5.2 Microsoft 365 Apps, Office Policies, ODT, OCT, and Admin Center

Deploying Microsoft 365 Apps with Intune

For managed Windows endpoints, Intune includes a dedicated Microsoft 365 Apps app type. Use it when the requirement is to install the Office suite, choose apps such as Word, Excel, PowerPoint, Outlook, Teams, OneDrive, Project, or Visio, and configure Office-specific deployment settings without building a generic Win32 package. Behind the scenes this uses Click-to-Run, not the Intune Management Extension, which is why it is not reliably trackable as a blocking app on the Autopilot Enrollment Status Page.

The app suite can be configured with the Intune configuration designer or by entering XML directly. The designer is usually enough for standard deployments. XML is useful when you need precise Office Deployment Tool settings, when you have specific Microsoft 365 Apps for business requirements, or when an organization already manages Office deployment XML as a controlled, version-managed artifact.

Update channels and shared computer activation

The update channel controls how frequently feature updates reach Office. Current Channel delivers features as soon as they are ready, Monthly Enterprise Channel delivers them once per month on a predictable schedule, and Semi-Annual Enterprise Channel is the slowest, validation-friendly cadence. A scenario asking for predictable monthly feature delivery points to Monthly Enterprise Channel; one asking for maximum validation time points to Semi-Annual Enterprise Channel.

Shared computer activation (SCA) is essential for multi-user Windows devices. Without SCA, an Office installation activates against a single user's licensing, which breaks on shared hardware. Enable SCA for school labs, libraries, pooled virtual desktops (including Azure Virtual Desktop and Windows 365 in pooled scenarios), and shift-worker PCs where many licensed users sign in to the same device. A stem mentioning a lab, kiosk-style shared PC, or pooled VDI is almost always pointing at shared computer activation.

ODT and OCT

The Office Deployment Tool (ODT) is a command-line tool. It uses setup.exe plus a configuration XML file to download, install, update, remove, or customize Microsoft 365 Apps. It gives detailed control over products, languages, update behavior, source path, display behavior, and install options. ODT is the tool that runs the deployment.

The Office Customization Tool (OCT) is the web interface that creates the Office configuration XML. It is the safer choice for many admins because it reduces XML syntax mistakes and can save deployment configurations in the Microsoft 365 Apps admin center. OCT can define products, releases, architecture, languages, apps and features, update source, MSI removal, activation method, and application preferences. The clean distinction for the exam: OCT builds the XML; ODT consumes the XML.

ODT and OCT matter on MD-102 because the official study guide explicitly includes deploying Microsoft 365 Apps as part of Windows Autopilot by using ODT or OCT. If the question says the deployment must be tracked during ESP, consider whether an Office Win32 package is a better fit than the built-in Microsoft 365 Apps type.

Office policies and admin center management

Do not confuse Office app deployment with Office app policy. Deployment installs the software; policy controls behavior after users run the apps.

The Cloud Policy service for Microsoft 365 enforces policy settings for Microsoft 365 Apps for enterprise on a user's device when the user signs in with their work account. The device does not have to be domain joined or otherwise managed, which makes Cloud Policy the right answer for "settings should follow the user across unmanaged or BYO devices." Commercial and US Government customers can access it through the Microsoft 365 Apps admin center at config.office.com or through Intune under Apps > Policy > Policies for Office apps.

The Microsoft 365 Apps admin center also supports inventory, servicing, update channel management, and cloud update. Cloud update is Microsoft's modern approach for servicing Microsoft 365 Apps on supported channels, especially Current Channel and Monthly Enterprise Channel. It supports rollout waves, pause, rollback, exclusion windows, and update health monitoring, so a scenario about staging Office feature updates with rollback can point to cloud update rather than a Windows update ring.

Exam decision pattern

When the scenario is installing Office on managed Windows devices, choose the Microsoft 365 Apps app type unless there is a specific Autopilot ESP tracking or custom packaging reason to use Win32. When it is building a reusable XML file, choose OCT. When it is running the XML to download or install Office, choose ODT. When Office settings must follow a user across devices, choose Cloud Policy.

Architecture, languages, and removing old Office

A few suite-configuration details are exam-worthy. Architecture (64-bit versus 32-bit) should normally be 64-bit on modern Windows, and it must match across the suite; you cannot mix Click-to-Run architectures on one device. Languages can add proofing tools and extra display languages, and you can choose to match the operating system language. The Remove other versions / MSI removal setting uninstalls older MSI-based Office (such as Office 2016/2019 volume installs) before the Click-to-Run install, which prevents the unsupported side-by-side state.

If a stem says "older Office must be removed automatically during the new deployment," that MSI-removal setting is the answer.

Accept the license agreement automatically suppresses the first-run EULA prompt, which matters for silent and Autopilot deployments where no user is present to click through it. Overlooking that option is a common cause of an Office install that appears to hang waiting for input.

Cloud update versus Windows update rings

Keep Office servicing distinct from Windows servicing. Cloud update in the Microsoft 365 Apps admin center services the Office apps themselves: it manages which devices are on which channel, supports staged rollout waves, pause, rollback, and exclusion windows, and reports Office update health. A Windows update ring in Intune services the operating system and does not control Office app updates. A scenario about staging Office feature updates with the ability to roll back points to cloud update; a scenario about staging Windows monthly updates points to update rings.

Mixing these two is a deliberate trap because both involve "staged updates with rollback," but they operate on different products.