Microsoft’s Paul Bowden announced on Tuesday at Virtual JNUC 2021 that the company is now providing additional update channels that support deferring updates for periods of time and even pausing updates on specific versions of Microsoft Office for Mac.
While these new options were announced at JNUC and Jamf Pro has native support for configuring them, MacAdmins who use a different MDM can also utilize them with custom configuration profiles right away.
I reached out to Paul for more details and clarification on these exciting new options. Read on for the details.
Microsoft has always provided two early access channels, Preview (formerly External / InsiderSlow) and Beta (formerly InsiderFast) that allow the installation of updates before they hit the general release channel of Current (formerly Production).
“We do have beta and preview channels available to use, so you can kinda get a jumpstart on upcoming changes,” Bowden said. “Beta releases two times a week so it is kind of almost nightly builds. [With] Preview you get two updates a month, so it’s a little slower and like an eight day lead time on when a build is going to hit the Current channel.”
Custom Manifest and Caching Servers
However Bowden acknowledged that for many customers these previews are not enough and they need to introduce an artificial delay on their fleet after Microsoft makes updates available in the Current channel.
“In the past we recommended that you setup a custom manifest server, so this is your own HTTPS server, and you manually copy collateral and kept that up to date, and you point MAU at that,” Bowden said.
I first wrote about MAU Manifest and Caching servers back in 2017 and have been running one for exactly this reason (and to save bandwidth) since then.
“Although that has been working really well for many MacAdmins, we noticed a lot of these custom servers were kinda setup the same, or they were there to perform the same purpose,” said Bowden.
“We looked at the patterns of these and said, it’s a whole lot of overhead we’re putting on MacAdmins by getting them to setup their own Manifest Servers, so can we do something that’s a little smarter here and have something hosted and managed by us.”
The results are two sets of new capabilities immediately available for MacAdmins.
“The first one are what we call Deferred channels and they create some breathing room for your IT validation,” Bowden revealed.
These dedicated Deferred channels are available in 3, 7, 14, 21 or 28 day options. The delays are calculated from when an update is promoted to the Current channel and does not rely on when a particular computer may have first seen the update.
“What’s also nice about the Deferred channels is you set them and forget them. You literally define the [delay] and then you never have to revisit that config profile again.”
The second set of new options allows MacAdmins to pause or pin updates on a specific release of Office. This is helpful for companies that require change management approval for any updates, if there is a change freeze around the end of a fiscal year or if a required plug-in vendor is not keeping up to date with Office releases.
“The consideration for using this type of pinning is that there is ongoing profile maintenance. Every time you want to start updating to the next version you need to go back to the config profile and change the [URL of the pinned version].”
Paul was also quick to point out that this is not meant to allow MacAdmins to permanently remain on a version of Office older than six months. “Anything beyond six months is really not in the scope what what we’re trying to achieve,” he said. Microsoft has built-in automation that will start moving Office forward once it goes past that timeframe. “After six months, the pinned channels will start moving forward month-by-month so that devices never get more than six months out of date.”
For example, an admin pins or pauses Office on version 16.51 from July 2021 and then never changes the configuration profile. In January 2022 when 16.57 is released, those Macs pinned to 16.51 will automatically be offered version 16.52 to keep them at the maximum six month delay. This pattern will continue with each version going forward every month.
This is a great safety net for situations where an admin leaves a company and their replacement doesn’t know about the pinned version, ensuring the fleet stays relatively current.
Another safety feature is that Current channel collateral is published to the future version pinned channels each month. So if for some reason you know you need to pause at 16.60 in April of 2022, you can set that now and continue to receive monthly updates until then.
When deciding if these new options are a good fit for you, make sure to note that they don’t apply to every application that Microsoft AutoUpdate can handle.
“One of the considerations is that this only defers [or pauses] the core five Office apps: Word, Excel, PowerPoint, Outlook and OneNote. Other MAU integrated apps such as Edge, Company Portal and Defender will update immediately based on their release cadence of the Current channel.”
Setting it up
No changes to Microsoft AutoUpdate were needed to support this new functionality, it is all handled server-side by Microsoft. This is done by serving the collateral for specific versions of Office at specific URLs, exactly as you would do if hosting your own custom ManifestServer, but completely automated by Microsoft.
While Jamf Pro supports configuring the options automatically in their web GUI, other MacAdmins can easily configure these in their own custom configuration profiles.
To use one of the deferral or pinned channels you need to set two options in your MAU configuration profile.
1. Set the ChannelName to Custom:
2. Set the ManifestServer to the URL of the specific deferral length or pinned version desired (see full table below):
Custom Channel URLs
Below are the time based deferral ManifestServer URLs that will never change. These are the ones you can set and forget:
|Defer 3 days||https://officecdnmac.microsoft.com/pr/Defer.3/|
|Defer 7 days||https://officecdnmac.microsoft.com/pr/Defer.7/|
|Defer 14 days||https://officecdnmac.microsoft.com/pr/Defer.14/|
|Defer 21 days||https://officecdnmac.microsoft.com/pr/Defer.21/|
|Defer 28 days||https://officecdnmac.microsoft.com/pr/Defer.28/|
|Defer 45 days||https://officecdnmac.microsoft.com/pr/Defer.45/|
These are examples of existing and future pinned ManifestServer URLs. You’ll be able to deduce the newer versions of these as Office updates are released in the future:
|Pause at 16.51 (July 2021 Release)||https://officecdnmac.microsoft.com/pr/16.51.2107/|
|Pause at 16.52 (August 2021 Release)||https://officecdnmac.microsoft.com/pr/16.52.2108/|
|Pause at 16.53 (September 2021 Release)||https://officecdnmac.microsoft.com/pr/16.53.2109/|
|Pause at 16.54 (October 2021 Release)||https://officecdnmac.microsoft.com/pr/16.54.2110/|
|Pause at 16.55 (November 2021 Release)||https://officecdnmac.microsoft.com/pr/16.55.2111/|
|Pause at 16.56 (December 2021 Release)||https://officecdnmac.microsoft.com/pr/16.56.2112/|
|Pause at 16.57 (January 2022 Release)||https://officecdnmac.microsoft.com/pr/16.57.2201/|
|Pause at 16.58 (February 2022 Release)||https://officecdnmac.microsoft.com/pr/16.58.2202/|
|Pause at 16.59 (March 2022 Release)||https://officecdnmac.microsoft.com/pr/16.59.2203/|
|Pause at 16.60 (April 2022 Release)||https://officecdnmac.microsoft.com/pr/16.60.2204/|
For further discussion of these new options please join us on the MacAdmins Slack in the #microsoft-autoupdate channel.
UPDATE 1/19/22: By popular request Microsoft has now added a 45 day deferrel channel and it has been added to the table above.
Great info! Let’s get this added to ProfileManifests asap!
Awesome! Thanks for sharing.
I think the Preview channel was previously called Insider Slow and not External?
External was the older name for Insider Slow. Most people will probably recognize InsiderSlow so I’ve added it to the article. Thanks!
Pingback: News Summary for Admins — 2021-10-22 – Scripting OS X