Managing Office 365 Updates with SCCM

SCCM Office 365 updates management is finally integrated to the standard software update process (since the release of SCCM 1602). Prior to this release it was announced as a new features, but it was not completely managed. It was necessary to add Office 365 updates to WSUS manually in order to manage them trough SCCM software update afterward. It’s now manageable natively with the release of SCCM 1602.

The integration of Office 365 Updates to SCCM will ease overall management of updates with these key features :

• Centralized management
• Standard Software Update
• Ability to use Automatic Deployment Rules
• Easier distribution to branch offices with Software Update packages
• Applications can run while updating

Before this integration, Office 365 Updates needed to :

• Manually downloaded
• Manually distributed or to create a package than distribution on Distribution Point
• Application need to be shut down before the update

This post will explain how to natively manage Office 365 desktop client update with SCCM 1602 and later. Refer to our post on how to deploy Office 2016 using SCCM if you’re looking at a complete Office 365 installation guide.

[su_box title=”Update : 2016-09-26″ style=”glass” title_color=”#F0F0F0″]

Following recent modification to the documentation on Technet (link https://technet.microsoft.com/en-us/library/mt628083.aspx )

 Here’s what’s new :

•   Minimum versions per channel :
  • Current Channel, Version 1602 
    • Build 6741.2017
  • First Release for Deferred Channel, Version 1602
    • Build 6741.2014 (same as before)
  • Deferred Channel, Version 1602 
    • Build 6741.2048
•   Because the version numbers are not the same for each Channel, here how to validate what Channel is installed. You can also refer to our free Office 365 inventory report to display your versions.
  • Under the registry key HKLM/Software/Microsoft/Office/ the value of CDNBaseURL  should match one of the following.
  • For Insider Preview / First Release for Current Channel: 
    •   http://officecdn.microsoft.com/pr/64256afe-f5d9-4f86-8936-8840a6a4f5be
  • For Current Channel :
    •    http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60
  • For First Release for Deferred Channel :
    • http://officecdn.microsoft.com/pr/b8f9b850-328d-4355-9145-c59439a0c4cf
  • For Deferred Channel:
    • http://officecdn.microsoft.com/pr/7ffbc6bf-bc32-4f92-8982-f9dd17fd3114
  • Look our post about Office 365 inventory to help out  (link https://systemcenterdudes.com/sccm-office-365-inventory-report/ )
• Office 365 client supported products :
  • Office 365 ProPlus
  • Visio Pro for Office 365
  • Project Online Desktop client
  • Office 365 Business
• Use the latest Office 2016 deployment tool to create the original installation package
  • https://www.microsoft.com/en-us/download/details.aspx?id=49117
  • Updated : 9/9/2016
• Use the latest Office 2016 ADMX
  • https://www.microsoft.com/en-us/download/details.aspx?id=49030
  • Updated 9/2/2016

.[/su_box]

SCCM Office 365 Updates Configurations

There are two ways to configure Office 365 to get updates from SCCM :

• Using the Configuration.xml at installation time of the Click-to-run package
• Using Office 2016 latest GPO

Determine which Office 365 Channel to use

[su_box title=”Office Channel” style=”glass” title_color=”#F0F0F0″]The Office team has recently changed terminology from Branch to Channel.[/su_box]

Before we go on to the configurations details, choosing your management Channel is key for managing updates.

With standard software updates, you probably used different Software Update Group / Deployment to manage test, pilots and production groups to validate updates.

For Office 365, similar process can be done. There’s 4 different Channels :

• First Release for Current Channel
  • This is basically an Insider build for Office
• Current Channel
  • Provide users with the newest features of Office as soon as they’re available
• First Release for Deferred Channel
  • Provide pilot users and application compatibility testers the opportunity to test the next Deferred Channel
• Deferred Channel
  • Provide users with new Office features a few times a year

The best example on how to use this comes from Technet :

• Provide a group of pilot users with Current Channel, so they can try out the new features of Office as they become available
• Provide your application compatibility testers with First Release for Deferred Channel so that they can test that the finance applications will work with the next Deferred Channel release
• Provide your finance department, which has several key line-of-business applications, with Defered Channel

As of now, only First Release for Current Channel and First Release for Deferred Channel are available in SCCM. Current Channel and Deferred Channel should be available in the next months.

[su_box title=”Important” style=”glass” title_color=”#F0F0F0″]Configuration.xml and GPO haven’t been updated to match the terminology of Channels. They both still use Branch.[/su_box]

Configure Office 365 Click-to-Run Package

• Download the Office Deployment Tools
• After downloading the tool, run OfficeDeploymentTool.exe

• Extract the files to a drive on your computer

• You’ll end up with 2 files – Setup.exe and Configuration.xml

• Edit the Configuration.xml file using a text editor
• Change the Branch and OfficeMgmtCOM value to Validation and True respectively

[su_box title=”Update : 2016-09-26″ style=”glass” title_color=”#F0F0F0″]New screen shot to reflect the new naming convention of Channel in the configuration.xml.[/su_box]

• Editing the Configuration.xml this way will :
  • Download and install Office 365 First Release for Deferred Channel
    • Branch = Validation
    • Channel=”FirstReleaseDeferred”
  • Enable Office to be managed by SCCM
    • OfficeMgmtCOM = True

[su_box title=”Update : 2016-09-26″ style=”glass” title_color=”#F0F0F0″]

With the change to Channel, the latest OCT needs to have the new values for Channel instead of Branch.

The possible values are  :

• Current
• Deferred
• FirstReleaseDeferred
• FirstReleaseCurrent[/su_box]
• Launch the Office 365 installation using a command line :
  • Setup.exe /configure Configuration.xml

All details about Office Deployment tool can be found on Technet.

Configure Office 365 Update using Group Policy (GPO)

Using this method will override configurations made by Configuration.xml at install time.

You could use both if you want in order to support already installed Office 365 as well as new installations.

• Download the Office 365 ADML/ADMX
• Import ADML/ADMX in your GPO repository
• Create an Office 365 GPO and edit it
• Go to Computer Configuration / Policies / Administrative Templates / Microsoft Office 2016 / Updates
• 2 settings must be configured :
  • Office 365 Client Managment
    • Set this setting to Enabled  – This allow SCCM to manage update for Office 365

• Update Channel
  • Set this setting to Enabled
  • In the Channel Identifier field, enter Validation for First Release for Deferred Channel – (Refer to Technet documentation for Branch Configuration Names – Current, Business, Validation)

[su_box title=”Update : 2016-09-26″ style=”glass” title_color=”#F0F0F0″]

As per our testing, the GPO as no impact to change the Channel for Office 365 when managed by SCCM.

When SCCM manage the updates, it will support only the Channel specified at the installation time.

Example : You install Office 365 with  Current Channel. You have a GPO setting Channel to Deferred. You deploy release updates with SCCM for Current and Deferred Channel, the client will only see the update for Current as necessary. Deferred will never be applied.[/su_box]

• Configure Hide option to enable or disable updates to ensure user don’t disable updates

• Here’s the results in Office when setting is set to Not Configured or Disabled                             

• Here’s the result in Office when setting is set to Enabled

[su_box title=”Update 2016-09-26″ style=”glass” title_color=”#F0F0F0″]

The Update Enabled element in the configuration.xml or in the GPO should be set to TRUE/Enabled

Quote technet : “Also, we recommend that you set the value of the Enabled attribute to True in the Updates element. If you set the value of the Enabled attribute to False, Office 365 clients can still receive updates from Configuration Manager. But, users won’t see any notifications when updates are pending”

NOTE: even with this from the TechNet Documentation, we can’t say the real impact with SCCM managing the update.. We have tested with True and False. Both times, updates were available within the Software Center as excepted.

It might only affect this warning, when updates comes straight from the web without SCCM involved.

[/su_box]

• Configuring Enable Automatic Updates, is also a good idea to prevent clients from updating automatically

• Here’s the results in Office if setting is Not Configured or Enabled

• Here’s the results in Office if setting is Disabled

Configure SCCM 1602 and Later

Software Update Point

• Ensure that you are running SCCM 1602 and later (How to verify)
• Go to Administration / Site Configuration, select Configure Site Components / Software Update Point on the top ribbon
• On the Products tab, select Office 365 Client

[/su_box]

• Initiate a synchronization by clicking Synchronize Software Updates on the top ribbon

• Once the synchronization is completed, Office 365 client updates will be available in Software Library / Software Updates / All Software Update
• They can be managed just as any other updates

Software Update Group

• Go to Software Library / Software Updates / Software Update Groups
• Create a new Software Update Group

• Download the update to a new Deployment Package

• Be sure to select the needed languages for your environment

• Each updates will take more than 1GB of disk space. Take that in consideration when downloading your updates

Client Side

• Before updating, the Office 365 version is 16.0.6741.2014 which is the minimum requirement for updating from SCCM

• Initiate a Software Update Scan Cycle and Software Update Deployment Evaluation cycle on your client. The update will be available to the client

• Compared to standard Software Update, the Office 365 Update is not downloaded in your SCCM Cache folder (By default – C:\Windows\CCMCache)
• Instead, the update will be downloaded in C:\Program Files (x86)\Microsoft Office\Updates\Download
• The update will automatically clean itself after rebooting

• Interaction in Software Center is exactly the same as any other Software Update
• Even with all Office products opened during updating, we encounter no problem for the installation, without user interaction

• Once computer is restarted, Office as been updated

SCCM Office 365 Software Update Reports

Related SCCM reports that give you detailed information about Office 365 Software Updates.

• Asset – Office 365 Inventory
• Configuration Manager | Software Updates
• Deployment | Software Updates
• System Health | Software Updates