Home intune macos microsoft 365 silent updates

Silent Microsoft 365 Updates on macOS via Intune: What You Need to Know

Updated: • 0 • min read
Table of Contents

Silent Microsoft 365 Updates on macOS via Intune

Managing software deployments and updates across an organization’s devices is a critical task for IT administrators. For organizations leveraging Microsoft Intune to manage macOS devices and deploy Microsoft 365 applications, ensuring a smooth and predictable update process is essential for user productivity and security. However, some administrators have encountered an issue where Microsoft 365 apps on macOS devices update silently, closing unexpectedly without prior notification, leading to potential disruption for end-users.

Understanding the Issue

Users on macOS devices managed by Microsoft Intune may experience Microsoft 365 applications (such as Word, Excel, PowerPoint, Outlook, Teams) closing abruptly. Following this unexpected closure, the applications often update automatically and then restart. This behavior is problematic because it bypasses the standard update notification process that users are accustomed to, which typically provides warnings about upcoming updates and allows users to save their work before the application closes for installation.

The standard behavior for Microsoft AutoUpdate (MAU) on macOS, when configured correctly, is to provide notifications to users when updates are available or required. These notifications often include options to install updates immediately or postpone them until a later time or a specific deadline. The absence of these notifications and the sudden closure of applications can be disruptive, potentially leading to unsaved work being lost and frustrating users.

This issue specifically occurs within environments where Microsoft Intune is utilized to deploy and manage Microsoft 365 applications on macOS. Intune provides a robust framework for deploying application suites and managing their settings through configuration profiles. When these profiles are not configured optimally, they can inadvertently lead to the silent update behavior observed.

Root Cause Analysis

Investigations into this unexpected silent update behavior point primarily to conflicts or misconfigurations within the settings controlling Microsoft AutoUpdate (MAU) on the macOS devices. MAU is the utility responsible for keeping Microsoft applications on macOS up to date. Its behavior can be managed through preference files, which administrators can configure and deploy using management tools like Microsoft Intune.

The core of the problem often lies in how these MAU settings are applied to the devices. There are two primary scenarios that commonly lead to the silent update issue:

  1. Deployment of Multiple Conflicting Configuration Profiles: In complex IT environments, administrators might inadvertently deploy more than one configuration profile targeting the same macOS devices. If these profiles contain differing or conflicting settings for Microsoft AutoUpdate, the device’s operating system and MAU may struggle to reconcile these instructions. This conflict can result in unpredictable behavior, including the bypass of user notifications and unexpected application closures for updates. Each profile might attempt to enforce a different update frequency, notification preference, or update channel, creating a situation where MAU cannot adhere to a single, clear set of instructions.

  2. Overly Granular Settings within a Single Profile: Alternatively, the issue can arise even when only a single configuration profile is deployed, if that profile contains a large number of highly specific MAU settings. While a single profile avoids inter-profile conflicts, including numerous settings targeting individual Microsoft 365 applications (e.g., separate settings for Word, Excel, Outlook) rather than applying settings suite-wide, can still lead to complexity and potential misinterpretation by MAU. MAU is designed to handle general suite-level settings efficiently. When faced with many specific, app-by-app settings, especially if they are not perfectly harmonized, it can sometimes result in the default or unexpected update behavior overriding the intended configuration, leading to silent updates.

Effectively, both scenarios lead to a situation where the intended MAU configuration (which would normally include user notifications and grace periods) is not correctly or consistently applied, causing MAU to proceed with updates without the user interaction that is typically expected.

Resolving the Issue

Addressing the silent update issue requires a focused approach on rationalizing and simplifying the configuration settings applied to Microsoft AutoUpdate via Microsoft Intune. The key is to ensure that MAU receives a clear, consistent, and unified set of instructions.

If your organization has deployed multiple configuration profiles containing settings for Microsoft AutoUpdate to the affected macOS devices, the primary resolution step is to consolidate these settings. Identify all profiles that manage MAU preferences (com.microsoft.autoupdate2 domain is commonly used for this). Review the settings within each of these profiles. The goal is to extract the desired MAU configuration and incorporate it into a single, comprehensive configuration profile. Once the consolidated profile is ready and assigned to the target devices, the redundant, conflicting profiles must be removed or unassigned from those devices. This ensures that MAU on the macOS client receives its instructions from only one authoritative source via Intune.

Furthermore, within the single, consolidated configuration profile, it is highly recommended to simplify the MAU settings themselves. Instead of defining numerous specific update settings for each individual Microsoft 365 application (Word, Excel, Outlook, etc.), configure only those MAU settings that are designed to apply universally to all applications within the Microsoft 365 Apps for macOS suite. Microsoft provides specific preference keys for MAU that are intended for suite-wide management. Focusing on these general keys reduces the complexity of the configuration profile and minimizes the chances of unintended interactions or conflicts between settings meant for different applications.

By adopting a single, well-defined configuration profile with general MAU settings, administrators can establish a predictable update policy for Microsoft 365 apps on macOS. This approach helps ensure that MAU behaves as expected, including presenting users with appropriate notifications before initiating updates, thereby preventing disruptive, silent closures and restarts.

Implementing the Resolution in Intune

Implementing the resolution involves creating or modifying a macOS configuration profile in Microsoft Intune. This process typically involves using the Settings catalog or a custom profile with a Property List (.plist) file.

Using the Settings Catalog

The Settings catalog is generally the easiest method to configure MAU settings in Intune as it provides a searchable interface for many macOS preferences.

  1. Navigate to Devices > macOS > Configuration profiles.
  2. Click Create profile.
  3. Select Templates as the Profile type and Settings catalog as the Template name, then click Create.
  4. Give your profile a descriptive name (e.g., “macOS - Microsoft AutoUpdate Configuration”).
  5. In the Configuration settings tab, click Add settings.
  6. Search for settings related to “Microsoft AutoUpdate”. You will typically find these under domains like Microsoft AutoUpdate.
  7. Add the desired MAU settings. Common settings you might want to configure include:
    • UpdateCheckFrequency: Defines how often MAU checks for updates (e.g., 86400 seconds for daily).
    • HowToCheck: Specifies the update method (Automatic is common for managed environments, allowing automatic downloads and prompting the user for installation).
    • UpdateDeadline: Sets a mandatory deadline for installing updates after they are found (specified in seconds). This is crucial for enforcing timely updates while still providing a grace period.
    • DisableInsiderCheckbox: Prevents users from opting into Insider channels, ensuring they stay on the standard update channel managed by IT.
  8. Configure the selected settings according to your organization’s update policy. Ensure these settings apply generally to the Microsoft 365 suite rather than trying to find settings specific to individual apps unless absolutely necessary and documented.
  9. Assign the profile to the appropriate macOS user or device groups.
  10. Review and create the profile.

Using a Custom Configuration Profile (Preference File)

If the Settings catalog doesn’t include all necessary keys, or if you prefer using a .plist file, you can create a custom configuration profile.

  1. Create a .plist file containing the desired MAU preference keys and values within the com.microsoft.autoupdate2 domain. An example structure might look like this:

    <?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>UpdateCheckFrequency</key>
    <integer>86400</integer>
    <key>HowToCheck</key>
    <string>Automatic</string>
    <key>UpdateDeadline</key>
    <integer>604800</integer> <!-- 7 days -->
    <key>DisableInsiderCheckbox</key>
    <true/>
</dict>
</plist>

    Note: This is an example. The exact keys and values should be determined based on Microsoft’s documentation for managing MAU.

  2. Navigate to Devices > macOS > Configuration profiles.

  3. Click Create profile.
  4. Select Templates as the Profile type and Custom as the Template name, then click Create.
  5. Give your profile a descriptive name.
  6. In the Configuration settings, provide a Configuration profile name (e.g., com.microsoft.autoupdate2) and upload the .plist file you created.
  7. Assign the profile to the appropriate macOS user or device groups.
  8. Review and create the profile.

After deploying the single, consolidated configuration profile, ensure that any previously deployed profiles managing MAU settings on the same devices are removed or unassigned. It may take some time for the profile to apply to the devices, and a restart of the Microsoft 365 applications or the macOS device might be necessary for the new settings to take full effect.

More Information and Best Practices

Effective management of Microsoft 365 updates on macOS through Intune goes beyond just resolving conflicts. Consider the following best practices:

Testing Deployment

Before deploying the consolidated configuration profile to your entire organization, deploy it to a small pilot group of test devices and users. Monitor these devices to ensure that MAU settings are applied correctly, notifications appear as expected, and updates install without causing disruption. Gather feedback from the pilot users.

User Communication

Clearly communicate your organization’s update policy and the expected update experience to your users. Inform them about how and when they will receive notifications for Microsoft 365 updates and what actions they should take. This proactive communication helps manage user expectations and reduces help desk calls.

Monitoring and Compliance

Utilize Intune’s reporting features to monitor the compliance status of your macOS devices regarding configuration profiles. Ensure that the MAU configuration profile is successfully applied to all target devices. You can also monitor application versions installed on devices to track update progress.

Troubleshooting on Client Devices

If issues persist on specific devices, you can troubleshoot locally on the macOS client. Configuration profiles managed by Intune are stored as property list files in /Library/Managed Preferences/<Your_Company_Identifier>/. You can also use the defaults read command in Terminal to inspect the applied MAU settings. For example:

defaults read com.microsoft.autoupdate2

This command will show the current settings read by MAU from the preference file, which should reflect your Intune configuration. Additionally, checking the Console logs for entries related to Microsoft applications or osasagent (macOS Software Update agent, sometimes involved with MAU) can provide clues.

Understanding MAU Preference Keys

Familiarize yourself with the common preference keys available for configuring Microsoft AutoUpdate. While the Settings Catalog simplifies this, understanding the underlying keys is helpful for troubleshooting and custom configurations. Here are a few common keys:

Key Name Data Type Description Example Value
UpdateCheckFrequency Integer How often MAU checks for updates in seconds. Minimum is 3600 (1 hour). 86400 (Daily)
HowToCheck String Determines the update process: Automatic (downloads, prompts), Manual (user checks), AutoDownload (downloads, prompts more forcefully?). Automatic is standard. "Automatic"
UpdateDeadline Integer Forces update installation after a specified number of seconds from when the update becomes available. Set to 0 to disable deadline. 604800 (7 days)
DisableInsiderCheckbox Boolean If true, hides the option to join the Insider program in the MAU interface. true
SendAllTelemetry Boolean If true, allows MAU to send telemetry data to Microsoft. true
ChannelName String Specifies the update channel (Current, Deferred, InsiderFast, InsiderSlow). "Current"

Note: Consult Microsoft’s official documentation for the most current and complete list of MAU preference keys and their behaviors.

By consolidating your MAU configuration into a single profile, using suite-wide settings where appropriate, and following best practices for deployment and monitoring, you can effectively resolve the silent update issue and ensure a predictable, user-friendly Microsoft 365 update experience on your macOS fleet managed by Intune.

Have you encountered this issue in your environment? What steps did you take to resolve it? Share your experiences and insights in the comments below!

Post a Comment