Microsoft 365 Apps: Deploy, Customize & Manage
Deploying the Office suite at scale means more than clicking install. Learn to use Intune, the Office Deployment Tool, and the M365 Apps admin center for enterprise Office management.
Deploying Microsoft 365 Apps
Think of deploying M365 Apps like furnishing an apartment building.
You don’t buy furniture individually for each apartment. You choose a standard package (sofa, table, bed), customise it (king bed for corner apartments, twin for studios), and the delivery company installs everything. Some tenants might want extras (Visio, Project) — those are available on request.
Intune is your delivery company. You configure which Office apps to include, which update channel to use, and which language packs to install. Intune pushes the package to every device in the group.
Deployment via Intune (recommended)
Step by step
- Intune admin center → Apps → Windows → Add → Microsoft 365 Apps → Windows 10 and later
- Configure app suite:
| Setting | Options | Sam’s Choice |
|---|---|---|
| Apps to include | Word, Excel, PowerPoint, Outlook, OneNote, Teams, Access, Publisher, Visio, Project | Word, Excel, PPT, Outlook, OneNote, Teams |
| Update channel | Current, Monthly Enterprise, Semi-Annual Enterprise | Monthly Enterprise Channel |
| Architecture | 32-bit or 64-bit | 64-bit |
| Languages | Select from 40+ languages | English (NZ), Maori |
| Remove other Office versions | Yes/No | Yes — remove any pre-installed Office |
| Shared computer activation | Yes/No | No (unless shared devices) |
| Accept EULA on behalf of users | Yes/No | Yes |
- Assign to device or user groups as Required or Available
- Monitor deployment status in the Apps monitor dashboard
Update channels explained
| Channel | Update Frequency | Best For |
|---|---|---|
| Current Channel | Monthly (as soon as ready) | Users who want the latest features immediately |
| Monthly Enterprise Channel | Monthly (predictable schedule) | Most organisations — balance of new features and stability |
| Semi-Annual Enterprise Channel | Every 6 months | Highly regulated environments needing maximum stability |
Exam tip: update channel selection
The exam tests channel selection in scenario questions:
- “Organisation wants the latest features ASAP” → Current Channel
- “Organisation needs a predictable monthly schedule with testing time” → Monthly Enterprise Channel
- “Organisation is heavily regulated and can’t tolerate frequent changes” → Semi-Annual Enterprise Channel
Sam at Tui Solutions uses Monthly Enterprise — predictable, gives time for testing, but still gets new features regularly.
Office Deployment Tool (ODT) and Office Customization Tool (OCT)
When to use ODT/OCT instead of Intune
| Scenario | Use ODT/OCT |
|---|---|
| Offline deployment (no internet) | ODT can download Office to a local share |
| Autopilot with custom Office config | Include ODT in Autopilot provisioning |
| Complex language/architecture combinations | ODT XML gives full control |
| Shared computer scenarios | OCT configures activation and licensing |
How they work
- ODT (setup.exe + configuration.xml): command-line tool that downloads and installs Office based on an XML configuration file
- OCT (config.office.com): web-based tool that generates the configuration.xml file with a visual interface — no need to hand-write XML
Deploying M365 Apps with Autopilot
When Office needs to be pre-installed during Autopilot:
- Create the Office package in Intune (built-in M365 Apps type)
- Assign as Required to the Autopilot device group
- Configure the Enrollment Status Page to block until Office is installed
- Device deploys with Office ready on first login
Alternatively, use ODT as a Win32 app for more control over the install configuration.
The Microsoft 365 Apps admin center
URL: config.office.com
This admin center provides:
| Feature | What It Does |
|---|---|
| Servicing profiles | Automated Office update management — replaces manual update ring config |
| Inventory | See which Office versions, channels, and builds are deployed across your org |
| Health dashboard | Monitor Office app crashes, hangs, and macro issues |
| Security update status | Track which devices have the latest security patches |
| Office cloud policy | Configure Office policies without GPO or Intune config profiles |
Office cloud policy service
Create policies that apply to Office apps on any device — managed or unmanaged:
- config.office.com → Customization → Policy Management → Create
- Select policies (e.g., disable macros from the internet, configure AutoSave)
- Assign to an Entra security group
- Policies apply when the user signs into Office, regardless of device management state
Deep dive: Office cloud policy vs Intune config profiles
Both can configure Office settings, but they work differently:
- Office cloud policy — follows the USER across devices. Works on unmanaged devices too. Configured at config.office.com.
- Intune configuration profiles — follows the DEVICE. Only works on enrolled devices. Configured in Intune admin center.
Use Office cloud policy for settings that should follow users everywhere (macro security, default font). Use Intune profiles for device-specific settings (update channel, installation config).
🎬 Video walkthrough
Flashcards
Knowledge Check
Sam needs to deploy M365 Apps to 500 devices at Tui Solutions. He wants monthly updates on a predictable schedule with time to test before each rollout. Which update channel should he choose?
Aroha needs to block internet macros in Office apps for all CloudForge users, even when they use Office on personal unmanaged devices. What should she use?
Next up: App Protection Policies & Conditional Access — securing corporate data in apps without requiring full device management.