Microsoft Ignite 2019 Guide to Office 365 ProPlus Deployment

If you’re an Office IT Admin, get ready to learn the latest and greatest about Microsoft Office 365 ProPlus deployment at Ignite starting November 4. We’re very excited to announce the following sessions, workshops, speakers, and other learning opportunities to help you make your Office 365 ProPlus deployment and management success. Here is what we have lined up for you:

Best practices for deploying and managing Microsoft Office 365 ProPlus (BRK3087). Amesh Mansukhani, a Principal Program Manager focused on helping enterprise organizations efficiently manage Office 365 ProPlus deployments, shares what’s new from the Office engineering team on how to best deploy and manage Office 365 ProPlus within your environment. He’ll also walk through the deployment tools and discuss the best options to suit your environment.

What’s new in the Office Customization Tool (THR 30309). Learn what’s new in the Office Customization Tool for Office 365 ProPlus from Chris Hopkins, a Senior Program Manager on the Office Enterprise Lifecycle team responsible for the deployment and management experience for Office across Office 365, System Center Configuration Manager, and Microsoft Intune.

Best practices for compatibility assessment and Office 365 ProPlus upgrades using Office Readiness in Configuration Manager (BRK3090). In this session, Tara Hanratty, a Senior Program Manager in Microsoft Ireland who focuses on helping enterprises address compatibility concerns, will discuss best practices for upgrading to Office 365 ProPlus, including:

• Evaluating Office readiness
• Using the Readiness Toolkit for advanced VBA readiness
• Discovering and remediating issues
• Deploying to “ready devices” with the right settings
• Identifying optimal pilots to unblock more devices
• Viewing health on deployed devices
• Viewing unblocked devices
• Advanced plug-in reports (accessibility)

Get to know the new Office Cloud Policy Service (THR3038). If you are still managing Office policies using Group Policy Manager, but you want to move the cloud, come learn about the new Office Cloud Policy Service. Chris Hopkins will explain how you can use the Office Cloud Policy Service to manage policies for Microsoft Office 365 ProPlus on Windows, Mac, and Office on the web. He’ll also show you how to use built-in intelligence to provide security policy recommendations and baselines for simplifying management and compliance.

Deploying and managing Microsoft Office 365 ProPlus (WRK3019). In this workshop, Matt Philipenko, Senior Premier Field Engineer for Office Deployment, Servicing, and Activation and ProPlus Ranger, will cover deploying and managing Office 365 ProPlus using Configuration Manager and Intune. He will walk through creating an Office 365 ProPlus deployment, managing updates, configuring cloud policies, and monitoring your current deployment status, and also share Microsoft best practices and common customer implementations.

Microsoft Office privacy controls and Diagnostic Data (BRK3088). Office uses the power of the Microsoft Cloud to deliver exciting new capabilities to individuals and organizations. Diagnostic data helps Microsoft keep Office and these experiences secure, up to date, and performing as customers expect. Some organizations have wondered what happens to this data, how it’s used, and how they might control the flow. Revolutionary change in product transparency over the past year means commercial customer IT departments can now control this data. In this session, you’ll gain a deep understanding about diagnostic data, identify the benefits of diagnostic data to your organization, learn about you can view and manage this data, and hear from a customer that has implemented the controls. This session is presented by Brian Albrecht and Steve Conn. Brian runs the Microsoft Office Data, Privacy, and Insights PM Team and is responsible for diagnostic data privacy and compliance with GDPR and next generation privacy regulations across the Office 365 client experiences. Steve has worked on Office and Windows in various marketing and engineering roles for 12 years.

The future of Office: The insiders view and how we’re making it easier for IT admins and organizations to deploy and use Office 365 ProPlus (BRK3298). Are you interested in what’s being developed for Office 365 ProPlus deployment? In this panel, moderated by Amesh Mansukhani, Microsoft CVPs Aleš Holeček and Tara Roth dive deep into what we’re bringing in the coming year to IT Admins and organizations around Office 365 ProPlus deployment. We also talk about the Office Insider program and why it’s a necessary component to successful deployments. And, we’ll get some real-world feedback from several customers, including Thuy Mesina from Chevron and Jason Meyers from Mars, about their recent experiences with ProPlus deployment and the Office Insider program.

Moving to Windows 10 and Office 365 ProPlus? FastTrack is here to help! (BRK2177) Learn from the FastTrack experts Sean McLaren and Bryan Allen as they share deployment best practices and learnings from experience with customers moving to Windows 10 and Office 365 ProPlus. The clock is ticking on end of support for Windows 7, with the January 14, 2020 deadline quickly approaching. Learn how FastTrack can help you accelerate your upgrade to Windows 10 with Desktop Analytics and leverage your existing investments in System Center Configuration Manager. You’ll also learn how we can help you deploy Office 365 ProPlus, mitigate application compatibility issues with Desktop App Assure, and keep your devices up to date. FastTrack for Microsoft 365 is your advisor to help deploy Windows 10 and Office 365 ProPlus, and leverage the value of Office in the cloud at no additional cost.

We look forward to seeing you at Ignite in Orlando, Florida starting November 4! Come talk with us at the Hubb. Our experts are easiest to find in the following booths: Office 365 ProPlus Deployment, Office Insiders Program, and FastTrack. For those not joining Ignite in person, you can watch livestream keynotes and some select sessions on-demand. As always, visit out Docs page to see what’s new in Office 365 ProPlus, watch our YouTube Deployment channel, and join the Office Insider program.

You may also find the following additional resources useful:

• Office deployment content for IT Pros: https://docs.microsoft.com/deployoffice
• What’s new in Office deployment for IT Pros: https://docs.microsoft.com/DeployOffice/whats-new-office-it-pros
• Microsoft 365 Enterprise documentation and resources: https://docmicrosoft.com/microsoft-365/enterprise/
• Getting started deploying Office Insider builds: https://insider.office.com/en-us/business/deploy
• Office 365 ProPlus deployment assistance from FastTrack: https://fastttrack.microsoft.com

Understanding Office 365 ProPlus Updates for IT Pros (CDN vs SCCM)

In supporting customers in the field, we receive many questions about Office 365 ProPlus update process. The objective of this blog is to provide context around end user behavior during update scenario and clarify when and how Office updates are applied. 

Office ProPlus was designed to be a cloud first product…. What does that mean?  It means that by default, Microsoft recommends you update Office 365 ProPlus directly from Microsoft Content Delivery Network (CDN).  While IT Pros are always in control,  Office 365 ProPlus is automatically kept up-to-date via evergreen model.  IT Pros can offload servicing aspect of Office 365 ProPlus to Microsoft so they can focus on other duties removing repetitive tasks.  At present, while we lead with CDN as our recommendation, the vast majority of Enterprise customers I work with prefer to manage updates from System Center Configuration Manager (SCCM) for a variety of reasons. (too many to list here such as network, governing process or political etc.)

Let’s compare and contrast both scenarios below to see which approach is best to address your business requirements.  Regardless, the goal is to ensure Office 365 ProPlus is serviced every month to address security and deliver features based on cadence suitable for our customers.

Quick refresher of Office ProPlus channel cadence –Simplified 

Monthly: Provide users with the newest features of Office as soon as they’re available.  This could be three or four builds per Month. (Updates should be delivered by CDN)

Semi-Annual Channel (Targeted): Provide pilot users and application compatibility testers the opportunity to test the next Semi-Annual Channel.  Featuresfixes delivered every six months, in March and September (Updates can use CDN or SCCM)

Semi-Annual Channel: Provide users with new features of Office only a few times a year. Featuresfixes delivered every six months, in January and July (Updates can use CDN or SCCM)

(Official Link is here Overview of update channels)

Note about PREVIEW feature using Delivery Optimization for Office 365 ProPlus installupdates

The point of the channels is to define the timing when those cumulative builds include features and fixes in addition to security. If you would like more information about channel management please see my other posting for more information called How to manage Office 365 ProPlus Channels for IT Pros

*This blog will focus primarily on update process.  Deployment of Office 365 ProPlus is out of scope and will assume Office 365 ProPlus is already installed on the machine.

Update from CDN

Prerequisites

• Automatic Updates is by default Enabled (equivalent GPO is “Enabled Automatic Updates”). If disabled, Office 365 ProPlus will never update.

Benefits

• Admins don’t have to spend time developing processes to duplicate CDN content on-premises.
• Admins don’t have to build processes to target software updates to collections. Each machine will pull updates on it’s own.
• Aligns with “Modern Desktop” motion where machines are increasingly managed by Mobile device management (MDM) rather than on-premises solutions without requirement for any infrastructure.
• CDN supports a variety of advanced policies to control updates at granular level such as “delay downloading and installing updates for Office”, “prioritize BITS”, “Target Version”, “Update Channel”, “Update Deadline”. IT Pros can control updates effectively without the need for on-premises software.
• Leverages inbox task scheduler MicrosoftOfficeOffice Automatic Updates 2.0 to perform updates based on trigger mechanism (Weekly, At log on, On idle)

Note: On idle is very interesting trigger condition in that it can check for criteria such as user absence and lack of resource consumption to determine opportunistic time to retry updates (no reboots required when Office applications are closed).

Reference Links for next section: Update history for Office 365 ProPlus (listed by date) and Download sizes for updates to Office 365 ProPlus

User Experience when updating from CDN

Let’s imagine Office 365 ProPlus has June 2019 build installed which is Version 1808 (Build 10730.20348).  “Patch Tuesday” rolls around and on July 9^th 2019 July build is released which is Version 1902 (Build 11328.20368).  Based on the trigger assigned the scheduled task “Office Automatic Updates 2.0” will detect a newer build applicable.  Upon initial release to CDN, a new build is temporary throttled until signals are received ensuring highest quality release have been verified.  As a result, IT Pros may observe updates may not occur on Day 0 to all machines but rather over a period of days.  Alternatively, IT Pros can intervene and enable policy “delay downloading and installing updates for Office” and simply define installing update based on number of days.   This mirrors servicing plans feature in SCCM for delivering Windows Feature Updates and makes it easy to build rings.

Since the build installed is most recent version we can leverage a feature called binary delta compression to help reduce the size of the files further.  Therefore, keeping Office ProPlus up-to-date is friendlier on network.  Office will download deltas and will stage in C:Program FilesMicrosoft OfficeUpdatesDownload.  After download Office Automatic Updates 2.0 will attempt to update Office 365 ProPlus.  If no Office applications are open, it will update.  If Office applications were open at the time of update request a series of notifications will occur of period of days. (Officially documented here)

Specifically, If, after four days, the updates still aren’t applied, a message appears in the notification area in Windows, telling the user that updates are available.

If, after six days, the updates still aren’t applied, a message appears in any newly opened Office document, reminding the user that updates are available.  We refer to this as the “BusBar” which allows user to drive change when convenient. 

Clicking “Update now” when Office applications are open will result in sample dialogue below.  Clicking continue will save work, update and reopen applications.

The Office backstage also offers a “Update now” selection driven by the user which will check for updates and download build resulting in same prompt above.

IT Pros can also configure policy “Update Deadline” to set a deadline by when updates for Office must be applied.  Users are given notifications leading up to the deadline. For example, within seventy-two hours of the deadline, users see a message, in any newly opened Office document, that updates are blocked.

Additional reminders will appear leading up to deadline notifying user update is mandatory.  This message appears every two hours. It’ll also be shown 60 minutes, 30 minutes, 15 minutes, and 5 minutes before the deadline.

If the deadline arrives and the updates still aren’t applied, users see a dialog box that warns them that they have 15 minutes before the updates are applied.

User Experience when updating from SCCM

Prerequisites

• SCCM Current Branch with Windows Server Update Services (WSUS) 4.0, you can’t use WSUS by itself to deploy these updates. You need to use WSUS in conjunction with Configuration Manager
• The hierarchy’s top level WSUS server and the top level Configuration Manager site server must have access to the following URLs: *.microsoft.com, *.msocdn.com, *.office.com, *.office.net, *.onmicrosoft.com, officecdn.microsoft.com, officecdn.microsoft.com.edgesuite.net.
• Office 365 Client product must be selected from products tab under Software Update Point Component Properties and synchronize software updates after change. Once complete, you should see Office 365 Client Updates populate the Office 365 Updates node under Office 365 Client Management within Software Library tab in SCCM Console.
• Office 365 Client Management must be enabled on the client. This can be configured in multiple ways such as adding OfficeMgmtCOM=”TRUE” in configuration.xml during installation, enable domain policy “Office 365 Client Management” and finally by toggling “Enable management of the Office 365 Client Agent” to Yes from within SCCM Client settings under Software Updates.  You can verify by launching dcomcnfg.exe on the client computer and confirming OfficeC2RCom application is registered.  Only one is required, where policy overrides and take priority over all other methods.  The purpose of the COM application is to allow Office 365 ProPlus to interop with SCCM to pull updates from distribution points rather than CDN

Example of running dcomcnfg.exe

Note about PREVIEW feature using Delivery Optimization for Office 365 ProPlus installupdates

Overwhelming majority of enterprise customers use SCCM to deliver Office 365 Client updates for compliance and distribute content from Distribution Points.  Microsoft is always working hard to provide customers additional options including the new feature Delivery Optimization and Office 365 ProPlus which is now in (Preview).  Please read article for full details but one-liner is customers will be able to install AND update Office 365 ProPlus sourcing content from peers without infrastructure requirements which we’re super excited about. (no more “thick packages” or distributing loads of content to support a simple language pack).  If you enabled OfficeMgmtCom for SCCM integration, this action must be reversed in order to use Delivery Optimization (DO). The Microsoft Office Click-to-Run Service is responsible for registering and unregistering OfficeC2RCom (OfficeMgmtCOM) application during service startup.  Changing domain policy or SCCM client settings for Office 365 Client Management from ‘Enabled’ to ‘Not configured’ is not enough.  Domain Policy or SCCM Client settings require explicit ‘Disable’ selection for OfficeC2RCom to be successfully deregistered and restore default configuration. Further, any custom update path configuration must also be removed.

Benefits

• Office 365 ProPlus updates can easily be included in the same software deployment as monthly Windows patch process. As a result, all existing business processes and change control can be aligned in the same manner as legacy MSI Office products.
• Clients will only pull down what’s needed to update themselves from Distribution Point.
• SCCM Administrators can download cumulative build one time from the internet and than deploy to all distribution points so clients pull updates from intranet sources.
• Administrators can make deployment Available (optional where user is notified update)
• Administrators can make deployment Available for a period of time prior to Installation Deadline. In this scenario, Office 365 Client using OfficeMgmtCOM will pull deltas from distribution point prior to Installation Deadline and give user a chance to “Update now” via BizBar discussed above at a time which is convenient for them.  This is especially important in a ever mobile world where machines are mobile and not powered on all the time.  Further, IT Pros can get some early production validation as some subset of their population will update prior to Installation Deadline giving them advanced notification of any problems prior to broad deployment.
• Administrators can make deployment Available time and Installation Deadline the same time. SCCM will ensure update is downloaded and installed at Deadline. (additional details on user experience below)
• Administrators can enable SCCM features such as Peer Cache so clients can share content among themselves further reducing network WAN traffic. (Peer cache for Configuration Manager clients)

User Experience when updating from SCCM

Frequency of toast notifications from SCCM are configurable within “Client Settings” under “Computer Agent”. This configuration is applicable to all software deployments not just Office 365 Client

Can be found within SCCM console under client settings

SCCM Deployment Scenarios

Scenario 1 – Available only

If the deployment is Available only, the user will only see a toast notification in the system tray for a few seconds, Office update will never be deployed automatically.  The problem is this notification isn’t context sensitive so it simply takes end user to Software Center and it also doesn’t ensure security compliance.  Therefore, approach isn’t used often in my experience.

Scenario 2 – Available with future Installation Deadline

This scenario is a good fit for customers who desire faster compliance, no reboots for Office 365 ProPlus updates and are comfortable with additional Office 365 ProPlus end user toast notifications, also in app notifications as well as Office 365 ProPlus countdown dialog leading up to deadline.  If the SCCM deployment is Available with future Installation Deadline, Office 365 ProPlus working with OfficeC2RCom application will download the necessary Office build pieces (not the entire build) and stage for installation pulling content from Distribution Point.  When COM is enabled and new build is staged, restart of Windows will not result in installation of update.  Immediately after the newer build is staged, any Office 365 ProPlus application which is reopened will immediately see the “BusBar” with end user option to drive change through “Update now” button.  This is a subtle difference compared to CDN scenario where banner shows only after a number of days.  Clicking the button results in same workflow as defined in CDN section.  When content is prestaged, there are a number of potential notifications, please review bullet items in blue from page Manage Office 365 ProPlus with Configuration Manager to review all details as there are many.

For example:

“BusBar”

Business Bar

Once build is staged, a toast notification might not display until the user clicks the icon in the notification area which is easy to miss. 

“Basic notification” which sometimes be hidden under task bar chevron  

7.5 hours prior to deadline, Office will show ‘Enforced Toast’ which will present above “Office Updates Available” toast to foreground.  If user doesn’t click “Update now”, end user will potentially receive three additional notifications with countdown.  If no decision is made to postpone, Office applications will be forced closed and updates prior to deadline defined in SCCM.

Minute countdown Second countdownUpdates Installed

If user postponed update by clicking ‘Postpone’ and deadline is eventually reached, standard SCCM restart window will be displayed with countdown.  Additionally, Office may also raise additional notification with 30 minute countdown.  Important to note, countdown from SCCM and Office countdown are not synchronized in any way, they work on separate timers.

Scenario 3 – Available and Required Installation Deadline have same date

This scenario is best for IT Pros who want to minimize notifications to end user unless deadline has been reached.(Office content is not prestaged)  If the software deployment Available time and Installation Deadline have the same date, SCCM Client will determine that deadline has been missed and therefore make the deployment immediate.  Typical notification workflow will be presented to user.  

In this case since deadline has passed, download will begin automatically.

Once content has been downloaded, SCCM will immediately initiate Office update with following logic:  

• If all Office applications are closed, update will occur with no reboot. 
• If any Office application are open standard SCCM reboot workflow occurs.

The end user will begin to see SCCM “Restart Window” below which shows countdown until restart is forced.  The countdown frequency of notification are controlled solely by SCCM Client and can be configured within Client Settings node within SCCM Console.

FAQ:

Is there a simple way to hide all notifications in Office such as the “Biz Bar” with button “Update Now?”

Yes. Use “Hide Update Notifications” GPO or registry

HKLMSOFTWAREPoliciesMicrosoftoffice16.0commonofficeupdate
"hideupdatenotifications"=dword:00000001

This registry setting doesn’t apply to deadline notifications such as the large white splash screen with countdown.

Is there an Microsoft official page which talks about this topic?

Yes. Manage Office 365 ProPlus with Configuration Manager

If the download is supposed to only contain deltas and stage to C:Program FilesMicrosoft OfficeUpdatesDownload, why in my environment is it staged in C:Windowsccmcache and full build? (~2GB)

This means SCCM “Peer Cache” feature is enabled and content is available to be shared with other peers.  Windows is leveraging a NTFS feature called “Sparse Files”.  Looking closely at size on disk details, you can compare the differences between the full data and the one on the right using peer cache. (Peer cache really only downloaded 80 MB.)

I’ve done everything I can think of and OfficeC2RCom application never shows within MMC console.  In fact, when I browse COM applications from within dcomconfg.exe, My Computer has a red down arrow?

This means COM, part of .NET may be corrupted on machine.  Office cannot register application as COM itself is broken.  Typically this is edge case and requires rebuild of Windows 🙁

You mentioned On idle update feature in CDN section but was omitted for SCCM, why?

“By design”, feature is enabled only for CDN scenario.

Users who launch Office immediately after logon receive message “Updating Office, please wait a moment”.  Why?

This means Office update was attempted while applications were open which cannot succeed.  Therefore, build was staged to retry update by Microsoft Office Click-to-Run Service on Windows startup.  In this edge case, the user was able to access desktop and launch a Office application while Office update process is in progress.  If easily reproducible, this is often a reflection of slow boot process and Windows startup performance.  Best to troubleshoot by removing 3rd party filter drivers and or startup items.

I’ve tried everything and Software Center never shows Office 365 Client build applicable to my machine?

Review how Office 365 ProPlus determines priority:

1st Priority : GPO "UpdatePath" - HKLMsoftwarepoliciesmicrosoftoffice16.0commonofficeupdate!updatepath
2nd Priority : GPO "UpdateChannel" - HKLMsoftwarepoliciesmicrosoftoffice16.0commonofficeupdate!updatebranch
3rd Priority : "UpdateURL" or UpdatePath="ServerShare" under HKLMSOFTWAREMicrosoftOfficeClickToRunConfiguration
4th Priority : "CDNBaseURL" - HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationCDNBaseUrl

Reflecting on priority list above, have you intentionally or unintentionally set a GPO “UpdatePath” – HKLMsoftwarepoliciesmicrosoftoffice16.0commonofficeupdate!updatepath or included an element inside configuration.xml during initial installation for UpdatePath HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationUpdatePath=”ServerShare”? This in effect breaks native updates via SCCM as they take precedence.  To resolve, remove these values and reset HKLMSOFTWAREMicrosoftOfficeClickToRunConfiguration UpdateChannelChanged to False, run Automatic Updates 2.0 scheduled task manually (or be patient and allow it to run) and then perform Software Updates Deployment Evaluation Cycle from SCCM Control Panel Applet.

You didn’t mention updating from on-premises file share, why?

Updating Office 365 ProPlus from File Shares has been deemphasized as a strategy.  Initially Office 365 ProPlus didn’t support update workflows such as SCCM or Delivery Optimization and therefore customers used this approach.  However, this is resolved with SCCM Current Branch and modern versions of Windows 10 this is no longer necessary. (still supported just less adopted)

The Author

This blog post is brought to you by Dave Guenthner, a Senior Premier Field Engineer and “ProPlus Ranger” at Microsoft. Feel free to share your questions and feedback in the comments below.

Office 365 ProPlus Deployment and Proxy Server Guidance

By far, the most important prerequisite for successful Office 365 ProPlus deployment is network configuration. 

Unlike older versions of Office, Office 365 ProPlus was designed from the ground up to work with cloud services such as Microsoft Content Delivery Network (CDN).  Microsoft recommends IT Pros “Bypass or white list endpoints on network devices and services that perform traffic interception, SSL decryption, deep packet inspection and content filtering” when accessing Microsoft Office 365 service endpoints.  

We often find customers apply “legacy” network configurations for on-premises only products to Office 365 ProPlus which can lead to slower product adoption, poor product performance, and higher cost of ownership.  The network requirements are documented in Office 365 URLs and IP address ranges document.

The goal of this blog is to clarify how IT Pros can optimize Office 365 ProPlus deployments with a proxy server in order to leverage a new concept called Hybrid or “Lean Installs”.

In terms of Office 365 ProPlus general deployment, we have several broad approaches. We’re going to focus on the 3^rd option, “SCCM with Office CDN fallback” or “Lean Install”.

• On-premises only – download and mirror all content from CDN on-premises. Enterprise customers have a variety of install packages (Base Office, Visio, Project, Visio + Project, second installs for languages).  All Office 365 ProPlus builds are cumulative and are updated monthly which can make this cumbersome and difficult to maintain as each permutation requires refreshed content.
• Cloud only – installations from the Office portal and update workflow occur using CDN. End users in the enterprise are normally not Administrators so self-service installations from portal.office.com are blocked.  Further, installation from CDN doesn’t currently support custom configuration files to exclude applications and so forth.
• SCCM with Office CDN fallback or “Lean Install” – IT Pros use SCCM (which has elevated permissions and allows custom configuration.xml files) to deploy Office 365 ProPlus but can either omit all or portions of the installation source and use CDN content.

SCCM is not a requirement to adopt “Lean Install” approach. If you are using 3rd party deployment tool, identify user context of process using process monitor and adopt proxy strategy below.

Lean install examples:

1^st Install

SCCM package contains all Office 365 ProPlus content and only subset of languages. You support 12 languages but only include two primary languages in the application source to minimize content and include AllowCdnFallback as Enabled within configuration.xml.  During the Office 365 ProPlus installation process, the Office Deployment Tool (ODT) looks first for source files in local working directory. If the language pack files required aren’t available in local source location and the AllowCdnFallback setting within configuration.xml is set to True, then the ODT will leverage the Office CDN for the missing ones.

2^nd Install

Office may need to be reconfigured to make changes to Office deployments without changing the version, like adding a language or Project/Visio. In this case, we only want the required bits to perform the change and nothing else.

All example scenarios above depend on the CDN to fetch content when embracing these new “Lean Install” approaches.  The primary reason we want to lean on the CDN is because it allows Office 365 ProPlus to only download the bits it requires for the change request resulting in the smallest network payload possible. 

Exploring 2^nd Install Scenario in detail in terms of content size:

IT Pro wants to perform a 2^nd install to add Project to an existing Office 365 ProPlus installation on one machine. 

If we use SCCM on-premises only strategy:

SCCM will download full Office content from CDN ~2GB.  SCCM will then copy this content to all distribution points to support scenario.  Let’s assume an enterprise customer has 50 distribution points, 2 GB * 50 = 100 GB per month every month (build needs to be up to date as to not downgrade client introducing security concerns).  Office 365 ProPlus builds are cumulative, irrespective of channel, so this content changes each month.

If we use SCCM with Office CDN fallback:

SCCM calls ODT Setup.exe /configure to add Project, only ~41 MB will be downloaded from CDN. 

Make sure to use MatchInstalled parameter in your XML

We expect most customers will download and cache all Office 365 ProPlus content one time to existing machines to perform an upgrade to Office 365 ProPlus but once installed we recommend to leverage the lean technique going forward.

Having “lean” applications in SCCM also means they rarely need to be updated. An occasional refresh of the Office Deployment Tool (ODT) is good idea. (Less than 10 MB)

Tip: There are several ODT features which can benefit from approach (FallbacktoCDN, MatchPreviousMSI, MatchInstalled, MatchOS)

Proxy Challenge

To be clear, even if the lean installation is triggered by an admin user, it still requires the computer (System account) to be able to access the internet in order to support all installation scenarios.  Most of the customers we visit in the field prohibit computers from accessing the internet directly.  Typically, only Users can access the internet through a proxy server or via PAC file.  These User settings are defined as WinINET proxy setting you’ll find in Internet Explorer. 

Standard proxy configuration in Internet Explorer

So, what about the local SYSTEM account needed by SCCM?  If customers follow guidance to allow users and computers direct access to Office 365 endpoints, everything “just works”.  However, often we find customers only configure network proxy for Users and therefore the “lean install” scenarios fail. (Installation will hang as Office Deployment Tool running as SYSTEM process will fail when attempting to access Office CDN)

OK, what can we do to solve problem?  Configure additional proxy settings using Microsoft Windows HTTP Services (WinHTTP) and Background Intelligent Transfer Service (BITS) for System Account.   

Recommended actions

1. Configure WinINET Proxy for SYSTEM
2. Sync configuration from WinINET to WinHTTP

*In this way, we ensure one proxy configuration is set for WinINET and WinHTTP regardless of application caller and network API used.

In my lab I use PSEXEC.EXE to accelerate testing.

From elevated command prompt, run PSEXEC.EXE -s -i cmd.exe.  This will launch cmd.exe process in the SYSTEM context to simulate SCCM package etc.  Type whoami from command line to verify.

C:WindowsSystem32>whoami
nt authoritysystem

Sample commands to set WinINET and import into WinHTTP:

C:WindowsSystem32>bitsadmin /util /setieproxy localsystem MANUAL_PROXY proxy.contoso.com:8080 ";*.contoso.com"
C:WindowsSystem32>netsh.exe winhttp import proxy source=ie

Sample commands to reset:

C:windowssystem32>bitsadmin /util /setieproxy localsystem RESET
C:windowssystem32>netsh winhttp reset proxy

The proxy servernetwork team should only allow computer access to internet URLs as defined by Office 365 URLs and IP address ranges document as well as any other URLs that they want to explicitly allow the Computer account to access.

In summary, configuring a SYSTEM proxy enables adopting a “lean” Office 365 ProPlus deployment strategy which can greatly reduce complexity and cost of ownership to operate Office 365 ProPlus. 

Additional Reference Documentation on proxy configuration for Windows

Use Group Policy to apply WinHTTP proxy settings to Windows clients

bitsadmin util and setieproxy

Office 365 system requirements changes for Office client connectivity

Editor’s note:

Changes have been made to the Office 365 system requirements. Go here to see the September 6, 2018 update and announcement: https://www.microsoft.com/en-us/microsoft-365/blog/2018/09/06/helping-customers-shift-to-a-modern-desktop/

Today on the Office blog, we announced changes to Office 365 system requirements for Office client connectivity and how we will make it easier for enterprises to deploy and manage Office 365 ProPlus. In this post, we are sharing some more detail on what the system requirement changes mean for IT between now and 2020 and why we’ve decided to make this change.

As technology evolves, system requirements need to change

The new system requirements provide clarity and predictability for client connectivity to Office 365 services. When customers connect to Office 365 with a legacy version of Office, they’re not enjoying all that the service has to offer – The IT security and reliability benefits and end user experiences in the apps is limited to the features shipped at a point in time.

When we release new on-premises apps and servers, we use that opportunity to update the system requirements. But there is not yet a common convention on when to update system requirements for a multitenanted cloud service that is always up to date. In absence of that, we are sharing these system requirement changes as early as possible and as part of a larger discussion of the Office 365 ProPlus roadmap for deployment and management capabilities.

As we get closer to 2020, we will share more details about implementation and the user experience for affected desktop clients. The updated Office 365 system requirements for Business Enterprise and Government plans state:

Effective October 13th, 2020, Office 365 will only support client connectivity from subscription clients (Office 365 ProPlus) or Office perpetual clients within mainstream support (Office 2016 and Office 2019). (Please refer to the Microsoft support lifecycle site for Office mainstream support dates.)

Here is a high level summary of  the implications for client connectivity in 2020, depending on how you use Office 365:

2020 may sound like a long way away, but your feedback to us has been consistent on the more advanced notice for Office 365 changes, the better. Providing over 3 years advance notice for this change to Office 365 system requirements for client connectivity gives you time to review your long-term desktop strategy, budget and plan for any change to your environment.

For now, the key takeaway is: Office 365 ProPlus is our recommended Office client for Office 365 users. This is the Office client that stays up to date with frequent feature releases and ensures the best service experience.

Here are some resources to help you plan for a ProPlus upgrade:

• Office 365 ProPlus Deployment Guide – The complete enterprise guide for Office 365 ProPlus deployment
• FastTrack deployment engagement – Start your onboarding engagement with assistance from Microsoft
• FastTrack Productivity Library – Enhance organizational readiness with scenario based productivity resources
• Office 365 RoadMap – Get a view into the future updates for Office 365 ProPlus
• Ignite On-Demand – Review the latest deployment content for Office 365 ProPlus
• Ignite 2017 – See what is coming at this year’s Ignite conference

Thank you!

New feature: Make changes to Office deployments without changing the version

With the most recent release of the Office Deployment Tool (ODT) we have implemented a new feature based on customer’s feedback. Starting with version 16.0.11615.33602 it is possible to make changes to an existing installation of Office 365 ProPlus while keeping the installed version as is, even when a newer one is available on the Office CDN or in your network share/local folder.

Scenario

Let’s assume that you want to add e.g. a Language Pack to an installation of Office 365 ProPlus on a certain device in an automated fashion. We also assume, that the device is not on the most recent build of their update channel, e.g. the device is still on SAC 1803. Maybe there is still some testing to be done before SAC 1808 can be deployed across the organization.

The updated “version” handling allows you to add e.g. Language Packs, Proofing Tools, additional products (like Visio or Project) or apps without updating the installed build, even when a newer build is available in the source location (Office CDN or the specified source path).

In the past the ODT automatically updated the installation to the latest build while installing the specified product, Language Pack or Proofing Tool.

How to use

The usage of the new feature is straight forward. Instead of specifying a build number (like 16.0.9126.2356), you just specify “MatchInstalled”. This instructs the ODT to keep whatever build version is already installed.

Benefit

In the past we saw different workaround in order to pin the version. These ranged from manually updating the configuation.xml with the correct build number every time to custom scripts which injected the build number into the configuration.xml on the fly. The new feature allows you to retire such workarounds and use a consistent method across update channels and versions.

Sample XMLs

The following XML is an implementation example of the “dynamic, lean and universal packaging” concept, which greatly reduces effort and maintenance costs of install packages. The configuration file will install Project, match the languages to already installed Office products and keep everything else (architecture (x86/x64), update channel and version) as is:

<Configuration>
	<Add Version="MatchInstalled">
		<Product ID="ProjectProRetail">
			<Language ID="MatchInstalled" TargetProduct="All" />
		</Product>
	</Add>
</Configuration>

The following XML will add the German Language Pack and keep the architecture (x86/x64), update channel and version as is:

<Configuration>
	<Add Version="MatchInstalled">
		<Product ID="LanguagePack">
			<Language ID="de-de"/>
		</Product>
	</Add>
</Configuration>

Prerequisites

In order to use the new feature, the following prerequisites apply:

• Use Office Deployment Tool 16.0.11615.33602 or newer
• The feature is intended to be used when an existing installation is modified or something added to it. If no installation is present, “MatchInstalled” for “Version” will be ignored and the ODT will go through normal detection to install proper version. No hard error in such case.
• If you are not using the Office CDN as an installation source, make sure to have the matching source files in your specified source path. We recommend to leverage the Office CDN.

The Authors

This blog post is brought to you by   and , two ProPlus Rangers at Microsoft. We’re looking forward to your questions and feedback in the comments below.

Microsoft wants your ideas on end user adoption & engagement with Microsoft 365 & Office 365

Edit: Survey results as of August 6, 2019: Thank you to all who participated in the survey! Here are the top 5 takeaways from your responses:

• Who: Admins and adoption/change management teams start with support from decision-makers and leverage power-users.
• Challenges: Lack of time, executive support/budget, metrics, training resources, and the complexity of newer apps.
• Needs: Adoption statistics and product roadmaps to help plan, plus training in the form of business scenarios and short, guided tutorials and videos.
• MS Comms: It’s ok for Microsoft to communicate to end users only if admins/adoption teams can control/customize frequency and content.
• Portal: Admins/adoption teams want all content centrally stored and navigable for easy referral and use.

Survey request as of June 12, 2019: Microsoft is looking for IT professionals like you to provide feedback on end user adoption and engagement for Microsoft 365 / Office 365 through a brief survey. Topics include key challenges in your role, end-user adoption and engagement practices, and preferred communications from Microsoft. Your feedback will help drive the types of content Microsoft develops for you and your end-users.

To qualify for this survey, you must meet the following criteria:

• Your role involves end-user training / change management / adoption of Microsoft 365 & Office 365 applications
• You are not in government or education sectors
• Your organization has at least 150 employees / seats on Microsoft 365 & Office 365 subscription

Dynamically convert MSI versions of Project and Visio to Click-to-Run

With the latest release of the Office Deployment Tool (ODT) we have implemented a new feature based on customer feedback. It is now possible to make the installation of a C2R product dependent on the previous presence of an MSI-based product. As it works for all products, it is especially helpful when deploying Project and/or Visio to users which had it previously. The feature is known as MSI Condition.

Prerequisites
In order to use the new feature, the following prerequisites apply:
• Office Deployment Tool 16.0.11901.20022 or newer
• The feature is intended to be used when an Admin wants to migrate the user from Office/Project/Visio in one pass with one XML.
• If you are not using the Office CDN as an installation source, make sure to have the matching source files in your specified source path.
• MSI Condition will detect 2010/2013/2016 MSI products.

Scenario
Since the release of RemoveMSI we’ve had the capability for your “first install” to match the MSI version of Office and replace with Office 365 ProPlus. MSI Condition allows an admin to specify a list of MSI Product ID’s along with a Product ID for a Click-to-Run install such as Subscription, Standard Perpetual and Professional Perpetual.

How to use
To use this feature simply add the MSICondition attribute to the Product node as shown in the example below. Once you have created the XML run setup.exe /configure like you would with any other installation process and that’s it

Benefit
In the past customers created very complex scripting to detect and replace Office products, in some cases running the install up to three times based on the number of previous products detected. We have even seen customers simply ignore Project and Visio and remove everything, then wait for helpdesk to get a call and replace it with the version the end user requested. MSI Condition makes your migration from MSI to C2R flow smoothly with one XML for your deployment which dynamically adjusts to the task at hand.

Please note that the above picture shows a simplified XML(in the image) to just show the concept behind it. For a fully working XML, please refer to the next section.

Sample XML
The following XML will
• install Office 365 ProPlus from Monthly channel, and match the previously installed languages
• install Visio Pro on machines that already have any older MSI version of Visio Pro
• install Project Pro on machines that already have any older MSI version of Project Pro
• remove all older MSI versions of Office, Project and Visio

<Configuration>
<Add Channel=”Monthly” OfficeClientEdition=”64″>

<Product ID=”O365ProPlusRetail”>
<Language ID=”en-us”/>
<Language ID=”MatchPreviousMSI”/>
<ExcludeApp ID=”Groove”/>
<ExcludeApp ID=”OneNote”/>
</Product>

<Product ID=”VisioProRetail” MSICondition=”VisPro,VisProR”>
<Language ID=”en-us”/>
<Language ID=”MatchPreviousMSI”/>
<ExcludeApp ID=”Groove”/>
</Product>

<Product ID=”ProjectProRetail” MSICondition=”PrjPro,PrjProR”>
<Language ID=”en-us”/>
<Language ID=”MatchPreviousMSI”/>
<ExcludeApp ID=”Groove”/>
</Product>

</Add>
<RemoveMSI/>
</Configuration>

Is this limited to Visio and Project?
No, it is not. The feature will accept any valid product ID for Click-To-Run and any MSI code as a condition. So, you can mix and match to your specific needs you could also build a deployment which installs e.g. Access Runtime for existing users of it:

<Configuration>
<Add>
<Product ID=”O365ProPlusRetail”>
<Language ID=”en-us”/>
<Language ID=”MatchPreviousMSI”/>
<ExcludeApp ID=”Access”/><
</Product>
<Product ID=”AccessRuntimeRetail” MSICondition=”AccessRT”>
<Language ID=”en-us”/>
<Language ID=”MatchPreviousMSI”/>
</Product>
</Add>
</Configuration>

The Authors
This blog post is brought to you by @Matt Philipenko (OFFICE PFE)  and @Martin Nothnagel , two senior ProPlus deployment experts at Microsoft from the Services organization. We’re looking forward to your questions, feedback and comments below.

Office 365 Home and Personal Licensing and Activation Improvements

Since launching Office 365 to consumers, we have heard feedback from customers about the challenges in installing and using their office subscription across multiple devices. The first step in addressing this issue happened in October 2018, increasing a single user’s device limits to five (meaning they can concurrently use five devices) for Office 365 Home and Office 365 Personal. Our next step in simplifying use across multiple devices will streamline the activation of a user’s device.

Beginning in May, we rolled out the following changes to customers on PCs, followed by Mac devices in July.

For customers, here’s what stays the same:

• Sign in to activate Office: Users will continue to sign in to activate Office on their devices. When single sign-on is enabled, Office detects the user’s credentials and activates Office automatically.
• Sign-in limits: Users will be able to install Office 365 on all their devices and be signed in to five at the same time. This includes any combination of PCs, Macs, tablets, or phones.

It’s important to stay signed in while you use Office on your device. This is what keeps your Office installation activated and ready to use.  

Here are the changes that you may notice:

• No more prompts to deactivate: Users can install Office on a new device without being prompted to deactivate Office on another device.
• Automatic sign-out: When a user reaches the sign-in limit (five devices), instead of being prompted to deactivate, the user will be automatically signed out of Office on the device where Office has been least recently used. The next time the user starts Office on that device, the user will be prompted to sign in to activate Office.

For more information on how sign-in works on devices where Office 365 is licensed, please visit this support article: https://support.office.com/en-us/article/how-sign-in-works-in-office-365-1d646e83-1585-4278-8daf-d4a2cc0905e0

Office 365 Client Licensing and Activation Improvements

Edit: July 30, Availability dates updated to reflect schedule.

Over the years, we’ve heard feedback from customers and IT Admins about the difficulty in managing Office activation for subscription-based Office clients, such as Office 365 ProPlus. We’re excited to announce upcoming changes to Office that will help simplify activation management and streamline the Office activation experience for users.

In August, we’ll start slowly rolling out these changes to commercial customers on Monthly Channel. The roll-out will continue to Semi-Annual Channel (Targeted) in January 2020.

For your users, here’s what stays the same:

• Sign in to activate Office: Users will continue to sign in to activate Office on their devices. When single sign-on is enabled, Office detects the user’s credentials and activates Office automatically.
• Sign-in limits: Users can sign in to activate Office on five desktops, five tablets, and five mobile devices.

Here are the changes that your users may notice:

• No more prompts to deactivate: Users can install Office on a new device without being prompted to deactivate Office on another device.
• Automatic sign out: When a user reaches the sign-in limit, instead of being prompted to deactivate, the user will be automatically signed out of Office on the device where Office has been least recently used. The next time the user starts Office on that device, the user will be prompted to sign in to activate Office.

Here are the changes that you as an admin may notice when managing devices where Office is installed:

• Improved device reallocation: Previously, users who received reallocated devices could receive an error if the previous user deactivated the device from the portal or if you removed the Office 365 license from the previous user. Going forward, users will not receive the error because the activation and deactivation is user specific.
• Improved activation reporting: Previously, when one user activated Office on a device and a second user later signed on to that device, the second activation was not displayed in the Admin Center’s Activation Reports. Going forward, both activations will be identified and displayed in the Activation Report.

Keep an eye out for these improvements as we start to slowly roll them out for our commercial customers. No additional action is required on your part.

Recommended Documents in Office apps and Version History in Office for the web

We are committed to ensuring that the collaboration experience in Word, Excel, and PowerPoint is great for you. This includes ensuring that you can work confidently with others in a shared document and get back to your work quickly. Thus, we are bringing Recommended Documents to the Office apps and Version History to Office in the web. 

We introduced the Recommended Documents section to Office.com and Office on the web in October 2018 which surfaces a curated set of Word, Excel, and PowerPoint documents that may be of interest to you. Using activity signals from across Office 365 such as files in which you are @mentioned, documents others have edited, and those shared with you, we pull together suggested documents to minimize the time you spend searching for the right file. We’re bringing this capability to the Office apps on your iOS and Mac devices now, and we will be rolling this out to Win32 over the next few months.

Once you’re in a shared document, we want to ensure that you feel confident making changes. Version History lets you see what changes have occurred and revert back if necessary. You’ve always been able to see the previous versions of your document in Word, Excel, or PowerPoint desktop and mobile apps, by going to File > Info > Manage Document. But did you know you can also click on the title bar at the top of your document and select Version History to see who edited your file and how the file has evolved over time? Click on “open version” to see the previous version of the document and compare edits or restore changes.

We’re bringing Version History to PowerPoint on the web in June, and will be rolling it out to Word and Excel on the web over the next few months. So if you prefer to work from the browser, you can easily return to earlier versions of the document.

Save your Office deployment configurations to the cloud

Keeping to our promise of continuous innovation and improvements to make Office deployment easier, our team released a new feature that allows you to save the deployment configurations that you create in the cloud.  This allows you to create, edit and access your deployment configurations from one central location, your Office 365 tenant.

Not only can you save your deployment configurations, but you can access them directly using an anonymous URL that can be copied from each deployment configuration and used with the Office Deployment Tool.

This allows you to skip the step of downloading the XML and just reference it directly on the command line when executing the /configure, /download or /customize commands.  The Office Deployment Tool will access the XML directly from your tenant using the anonymous access URL.

Note: The current version of the Office Deployment Tool does not support the anonymous URL.  The next version of the Office Deployment Tool will include this feature and we expect to release the next ODT the beginning of July 2019.

For more information and a demonstration of this new capability take a look at the new video posted on the Office Deployment insider’s channel

https://www.youtube.com/watch?v=nPuzsyKWcTE

Cheers,

Chris Hopkins

PM – Office Team

Office 365 helps you get back to work, now with improved brand customization

In today’s modern workplace, people use many different apps, services, and tools to identify what’s their most important work to complete. Valuable time is wasted looking for the most recent content, like searching for new comments in one’s documents, and the most relevant tools just to get started working. Office.com and the new Office app released on Windows help you get started and back to work more efficiently by pulling together your most relevant apps, including third-party apps your company uses, documents, and places where you and your colleagues are working. Additionally, we continue to make improvements to capabilities that are available across the entire system including modernization the customization available to admins in order to represent their company and school brand.
Check out the video below to learn more and share it with your users to help them adopt a more efficient way to get started in Office 365.
Video: Getting started with Office.com

More flexible image sizes and formats are now supported to show your company or school logo in the Office 365 navigation bar 

We are modernizing your custom theming experience to help you represent your company or school brand with a higher quality logo across Office 365. Now, you’ll be able any file size and any format to improve the clarity of the logo image that your users see in the Office 365 navigation bar across their Office applications, like Outlook, SharePoint and Office.com.

For more information about setting your organization’s theme in Office 365 please visit here.

Visit www.office.com to try out the new experiences.

For more information about the new Office app see here. 
Stay up to date on the latest news and features for Microsoft 365 and join the conversation in the Microsoft 365 Tech Communities.

Announcing 3D Content Guidelines for Office 365

Since 3D was first introduced in Office, we’ve heard resounding feedback from the community that better guidance was needed to help users acquire, build and convert 3D content for use in Office. Whether you are an Office user looking to acquire 3D assets for your documents, or a 3D professional creating content for your clients, we are pleased to announce that the 3D Content Guidelines for Microsoft are now publicly available, and have been developed to help users be more successful with 3D in Office.

Download the guide in PPT format
Download the guide in PDF format

Customer connections were the key to defining the scope of what the guidelines cover. These connections gave us the opportunity to understand the friction points first-hand, provide immediate support to keep customers moving forward, and roll those learnings back into the guidelines.

The 3D Content Guidelines for Microsoft are split into four major sections and can be read in sequence or independently depending on what you would like to accomplish.

3D engine overview
Learn about the inner workings of the real-time 3D engine used in Office and how it compares to other methods of rendering 3D content.

Sourcing assets
Learn tips and tricks for finding quality 3D content in online marketplaces and best practices when working with third party vendors to build custom 3D assets.

Content creation
Step through the process of creating custom 3D content for real-time rendering in Office. From modelling, surfacing and animation guidance for new content, to exporting, converting and optimizing existing 3D content, this section will help to ensure that 3D assets targeted for Office will render optimally.

Additional Resources
Discover tools for viewing, analyzing and validating your 3D content as well as links to other valuable resources.

While today’s version of the guidelines is focused on Office, the vision is to expand the scope and include other Microsoft products and services in the future. We believe these guidelines will be a good connection point between many of the great existing resources and look forward to continuing to evolve them to meet the growing needs of all our users. Please check them out!

Download the guide in PPT format
Download the guide in PDF format

The new cloud-based policy management service for Office 365 ProPlus has been released!

The Office cloud policy service allows administrators to define policies for Office 365 ProPlus and assign these policies to users via Azure Active Directory security groups.  Once defined, policies are automatically enforced as users sign in and use Office 365 ProPlus.  No need to be domain joined or MDM enrolled and works with corporate owned devices or BYOD.

Get started today by visiting and signing into the Office cloud policy service

• Build a policy configuration that includes the policies you want to enforce, configured for your organization’s needs.  The service is always up to date and includes the latest policies as they are released.
• Target a group of users by assigning the policy configuration to a specific AAD security group.
• Policies automatically enforced as users sign into Office 365 ProPlus.
• Health reporting available for each of the policy configurations, letting administrators know that the policies are getting deployed to users and their devices.

  

   

This service is now generally available and supported for all Office 365 ProPlus customers.  If you are an administrator, you can start using this service today by signing into the Office client management portal and creating policy configurations.

We are also excited to announce the public preview for the security policy advisor feature; an intelligent policy recommendation engine being added to the Office cloud policy service.  Click here for more information on the security policy advisor feature.

This service is just one of many new services which the Office team will be releasing over the next 12+ months.  These services, which shape the foundation of the Office serviceability SDK, are designed to work with 1^st and 3^rd party management solutions to help administrators simplify and streamline Office deployment and management.

For additional documentation on how to use this new policy service and its capabilities take a look at this document.

As always, please provide feedback using the feedback button to help us improve the service.

FAQ:

1. Does the Office client policy service replace Group Policy management options?
   No, this service provides an alternative to Group Policy management. Group Policy management enforces policies on Windows PCs joined to an Active Directory domain, while the Office client policy service only requires the user sign into Office using their corporate credentials (Azure Active Directory) along with a valid Office 365 ProPlus license.
2. What are primary differences between the types of policies I can enforce using Office client policy service compared to Group Policy?
   Office client policy service manages only user-based policies for Office 365 ProPlus. Group Policy can manage both user-based and machine-based policies.
3. How does the Office client policy service compare with the Office Customization Tool for Click-to-Run’s application preferences settings?
   The settings configured as part of Office installation using the Office Customization Tool for Click-to-Run – as well as previous OCT versions – are based on ‘preferences’, meaning that a user can change them. Office client policy service settings are enforced, like Group Policy enforcement.
4. If I use Group Policy Management and the Office cloud policy service, how will conflicts be resolved?
   The policies configured in the Office cloud policy service take precedence over any policies configured via Group Policy Management. If there are conflicts, the values specified in the Office cloud policy service for the conflicting policies will be honored.

5. Can I import policies from Group Policy Management to Office cloud policy service?
   At this time we do not have import capabilities, but we are looking at providing this functionality to help admins migrate.
6. How is this different from the Administrative Templates feature in Intune for Device configuration
   The Office cloud policy service is built specifically for managing Office policies in non-domain joined and non-MDM managed scenarios.  Office cloud policy service is available to any customer that owns Office 365 ProPlus.  If used with Intune, the policies configured in Office cloud policy service take precedence over any Office policies managed via Intune.

5 steps to get you collaborating more effectively in Office 365 Word, Excel, and PowerPoint

With last month’s Twins Challenge, we shared a few time-saving tips for Word, Excel, and PowerPoint. Today, we’re following up with a few ways to get you started collaborating in your documents.

1. Create and save your documents to the cloud by default. Whether you plan to work on a document with others or simply share it for review, your documents are safer when saved to the cloud.

Create and save your documents to the cloud by default

Now, when you go to save a new Word, Excel, or PowerPoint file in the desktop app using Ctrl-S (Windows), Cmd-S (macOS), or the Save button in Office, a new dialog will default to OneDrive or SharePoint Online and allow you to quickly set the filename and location. Once saved to the cloud, you can access the file across your devices.  

And when you forget to save a new document before exiting, you’ll see an updated save experience directing you to the cloud. And because documents are saved to the cloud, you can work with others, like real-time co-authoring, from the get go.

Turn on AutoSave so you never have to worry about saving changes to your document.
Once a document is in the cloud, AutoSave takes over to regularly sync your documents to the cloud. With AutoSave, you don’t have to worry about hitting save or losing changes since edits are saved automatically.

If the AutoSave toggle is turned off, flip it to “On” and store your file in OneDrive. It saves your file so that you don’t have to.

For those using Office in the browser, your files are already being saved automatically!

And if you are still saving files to your computer’s hard drive, you are leaving your documents vulnerable to device theft or destruction. Use Known Folder Move to easily backup and sync your desktop documents and folders to OneDrive, making OneDrive the default location for those files.

2. Once in a shared cloud document, you can co-author and even assign tasks using @mentions.

Share Office 365 documents with others to co-author the document together.

Stop spending time merging changes from coworkers into one document or sifting through emails for versions of a file. Simply share the Word document, Excel spreadsheet, or PowerPoint presentation with collaborators and work together.

Once a cloud file is shared, you can work in the file on your own time or with multiple collaborators simultaneously. If you’re editing together in real time, you’ll see others’ changes in real time. Co-author with others on any device that works best for you – web browser, desktop, or mobile.

Collaborate with your team by using @mention and threaded comments to have a conversation right next to the relevant content in Excel, Word, and PowerPoint.

Threaded comments and @mentions ensure that you always have context on what’s going on and enable you to easily have conversations about specific content with collaborators.

To @mention someone, type “@” and the person’s name in the comment. This is an efficient way to get their attention because they will get notified via email to take action. And rolling out to Word, you will be able to assign tasks to others using @mentions.

*Threaded comments is available across Word, Excel, and PowerPoint on the desktop apps, web, and mobile.
**@mention is rolling out across Word, Excel, and PowerPoint. @mention is now available in Office Online, Office for iOS, Office for Android, and for Office Insiders on desktop. 

***To-dos is currently available for Word on the Mac for Office Insiders (Fast).

3. Work together with confidence in a shared document.

See what’s changed in your PowerPoint presentation while you were away.

If you’re collaborating on a deck with others, you can see who made new changes, quickly get up-to-speed and start working. You no longer need to scroll through the whole deck to see what’s changed or painstakingly compare slides side-by-side. We’ll tell you if someone has made changes to the slides while you were away and highlight the things that have changed.

*This feature is available in PowerPoint client app and on the web now.

Set your file to Read-Only and set the context for how collaborators’ interact with the file.

Want to share a document with a colleague but avoid accidental changes? You can set permissions on a shared document to “Restrict Editing” or “Always Open Read-Only”. By flagging the document as read-only, you are letting collaborators know not to make unintentional edits. 

If the file is finalized, you may also want to consider applying “Mark as Final”.

Feel confident making changes in a shared document. Version History lets you see what changes have occurred and revert back if necessary

If a document is being used as a basis for a new document, users should always Save a Copy first to avoid changing the original file.

If you forget and make changes to the original file while AutoSave is on, no need to worry. You can easily restore a previous version through Version History. To see the list of previous versions of your files, you can go to File > Info > Manage Document.

You also have the option to click on the title bar at the top of your document and select Version History to see who edited your file and how the file has evolved over time. Click on “open version” to see the previous version of the document and compare edits or restore changes.

4. For existing documents, find and work on them on the web, mobile, or desktop, wherever you prefer. 

Find documents you’ve been collaborating on or share them with others from Office.com or the new Office app for Windows 10.

Office.com and the recently released Office app for Windows 10 are great ways to get started with Office and jump quickly into your work. In the documents section, you can easily find the documents that you have used most recently, pinned for easy access, or shared with others. And, we curate a list of recommended shared documents so that you can spend less time looking for what you need and more time getting things done.

Open file links in the Word, Excel, or PowerPoint desktop applications to start working where you prefer
If you are in the Office desktop apps and click on an Office 365 document link that others have shared with you, the file will open directly in the Office desktop apps instead of the web. This option to open files in the Office desktop apps will save you time by taking you to your preferred starting location.

If you prefer using Office on the web, your Word, Excel, and PowerPoint files will continue opening in the browser.

*This feature is rolling out to Word, Excel, and PowerPoint desktop applications over the next few months.

5. Don’t have an Office 365 subscription? You can give Office a try at Office.com.

For consumers, you can get started for free with Word, Excel, and PowerPoint on the web by signing in or creating an account at Office.com.

Once you have an account created, you can get started working in the web browser at Office.com and even work on documents with collaborators (including those who are not using Office).

Find more Office tips and tricks here.

Now available: Multi-Geo in SharePoint and Office 365 Groups

Updated March 27, 2019

Today, we’re thrilled to announce the General Availability of Multi-Geo Capabilities in SharePoint Online and Office 365 Groups. The functionality has been in preview, and thanks to the invaluable feedback from our preview customers, it’s now ready for prime time.

Multi-Geo in SharePoint and Groups enables global businesses control the country or region where shared resources like SharePoint Team Sites, Office 365 Groups content (associated SharePoint Sites and Groups mailboxes) are stored at-rest.

Earlier this year we launched Multi-Geo in Exchange Online and OneDrive, giving control over the geo-location of user-attached resources like user’s mailbox and OneDrive files.

With more data residency measures being legislated around the world for cloud data, global businesses are challenged with meeting their data residency requirements and digitally transforming with the cloud.

Multi-Geo addresses these challenges by enabling a single Office 365 tenant to span multiple regions and/or countries and giving customers the flexibility to choose the country or region where each employee’s Office 365 data is stored at-rest. This helps businesses meet their global data residency needs and digitally transform with Office 365.

Configuring Multi-Geo in SharePoint

Setting up and managing Multi-Geo is now available through the SharePoint admin center.  Simply click ‘Add location’ and select the needed satellite geo and then pick a namespace URL. New sites created by users are automatically created in the geo where their PreferredDataLocation (PDL) was established.  See more about managing PDL with Azure AD Connect at aka.ms/PDL

For your global workforce, the digital transformation means that every employee is empowered with a modern productivity experience in Office 365.

Global SharePoint Home experience

With SharePoint Multi-Geo, satellite geos now get the rich SharePoint Online functionalities in addition to the OneDrive functionalities. SharePoint Home experience shows a curated list of News roll-up and Suggested sites powered by the intelligence of the Office graph, which analyzes the activities and signals from across the global organization and tailors a list for every user.

SharePoint Home

New site creation in the user’s geo

Team sites and Communications sites creation experience automatically detects the user’s configured geo-location and triggers sites creations in the corresponding geo.

New sites automatically created in the user’s geo

Hub site is Multi-Geo aware

SharePoint Hub sites enhances the discovery and engagement with content for employees, while creating a complete and consistent representation of projects, departments or regions. With SharePoint Multi-Geo, sites from Satellite geos can easily be associated with a hub site regardless of which geo the hub site is hosted in. This makes it easy for employees to tailor their business units needs through hubs while at the same time being part of One Enterprise. Employees can search and get results across the hub through a single search experience, regardless of in which geo the sites are located at-rest.

SharePoint Hub Site experience

Mobile

For employees on the go, the same great productivity experience is available on rich mobile apps for SharePoint, OneDrive and Outlook. Employees simply sign in with their Office 365 credentials and access content in their Multi-Geo enabled Office 365 tenant, they don’t need to remember any geo specific URLs or other information.

SharePoint Mobile with sites and people from around the world

Managed metadata

For organizations that use taxonomy enterprise managed metadata to organize their sites and contents, Multi-Geo enables an easy way to centrally manage metadata in a central location and behind the scene these get replicated to all the satellites and ready to use in satellite sites. This doesn’t require any additional customization.

Rollout

Multi-Geo for SharePoint Online and Exchange Online Groups is now rolled out to all Office 365 tenants enabled with the Multi-Geo feature. Please see https://aka.ms/GoMultiGeo for details.

Pricing

Multi-Geo in SharePoint Online and Groups is included with the existing Multi-Geo offering. Please see https://aka.ms/GoMultiGeo for further details or contact your Microsoft representative.

Resources

• Admin Guide: https://docs.microsoft.com/Office365/Enterprise/office-365-multi-geo
• Introducing SharePoint Online and Groups Multi-Geo at Ignite 2018: https://myignite.techcommunity.microsoft.com/sessions/65756
• Multi-Geo Mechanics videos: https://www.youtube.com/watch?v=_Sk8mO0bLnE&t=105s

Announcing the new cloud-based policy management service for Office 365 ProPlus

Today we are pleased to announce the preview of the Office cloud policy service to help administrators manage policies for all Office 365 ProPlus users in their organization, from an easy-to-use, Internet-based portal focused on Office 365 ProPlus management.

Office 365 ProPlus allows users to access full Office experiences from multiple Windows devices. These may be managed or MDM-enrolled devices, but are often also personally-owned and unmanaged. Now with the Office cloud policy service, you can define and enforce Office policies without the infrastructure or MDM services traditionally required.

The Office cloud policy service allows administrators to define policies for Office 365 ProPlus and assign these policies to users via Azure Active Directory security groups.  Once defined, these Office policies are automatically enforced as users sign in and use Office 365 ProPlus.

• Build a policy configuration that includes the policies you want to enforce, configured as needed for your organization’s needs.  The service is always up to date and includes the latest policies as they are released. 

• Target a group of users by assigning the policy configuration to a specific AAD security group. 

• Policies automatically enforced as users sign into Office 365 ProPlus.

  

   

This service is now available as a preview for all organizations with Office 365 ProPlus.  If you are an administrator, you can start using this service by signing into the Office client management portal and creating Office cloud policy configurations.  As you evaluate this preview, please provide feedback using the feedback button (in the upper right corner) to help us improve the service.

For a guided walk-though of this new service, take a look at a this video which also includes a deep dive into the Office Customization Tool.

For additional documentation on how to use this new policy service and its capabilities take a look at this document.

FAQ:

Does the Office cloud policy service replace Group Policy management options?
No, this service complements Group Policy-based management as another option. Group Policy management enforces policies on Windows PCs joined to an Active Directory domain, while the Office cloud policy service only requires Azure Active Directory sign-in as part of Office 365 ProPlus.

What are primary differences between the types of policies I can enforce using Office cloud policy service compared to Group Policy?
Office cloud policy service manages user-based policies for Office 365 ProPlus. Group Policy can manage both user-based and machine-based policies.

How does the Office cloud policy service compare with the Office Customization Tool for Click-to-Run’s application preferences settings?
The settings configured as part of Office installation using the Office Customization Tool for Click-to-Run – as well as previous OCT versions – are based on ‘preferences’, meaning that a user can change them. Office cloud policy service settings are enforced, similar to Group Policy enforcement.

Is an Intune subscription required?

No.  It is not required that the tenant have an Intune subscription.  This is a feature of Office 365 ProPlus and only requires that the tenant have a subscription that includes Office 365 ProPlus.

Does this work with all Office Click-to-Run products?

No.  This is a feature of Office 365 ProPlus and only works with the Office apps that are deployed as a part of the Office 365 ProPlus suite.

Does this new policy service support all the policies from the Office ADMX templates?

No.  Currently this preview is limited to a subset of the user based policies defined in the ADMX templates.  All machine based policies are not included.

Which admin roles are allowed access to configure policies?

Only the Global Admin, Security Admin or Desktop Analytics Admin (private preview) roles are allowed access to create or view policy configurations.

Save your files to the cloud more easily

To protect against device loss or damage and to provide anywhere access to files, we recommend storing them in Office 365. Last June we announced Known Folder Move (KFM) in OneDrive for customers on Windows 7, 8.1 and Windows 10. Known Folder Move provides an easy way to redirect your desktop documents and folders to OneDrive, making OneDrive the default location for those files. With KFM, your content is automatically synced to OneDrive with no disruption to productivity.

Today we are announcing a new capability that makes it easier for you to create and save your Word, Excel, or PowerPoint document directly to the cloud. When you go to save an Office365 document using Ctrl+S (Windows), Cmd+S (macOS), or the Save button, the new dialog box will default to OneDrive or SharePoint Online. And if you forget to save a new document before exiting, you will also see this updated save experience.

Once a document is saved in the cloud, you can easily rename the file and change the location from the title bar. This ability to save your document to the cloud directly from Word, Excel, or PowerPoint will roll out to Office 365 on Windows and Mac beginning in February. 

These features, along with OneDrive Files On-Demand for Mac, are part of our investments in making it easier for you to get your files into the cloud. By saving to the cloud, you will be able to securely access your most important documents from any device and start collaborating with others from the get go.

Multi-Geo India satellite geo available in December 2018

We’re thrilled to announce that all customers using Multi-Geo Capabilities in Office 365 will soon be able choose India as a satellite geo-location to store their users’ Exchange Online Mailboxes and OneDrive for Business files at-rest, and address their global data residency needs. Once SharePoint Multi-Geo is generally available, it will also include the India geo.

We’re in the process of rolling out the India geo to all Multi-Geo enabled Office 365 tenants. In the next few weeks, Multi-Geo customers will get a Message center notification in Office 365 indicating that the India geo available. After that, simply set the “PDL” to “IND” to trigger the move of mailboxes and OneDrive files to the India geo. Read more on configuring Multi-Geo at aka.ms/ExchangeMultiGeo and aka.ms/OneDriveMultiGeo.

This means Multi-Geo is available in 10 geos across Microsoft’s massive global data center footprint. Learn more about Multi-Geo at aka.ms/GoMultiGeo