly Office 365 Channel app + 3 policies as explained in your article (respectively a monthly policy channel on pilot group, a SACT on early and a SAC on prod)? and how do I manage the Office 365 Visio and Project apps deployed individually to users based on their ownership of the pilot, early, and prod groups? In this second scenario, what will be the behavior during the autopilot phase for a user Prod: office 365 install channel monthly, SAC policy channel, deployment Visio monthly …

    Reply
  2. Hi Peter,

    Where can I go on the client device to check if Office Updates are currently being managed by Intune on that device?

    Thanks.

    Reply
  3. Hi Peter, i tried to change all the 11 settings @ Privacy\Trust Center.

    The Registry settings are there (11×2), but in Intune i only see the succeeded message for 1 setting, “Send Office Feedback” (\Microsoft Office 2016\Privacy\Trust Center). Is this default, or do i have to wait for MS to sync it all around?

    Reply
  4. Peter,
    even with a new Profile i have the same issue, so collected all info and raised a ticket.
    Only when it fails (for the System account when i assign it to a device) i can see all the info per setting.

    Reply
  5. After showing in detail (also on client side) was was going on they would come back to me.
    A few hours later MS called back and told me this is a known behavior and will be fixed in the subsequent updates.

    Reply
  6. Hi Thank you for this,
    My current O365 deployment in Intune Client Apps is set to Current, i would like to change it to Semi-Annual Enterprise. If i do that, will it disrupt my current users at all? I have a few that have updated to the latest version I just want to ensure they wont have any disruptions on their office apps.

    Thank You

    Reply
  7. how is ADMX Template Updating M365 Office Product different from Using built in APP Configuration Manager ? i have a GRP based policy built to update M365 Product Monthly Channel (APP>Allapps>M365 App). Do we still need ADMX automatic update on the top of that ?

    Reply
  8. I know this is old, so I apologize if there is an update to this somewhere, but I just came across this and am confused. You are setting it to Current Channel and all of your Registry settings show Current, however your Office shows Monthly. Did I miss something? I think nowadays (2023), there is a Current Channel and a Monthly Enterprise Channel, so it appears to me that your Office is not indeed updating to Current.

    Reply
  9. Is there a way to use the autoupdate and stay within one version of the semi Annual Channel, e.g. 2308 and only receive the security updates? This without manually adjusting the target version every month within the Intune profile.

    Reply

Leave a Reply to Peter van der Woude Cancel reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.