# Managing Microsoft 365 Apps and Office Updates

> Chapter 12 of the Courseiva MD-102 curriculum — https://courseiva.com/learn/md-102/managing-microsoft-365-apps

**Official objective:** 3.2 — Manage Microsoft 365 Apps deployment and updates

## Introduction

How do you make sure every single computer in an entire company has the latest version of Microsoft Word and Excel, without having to walk from desk to desk with a USB stick? The answer is a set of tools and policies called Microsoft 365 Apps deployment and update management. For the MD-102 exam, you need to understand exactly how to push Office to hundreds of computers, keep them updated with security patches, and control when those updates happen so they do not crash someone's important presentation.

## The Apartment Building Maintenance Analogy

You move into a new apartment building and sign a lease for a one-bedroom unit. The building manager gives you a standard set of keys, tells you which lightbulbs to use, and shows you the laundry room schedule. That initial move-in is your Windows installation and the Office deployment. Everything works because you followed the building's rules.

Now, a few months later, the building manager decides to upgrade all locks to a more secure model because of a break-in in a neighbouring building. You get a notice: tomorrow, between 9am and 5pm, your key will stop working, and a new key will be issued by the front desk. If you ignore the notice, you will be locked out of your own apartment. That notice is your update deployment policy. The building manager decides when the lock change happens (the update ring), who gets the new key first (the pilot group: maybe the ground floor units), and who gets it last (the top floor). She cannot force every tenant to change their lock at the exact same second because some tenants might be sleeping or out of town. Instead, she sets a deadline (the update deadline). If you do not collect your new key by Friday, your old key will stop working on Saturday morning. That is a forced update.

If the building manager used a lazy approach, she would hand each tenant a new key only when they asked for it. Half the tenants would never get the new key, and those apartments would remain vulnerable. That is why centralised management (like Intune or Group Policy) is critical: it ensures every unit in the building gets the security upgrade, whether the tenant wants to deal with it today or not. The goal of the building manager is to keep every apartment safe without causing chaos. That is exactly what you do as a Microsoft 365 Endpoint Administrator: you manage updates so that every Office app on every company computer stays secure and functional without disrupting the workday.

## Core explanation

Let's start with the basics. Microsoft 365 Apps (formerly called Office 365 ProPlus) is the subscription-based version of the classic Microsoft Office suite — you get Word, Excel, PowerPoint, Outlook, Teams, and more. Unlike the old one-time purchase model where you bought Office 2019 and it stayed exactly the same forever, this version gets new features and security fixes every few months. That's great for security, but it creates a problem for a company with hundreds or thousands of computers: how do you get those updates onto every machine in a controlled, reliable way?

The solution is the Office Deployment Tool (ODT). This is a free, command-line tool from Microsoft that lets you download the Office installation files (called the Office 365 Apps source files) and then push them to computers. You use it to create an XML configuration file — think of it as a recipe card. That recipe tells the ODT exactly which Office apps to install (just Word and Excel? What about Access and Publisher?), which language pack to use, which update channel to join, and what architecture (32-bit or 64-bit) to use.

Here comes the crucial concept for the exam: update channels. Microsoft releases new builds of Office on a schedule, and you decide when your users get them through a channel. There are three main channels you need to know:

- Current Channel: Users get the latest features as soon as Microsoft releases them (monthly). This is the fastest channel and is best for home users or small businesses that want the newest features immediately. The risk is that a bug might slip through and affect users before you have time to test it.

- Monthly Enterprise Channel: This is a new name you will see on the exam. It gives you the same monthly feature updates as Current Channel but only on the second Tuesday of the month (Patch Tuesday). This gives your IT team a small buffer to test the update before it hits users.

- Semi-Annual Enterprise Channel (SAEC): Updates come only twice a year — in January and July. This is the slowest, most stable, and most common for large companies. Your users get security fixes every month, but the big feature updates only happen twice a year. This gives your IT team months to test compatibility with internal applications before the update rolls out.

The channel is set in the XML configuration file when you deploy Office, and it can be changed later using Group Policy or Microsoft Intune (a cloud-based management service for devices). Intune is part of the Microsoft Endpoint Manager family, and it is the modern way to manage both updates and deployment without needing on-premises servers.

Now, about the update process itself. Once Office is installed and joined to a channel, the built-in Microsoft 365 Apps update engine (called Click-to-Run) checks for updates on a schedule. You can control this schedule with policies. You set a deadline: for example, 'Download updates automatically, but do not install them until 3 days after release, and force installation after 7 days.' The deadline is critical because it prevents users from postponing an important security patch forever.

What about the actual installation methods? You can install Office from the local network (an on-premises source), from the Microsoft Content Delivery Network (CDN — just a fancy term for Microsoft's internet servers), or from a combination of both. Using a local source (called a network share) is common for large companies because it saves internet bandwidth. Every computer in the office downloads the installation files from a shared folder on a server inside the company, not from the internet.

Finally, there is the concept of licensing. Microsoft 365 Apps requires a valid subscription license (like Microsoft 365 E3 or E5). When a user signs into Office with their work account, the license is verified against Microsoft Entra ID (formerly Azure Active Directory). If the license is missing or expired, Office switches to a reduced-functionality mode where you can view documents but not edit them. As an administrator, you assign licenses through the Microsoft 365 admin centre or through Entra ID.

To summarise the key technical pieces: you have the ODT with an XML configuration file to define the installation. You assign users to update channels (Current, Monthly Enterprise, Semi-Annual Enterprise). You manage update deadlines and user behaviour with Group Policy or Intune policies. You ensure every device has a valid license through Microsoft Entra ID. That is the complete picture of deploying and updating Microsoft 365 Apps in an organisation.

## Real-world context

Meet Priya, the IT administrator at a medium-sized company called MapleTech (150 employees). MapleTech uses Microsoft 365 E3 licenses and recently hired 20 new employees in its sales department. Priya needs to deploy Office to their new laptops and then keep Office updated across all 150 machines. She cannot afford to let a security flaw in Excel go unpatched for weeks, but she also cannot break the accounting department's custom Excel macro that their finance team depends on.

Priya's first step is to plan the deployment. She decides to separate the 20 new sales laptops into two update channels: 5 of the laptops will be on the Current Channel (for power users who want the latest features and can handle occasional bugs), and the other 15 will be on the Semi-Annual Enterprise Channel (for stability). She configures this by creating two separate XML configuration files.

Next, she downloads the Office Deployment Tool from the Microsoft website. She creates the first XML file for the Current Channel group. The file specifies:

- Which apps to install (Word, Excel, Outlook, Teams, OneDrive).
- The architecture (64-bit, because the new laptops have more than 4GB of RAM).
- The update channel (Current Channel).
- The language (English).
- The source location (a network share on a local server, so she does not have to download the 3GB installer 20 times from the internet).

She runs the ODT command (setup.exe /configure configuration-current.xml) on one test laptop first. It works. Then she pushes the same command to the 5 pilot machines using Microsoft Intune. Intune allows her to run scripts and deploy software to remote machines without touching them.

For the other 15 sales laptops, she uses a second XML file configured for Semi-Annual Enterprise Channel. She also sets an update deadline policy via Intune: 'Updates will download automatically. Users can postpone installation up to 2 times. After 7 days from release, the update will force-install and restart the device if needed.' This ensures that the important security patches are installed within a week, even if a sales rep is travelling and ignoring the pop-up.

Now, the existing 130 Office users. Priya uses Group Policy in on-premises Active Directory to configure update settings for those devices. She sets the update channel for the entire finance department to Semi-Annual Enterprise (to protect that custom macro). She enables the 'Hide option to enable or disable updates' policy so users cannot accidentally turn off automatic updates. She also configures the 'Update deadline' policy to 5 days for all groups, with a grace period of 2 days after the deadline before the device forces a restart.

Finally, Priya monitors the deployment in the Microsoft 365 Apps admin centre. She checks the 'Office 365 software update status' report to see which devices still need the latest patch. She sees that 3 devices in the accounting department are showing as 'updates pending' because the users have been postponing. She sends a friendly email reminder, and within 24 hours, those devices are up to date.

This real-world scenario shows the full lifecycle: plan channels, create XML files, deploy with ODT and Intune, configure update policies with Group Policy or Intune, and monitor compliance in the admin centre.

## Exam focus

The MD-102 exam tests your practical knowledge of deploying and updating Microsoft 365 Apps. You will see scenario-based questions where you must choose between Current Channel, Monthly Enterprise Channel, and Semi-Annual Enterprise Channel. The exam loves to test the exact behaviour of update deadlines, grace periods, and what happens when a user runs out of postponements.

Key exam topics you will be tested on:

- The three update channels and their update cadences (Current = monthly, Monthly Enterprise = monthly but only on Patch Tuesday, Semi-Annual = twice a year). You must know which channel is appropriate for a given business requirement. For example: 'A financial firm needs maximum stability and only wants feature updates twice a year. Which channel?' Answer: Semi-Annual Enterprise Channel.

- The Office Deployment Tool (ODT): you need to know that it uses an XML configuration file to define installation settings. They will ask what command you run to perform a silent installation (setup.exe /configure configuration.xml). They might ask what happens if you do not specify an update channel in the XML (it defaults to Current Channel).

- Update deadlines and grace periods: know the difference between 'Deadline' (the date when the update is forced) and 'Grace period' (extra time after the deadline before a restart is forced). A typical trap: 'You set a deadline of 7 days and a grace period of 2 days. When is the restart forced?' Answer: Day 9.

- How users can postpone updates: they can postpone up to 3 times (unless you change it with policy). The exam will test whether users can see and use the 'defer update' option and what the default deferral period is (3 days).

- Group Policy vs Intune: you need to know that both can configure update settings, but Intune is the modern, cloud-based method. For devices that are Microsoft Entra ID joined only (no on-premises Active Directory), you must use Intune policies. For devices that are hybrid joined (on-premises AD + Entra ID), you can use either.

Common exam traps:

- Confusing Monthly Enterprise Channel with Semi-Annual Enterprise Channel. Remember: Monthly Enterprise is still every month (like Current) but with a one-week delay. Semi-Annual is only twice a year. The exam will give you a scenario like 'needs feature updates monthly but with a delay for testing' — that is Monthly Enterprise.

- Thinking that the update channel is set in the client UI. It is not — it is set via XML during deployment or via Group Policy/Intune after deployment. Users cannot change the channel themselves (unless the admin allows it).

- Believing that all users in an organisation must use the same channel. Wrong. You can assign different channels to different user groups based on their needs.

- Forgetting that the Semi-Annual Enterprise Channel still receives monthly security updates — only the feature updates are delayed. Security patches come every month regardless of channel.

Terms to memorise for the exam:

- ODT = Office Deployment Tool.
- XML configuration file = defines what to install and which channel.
- Click-to-Run = the underlying streaming and update technology for Microsoft 365 Apps.
- CDN = Content Delivery Network (Microsoft's internet servers).
- Network share = a local folder on a server used to host the Office installation files.
- MAAC = Microsoft 365 Apps admin centre (where you monitor update status).

Know these backwards and forwards, and the update-management questions on the exam will feel like a breeze. The typical format is a multiple-choice question with a two-sentence scenario followed by four options. You pick the correct channel or policy configuration. You will also see drag-and-drop questions where you match the channel to its update frequency.

## Step by step

1. **Plan Update Channels** — Decide which update channels (Current, Monthly Enterprise, Semi-Annual Enterprise) to assign to different user groups based on their need for new features versus stability. Document which groups get which channel.
2. **Download Office Deployment Tool and Source Files** — Download the ODT from the Microsoft website. Use the ODT to download the Office installation files to a network share (local server folder) so you do not consume internet bandwidth for every computer. Create separate folders if you need multiple product versions.
3. **Create XML Configuration Files** — For each user group, create an XML file that specifies the channel, apps, language, and architecture. For example, one file for sales (Current Channel) and another for finance (Semi-Annual Enterprise). Test the XML on a single computer before broad deployment.
4. **Deploy Office to Devices** — Run the ODT command (setup.exe /configure yourfile.xml) on target computers. You can deploy this command manually, via Intune (as a script or Win32 app), or via Group Policy (using startup scripts). Verify successful installation on pilot devices.
5. **Configure Update Policies** — Set update deadlines, grace periods, and postponement limits using Group Policy (for on-premises devices) or Intune (for cloud-joined devices). Enable automatic download and installation, and set a deadline to force compliance within a safe window.
6. **Monitor and Remediate** — Use the Microsoft 365 Apps admin centre to view update status reports. Identify devices that are behind on updates and take action (send reminders, escalate to manager, or remotely trigger an update via Intune). Adjust policies if too many devices are failing compliance.

## Comparisons

### Current Channel vs Semi-Annual Enterprise Channel

**Current Channel:**
- Feature updates monthly, immediately upon release
- Best for power users who want latest features
- Higher risk of bugs impacting production

**Semi-Annual Enterprise Channel:**
- Feature updates only twice per year (January & July)
- Best for stability and compliance-heavy departments
- Lower risk due to months of testing before deployment

### Office Deployment Tool (ODT) vs Microsoft Intune

**Office Deployment Tool (ODT):**
- Command-line tool for initial installation and download
- Uses XML configuration file for settings
- Does not monitor ongoing update compliance

**Microsoft Intune:**
- Cloud-based service for ongoing management
- Uses policies (not XML) for update settings
- Provides compliance reports and remote remediation

### Update Deadline vs Update Grace Period

**Update Deadline:**
- The date when the update must be installed
- If user postpones past deadline, update is forced
- Measured in days from update release

**Update Grace Period:**
- Extra time after deadline before restart is forced
- User can still work during grace period
- Measured in days (e.g., 2-day grace period means restart forced on day 9 if deadline is day 7)

### Group Policy (GPO) vs Intune Policy

**Group Policy (GPO):**
- Requires on-premises Active Directory
- Works only for domain-joined devices
- Updated via Group Policy Management Console

**Intune Policy:**
- Works for Microsoft Entra ID joined devices
- Works for internet-connected devices anywhere
- Updated via Microsoft Endpoint Manager portal

## Diagram

_This flowchart shows the high-level decision process for deploying and managing Microsoft 365 Apps updates, from planning channels to monitoring compliance._

```mermaid
flowchart TD
    A[Administrator] --> B[Plan update channels]
    B --> C[Group 1: Current Channel]
    B --> D[Group 2: Monthly Enterprise]
    B --> E[Group 3: Semi-Annual Enterprise]
    C --> F[Create XML config files]
    D --> F
    E --> F
    F --> G[Download ODT and source files]
    G --> H[Deploy Office using ODT + Intune or GPO]
    H --> I[Configure update policies (deadlines, grace periods)]
    I --> J[Monitor compliance in Microsoft 365 Apps admin centre]
    J --> K[Remediate non-compliant devices]
```

## Common misconceptions

- **Misconception:** You must be connected to the internet to deploy Office using the Office Deployment Tool. **Reality:** You can download the Office installation files to a local network share and deploy from there, saving bandwidth. (Beginners think 'cloud' means internet-only. The ODT supports offline deployment via a local source.)
- **Misconception:** The update channel is a setting users can change in the Office app settings themselves. **Reality:** By default, users cannot change the update channel. It is set by an administrator via the XML file, Group Policy, or Intune. (Most home users can change their channel, so beginners assume the same applies in corporate environments. It does not.)
- **Misconception:** Switching a user from Current Channel to Semi-Annual Enterprise Channel immediately downgrades their Office build. **Reality:** You cannot downgrade Office to a lower channel without a full reinstallation. Switching channels only affects future updates. (The word 'switch' implies a direct change, but Office does not support rolling back to an older build via channel change.)
- **Misconception:** The Semi-Annual Enterprise Channel only receives updates in January and July, meaning no security fixes in between. **Reality:** Security updates are delivered monthly on Patch Tuesday for all channels, including Semi-Annual Enterprise. Only feature updates are twice a year. (The word 'Enterprise' makes people think it is extra slow, but security is still a priority.)
- **Misconception:** The 'Monthly Enterprise Channel' is the same as the old 'Current Channel' with a different name. **Reality:** Monthly Enterprise Channel is a distinct channel that delivers feature updates monthly but only on the second Tuesday of each month, unlike Current Channel which drops updates whenever Microsoft releases them. (Microsoft changed the naming scheme in 2020, and the exam loves to test the distinction.)

## Key takeaways

- The Office Deployment Tool (ODT) uses an XML configuration file to define exactly which Office apps, languages, architecture, and update channel to use during installation.
- There are three main update channels: Current Channel (monthly features), Monthly Enterprise Channel (monthly features on Patch Tuesday), and Semi-Annual Enterprise Channel (features twice a year).
- You cannot downgrade Office to an earlier channel without a full reinstallation; switching channels only affects future updates.
- Update deadlines and grace periods control when users are forced to install updates, preventing indefinite postponement of security patches.
- The Semi-Annual Enterprise Channel still receives security updates every month on Patch Tuesday, even though feature updates are only released twice a year.
- Group Policy and Microsoft Intune are the two tools you use to configure update settings after Office is deployed, with Intune being the modern cloud-based choice.
- Users can postpone an update up to three times by default, and administrators can override this with policy settings.
- For devices that are Microsoft Entra ID joined only (no on-premises Active Directory), you must use Intune to manage update policies.

## FAQ

**What is the Office Deployment Tool and why do I need it for MD-102?**

The Office Deployment Tool (ODT) is a free command-line utility from Microsoft that lets you download, configure, and deploy Microsoft 365 Apps to multiple computers. For MD-102, you need to know how to create XML configuration files and run the ODT to install Office at scale.

**Can I use the same update channel for everyone in my company?**

Yes, but best practise is to assign different channels to different user groups based on their needs. For example, IT staff might use Current Channel for early testing, while accountants use Semi-Annual Enterprise for stability.

**How do I force an update to install immediately on a user's computer?**

You can configure a Group Policy or Intune policy with a deadline set to 0 days, which forces the update to install immediately. However, this may cause disruption if the user is in the middle of work.

**What happens if a user postpones an update too many times?**

After the user has exhausted the maximum number of postponements (default is 3), the update will force-install automatically at the next available opportunity, possibly restarting the device.

**Is it true that I can only use Group Policy for on-premises computers?**

Group Policy works only for devices connected to on-premises Active Directory. For devices that are only joined to Microsoft Entra ID, you must use Intune to manage update policies.

**What is the difference between Monthly Enterprise Channel and Semi-Annual Enterprise Channel?**

Monthly Enterprise Channel delivers new features monthly (on Patch Tuesday), while Semi-Annual Enterprise Channel only delivers features twice a year. Both receive monthly security updates on Patch Tuesday.

## Check your understanding

1. **Which update channel should you assign to a department that needs new features as soon as they are available but can tolerate occasional bugs?**

   Answer: Current Channel, because it delivers feature updates monthly immediately after Microsoft releases them.

2. **What command do you run with the Office Deployment Tool to install Office using the settings in 'config.xml'?**

   Answer: setup.exe /configure config.xml

3. **Can a user in a corporate environment change their own update channel?**

   Answer: No, by default the update channel is set by the administrator via XML, Group Policy, or Intune, and users cannot change it.

4. **What is the difference between an update deadline and an update grace period?**

   Answer: The deadline is the date the update must be installed; the grace period is extra time after the deadline before a restart is forced.

5. **If you set a deadline of 5 days and a grace period of 3 days, on which day is the restart forced?**

   Answer: Day 8 (5 days deadline + 3 days grace period).

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/md-102/managing-microsoft-365-apps