Application updates can be managed through Intune or through external tools. External tools typically provide significantly more configuration and customization options.

But external tools need to be purchased, set up, integrated and maintained. In addition, it is not infrequent that external tools, nowadays typically in the form of a service, have security incidents. Such an incident can then directly endanger your environment through a so-called supply chain attack. There are many examples of supply chain attacks in the history.

For the reasons mentioned above, I recommend using the native capabilities within Microsoft Intune. For Microsoft 365 Apps, there is native support in Intune for update configuration, so there is not much reason to even address this with another tool.

How to configure Microsoft 365 Apps update policies in Intune

Managing Microsoft 365 Apps updates in Microsoft Intune is easy with configuration profiles.

So create a new Device Configuration Profile of type Settings Catalog. Open the settings for Microsoft Office 2016 (Machine), where the Updates category is located at.

I usually recommend configuring the items shown in the screenshot:

  • Deadline
  • Delay downloading and installing updates for Office
  • Don’t install extension for Microsoft Search in Bing that makes Bing the default search engine
  • Don’t install Microsoft Teams with new installations or updates of Office
  • Enable Automatic Updates
  • Hide option to enable or disable updates
  • Hide Update Notifications
  • Update Channel
  • Update Deadline

The screenshot below shows my typical configuration. The deadline for updating Office is set to 2 days. I disable the installation of the Microsoft Search extension which sets Bing as the default search engine; I enable the installation of Teams as part of the Office installation; I enable automatic updates; I disable the ability to pause updates; I show notifications of pending updates; and I set the update channel to Current Channel.

This is a basic and very simple configuration, but in most cases it is perfectly sufficient.