Office 365 Client Updates via WSUS

Many of you have already seen the announcement that Configuration Manager can now be set up to sync Office 365 ProPlus updates directly.  This scenario is a direct response to requests for control of distributing these updates, and is an improvement on the past model (wherein Office 365 ProPlus updates circumvented Microsoft Update and WSUS altogether); however, there may be a nonzero cost to WSUS administrators that do not use Configuration Manager.  This post discusses how to mitigate that cost if you are affected by the change.


The Office 365 Client category now appears in the WSUS Products and Classifications pane:


If you’ve configured WSUS to sync this content, then you’ll see new updates in the console:


Deploying these updates without Configuration Manager is not supported, so the content described above is essentially useless to a WSUS standalone administrator.  Depending on your situation, we recommend that you take one of the following actions:

  1. Deselect the Office 365 Client product so that WSUS does not sync this content from Microsoft Update. 

  2. For those running Small Business Server or other flavors that do not allow product filtering, decline all updates for the Office 365 Client product, which can be identified by the update title.


Please let us know if there are any questions on this new content in WSUS.

Comments (20)
  1. RP says:

    Are you planning to allow WSUS to deploy these updates without an SCCM infrastructure in the future?

  2. Typhoon87 says:

    This seems like a very poor choice. Deploying updates through SCCM is a big change as you have to package updates. We do not have the support staff capacity to do that.

  3. RP: There are no plans to support this via WSUS standalone at this time. My preference would be to support this scenario without the use of this workaround, which is not possible with the current implementation. We’ve got other changes coming in WSUS that
    are higher priority, but if there’s a clear need in the ecosystem, then we may look at ways to support this in the WSUS standalone scenario.

    Typhoon87: The old model required manual deployments of MSI packages via Configuration Manager, and did not use the conventional Microsoft Update pipeline that all other first-party updates use. With this change from the Office/Configuration Manager teams,
    this content can be deployed like a regular update, so it should not require the specific packaging that you describe. Can you clarify why you would need additional support staff because of this change?

    1. Patrick Dunlap says:

      Its a year+ later. Have you guys found time to include this yet? Do you need us to get out and push?

  4. Mathieu says:

    You could probably use Automatic Depoyment Rules to ease the deployment of updates using SCCM, pretty much automated that way and really less manipulation to be done. There is no real package to be done while deploying updates.

  5. Jack says:

    Yes ADRs via SCCM is the way to go here. Works like a champ. Fire & forget.

  6. Fred Duarte says:

    What’s the back-out strategy looks like when using ConfigMgr? If we need to roll back to the previous build, what does the process look like?

  7. SF says:

    I too think it’s a sad choice not supporting a WSUS only plan. Makes it a lot more complicated and more expensive for someone not having SCCM…

  8. Emman says:

    Please support Office 365 update through standalone WSUS as small businesses cannot afford to have SCCM.

  9. Patrick Dunalp says:

    I would also like to strongly request that time be spent to enable the distribution of Office 365 source from the WSUS system. We are currently hosting our sources on netshares at various locations around the world and we run a scheduled script that pulls this from Microsoft and syncs it to these shares. We already have a robust WSUS infrastructure, WSUS is the logical way to pull and host these sources, and this would give us far more visibility in the conditions of our endpoints.

    If possible we would also like to see the same P2P/mesh type of file sharing that is being employed with Windows 10 (also a software as a service technology) used with Office 365.

  10. Adam says:

    Another stupid decision. Just stick the updates into WSUS, that’s what it is there for. Conf Mgr is yet another needless cost to small businesses.

  11. everlifted says:

    Just discovering this article.

    Interesting thing is that WSUS detects and pushes the updates out to all the Office 365 clients running on Win10Pro. The updates download successfully and appear to install successfully. But this happens every night. So if I check the client side update history there is a long list of the same updates being installed over several nights… that is until I manually update through Office (i.e. Word 2016, etc.). Office then successfully updates, the version number changes, and Windows clients no longer shows the update that needs to be installed, and WSUS detects that it is no longer needed.

    Before I turned on Office365 updates in WSUS, Office would never update and always errored out when manually checking for updates. Guess I’ll look for other articles why that might be. It would be nice to have this supported though.

  12. Keith says:

    What a disappointment that Microsoft’s solution to updating Office 365 is the most expensive and most infrastructure intensive solution possible. WSUS should be supported, plain and simple.

  13. Marc Hoffman says:

    Please add support for a WSUS-only system!

  14. Jason says:

    So glad we have stayed with the MSI-based Office 2016. We’d be underwater if we had went with Office 365 since you can’t even update it via WSUS.

    Honestly, I don’t mind the cost of Office 365, but because of decisions like these, there is a *lot* more overhead involved. Office 365 is not worth it.

  15. Marc Becker says:

    My WSUS is downloading Office 2016 updates (over 40 gigs) but none of my clients are receiving any updates. Is there something more I need to do to get WSUS to distribute the updates to the clients?

    1. Are those updates approved for the clients? Are they being detected as Needed by the clients? Both must be true in order to deploy a given update.

  16. atul tamta says:

    Do we need WSUS 4.0 for managing office 365 updates via SCCM ?

    1. Current Branch versions of Configuration Manager require at least WSUS 4.0 running underneath them. This feature was added in Config Manager CB 1602, which does not support WSUS 3.0/1/2.

  17. Christian kelly says:

    With the mess of Office updates coming out lately (attachments not opening/broken search) getting some control of which updates are pushed via WSUS is becoming important. It’s been a total headache with clients who are using clicktorun vs old school office with WSUS

Comments are closed.

Skip to main content