Deploying Microsoft 365 Apps Updates in 2026: Update Channels, Deferral, and Forced Refresh

There’s no “Updates” folder to slipstream patches into anymore. That trick worked for MSI-based Office admin installs (2016 and earlier), but Microsoft 365 Apps and Office LTSC are Click-to-Run (C2R) products: they stream updates from a CDN, a local network share, or Configuration Manager, controlled entirely by update channel and policy, not by files dropped next to setup.exe.

This is also a genuinely awkward year to get this wrong. From July 2026, Microsoft folded the Semi-Annual Enterprise Channel into the Monthly Enterprise Channel’s release cadence, and support for the last classic Semi-Annual build (2508) ended on 8 September 2026. If your fleet is still on Semi-Annual and nothing’s changed in your management tooling, this covers what actually happens, how to set channels and deferral properly with the Office Deployment Tool (ODT), Group Policy and Intune, and how to force a stuck machine to update right now.

Update channels in 2026, and what changed

Every Microsoft 365 Apps client (and Office LTSC, sort of) belongs to exactly one update channel. All Office products on a device must share the same channel; you can’t run Word on Current and Excel on Monthly Enterprise on the same machine.

SAEC devices don’t need reinstalling: Microsoft pushes the transition automatically and the client just starts reporting as Monthly Enterprise Channel under File, Account. The build numbers for the two channels’ “2606” release deliberately differ so Click-to-Run recognises the update as valid during the switch. If you use Cloud Update for MEC, review your exclusion groups before your SAEC devices get auto-onboarded; if you’d rather control the pace yourself, hold devices on 2508 with your existing tooling until you’re ready, but not past 8 September 2026 when that build stops getting security fixes.

Setting the channel with the Office Deployment Tool

ODT’s configuration.xml is still the source of truth for a fresh install, and it’s also how you point clients at a local update source (the modern equivalent of the old Updates share):

<Configuration>
  <Add Channel="MonthlyEnterprise" OfficeClientEdition="64">
    <Product ID="O365ProPlusRetail">
      <Language ID="en-gb" />
    </Product>
  </Add>
  <Updates Enabled="TRUE" Channel="MonthlyEnterprise" UpdatePath="\\fileserver\office365updates" />
</Configuration>

To stock that share, run ODT in download mode against the same channel on a machine with internet access:

setup.exe /download configuration.xml

Clients pointed at UpdatePath pull from that share instead of Microsoft’s CDN, which is the closest thing left to the old slipstream workflow, useful for sites with restricted internet or slow WAN links.

Group Policy and Intune: deferral and deadlines

Once Office is installed, Group Policy (or Intune’s identical ADMX-backed settings) takes priority over whatever was in the original configuration.xml. The settings live under Computer Configuration\Policies\Administrative Templates\Microsoft Office 2016 (Machine)\Updates (the “2016” naming is legacy but it’s still the correct template for current Click-to-Run builds):

In Intune, the same options are available through the Administrative Templates profile (a direct match to on-prem GPO) or, for more granularity, the Settings Catalog. There’s no separate Intune-only Office update policy; it’s the same ADMX under the hood, so anything documented for Group Policy works the same way for Intune-managed devices.

Forcing a stuck machine to update now

For a one-off check, or a user reporting Office won’t update, run this as the logged-on user (not elevated, C2R updates run in user context by design):

"%CommonProgramFiles%\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /update user displaylevel=true

For unattended deployment (login script, RMM, or a Configuration Manager script), suppress the UI and close apps automatically:

"%CommonProgramFiles%\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /update user displaylevel=false forceappshutdown=true

If the machine still doesn’t move, check that it’s actually on the channel and update path you think it is:

# Current channel and version, per client
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" |
  Select-Object UpdateChannel, VersionToReport, ClientFolder

A machine reporting the wrong channel usually means a Group Policy conflict, or that Cloud Update onboarded it to a channel your ODT config didn’t set. Fix the policy first; forcing the client-side update again won’t help if it’s correctly obeying the wrong instruction.

Office LTSC is a different beast

None of the channel logic above applies to Office LTSC 2021 or 2024. Those use their own fixed channel (PerpetualVL2021 or PerpetualVL2024 in ODT), receive security and reliability patches only, and never get feature updates, that’s the entire point of a perpetual volume-licensed release. If you need the latest features, LTSC isn’t the right product, and no amount of GPO tweaking changes that; you’d need to deploy Microsoft 365 Apps for enterprise alongside or instead of it.

Frequently asked questions

Do I need to do anything before the Semi-Annual Channel changes?

No action is mandatory, existing GPO, Intune and ODT configurations keep working. But check any reporting or compliance dashboards that filter on “Semi-Annual Enterprise Channel” by name, since devices will start reporting as Monthly Enterprise Channel after the July 2026 update.

Does Group Policy really override the Office Deployment Tool?

Yes. ODT’s configuration.xml only governs the install and initial channel assignment. Once a GPO or Intune policy targets a machine, it wins for anything it configures, including channel, from then on.

Can I still host updates on an internal file share instead of pulling from Microsoft’s CDN?

Yes, that’s what UpdatePath is for. Run setup.exe /download against your chosen channel to stock a share, then point the Update Path policy or ODT config at it. It’s not a drop-in “Updates” folder like the old MSI installs, but it achieves the same goal: controlled, bandwidth-friendly distribution.