Intune Compliance Check for Install of o365

Question

I have been asked to setup a Compliance check to see if o365 is installed or not. I have been searching online and have not found any 365 detection scripts or JSON files for this that others have used. I am not great with Powershell and JSON so any help will be welcomed!!!!

Answer 1

I don't know how this works, so please consult your organization's IT administrator.

Answer 2

Hello rr-4098,

You would like to mark the device non-compliant if M365 (formerly O365) apps are not installed. Is that correct? In that case, you can create the compliance policy as follows.

Disclaimer: Please test this on test devices before deploying for production devices.

Prerequisites:

You need to create the script and JSON file for detection and validation.

1. Script to detect M365 app install:

      #########################################################################################
      # ALL THE SCRIPTS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED                   #
      # OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR         #
      # FITNESS FOR A PARTICULAR PURPOSE.                                                                 #
      #                                                                                                   #
      # This sample is not supported under any Microsoft standard support program or service.             #
      # The script is provided AS IS without warranty of any kind. Microsoft further disclaims all        #
      # implied warranties including, without limitation, any implied warranties of merchantability       #
      # or of fitness for a particular purpose. The entire risk arising out of the use or performance     #
      # of the sample and documentation remains with you. In no event shall Microsoft, its authors,       #
      # or anyone else involved in the creation, production, or delivery of the script be liable for      #
      # any damages whatsoever (including, without limitation, damages for loss of business profits,      #
      # business interruption, loss of business information, or other pecuniary loss) arising out of      #
      # the use of or inability to use the sample or documentation, even if Microsoft has been advised    #
      # of the possibility of such damages.       
      #########################################################################################
      
      # Initialize values
      $OfficeArch       = "Unknown"
      $OfficeType       = "None"
      $OfficeVersion    = "Not Found"
      $OfficeBuild      = "Unknown"
      $OfficeVersionMap = "Unknown"
      $OfficeName       = "Unknown"
      $Timestamp        = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
      # Detect Click-to-Run Office via registry
      $C2RPaths = @(
          "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration",
          "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun\Configuration"
      )
      foreach ($path in $C2RPaths) {
          if (Test-Path $path) {
              try {
                  $props = Get-ItemProperty -Path $path
                  if ($props.Platform) {
                      $OfficeArch = $props.Platform
                      $OfficeType = "Click-to-Run"
                  }
                  if ($props.VersionToReport) {
                      $OfficeVersion = $props.VersionToReport
                      if ($OfficeVersion -match "^16\.0\.(\d+)\.") {
                          $OfficeBuild = $Matches[1]
                      }
                  }
                  if ($props.ProductReleaseIds) {
                      $OfficeName = $props.ProductReleaseIds -replace ";.*", ""  # Grab first product ID
                  }
                  break
              } catch {}
          }
      }
      # If not Click-to-Run, check for MSI Office using WMI
      if ($OfficeType -eq "None") {
          try {
              $OfficeProducts = Get-WmiObject -Class Win32_Product | Where-Object {
                  $_.Name -match "Microsoft Office" -and $_.Name -notmatch "Click" -and $_.Name -notmatch "365"
              }
              foreach ($product in $OfficeProducts) {
                  if ($product -ne $null) {
                      $OfficeType    = "MSI"
                      $OfficeVersion = $product.Version
                      $OfficeName    = $product.Name
                      if ($OfficeVersion -match "^16\.0\.(\d+)\.") {
                          $OfficeBuild = $Matches[1]
                      }
                      break
                  }
              }
              $OfficeExePaths = @(
                  "$env:ProgramFiles\Microsoft Office",
                  "$env:ProgramFiles (x86)\Microsoft Office"
              )
              foreach ($base in $OfficeExePaths) {
                  $exe = Get-ChildItem -Path $base -Recurse -Include "winword.exe" -ErrorAction SilentlyContinue | Select-Object -First 1
                  if ($exe) {
                      $OfficeArch = if ($exe.FullName -like "*Program Files (x86)*") { "32-bit" } else { "64-bit" }
                      break
                  }
              }
          } catch {
              $OfficeType    = "MSI Detection Failed"
              $OfficeArch    = "Unknown"
              $OfficeVersion = "Unknown"
              $OfficeBuild   = "Unknown"
              $OfficeName    = "Unknown"
          }
      }
      # Map build to marketing version
      if ($OfficeVersion -match "^16\.0\.(\d+)\.") {
          $build = [int]$Matches[1]
          $OfficeBuild = $build
          switch ($build) {
              { $_ -ge 17000 } { $OfficeVersionMap = "2024"; break }
              { $_ -ge 14000 } { $OfficeVersionMap = "2021"; break }
              { $_ -ge 10300 } { $OfficeVersionMap = "2019"; break }
              { $_ -ge 4266  } { $OfficeVersionMap = "2016"; break }
              default          { $OfficeVersionMap = "16.x (Unknown)" }
          }
      } elseif ($OfficeVersion -match "^15\.0") {
          $OfficeVersionMap = "2013"
      } elseif ($OfficeVersion -match "^14\.0") {
          $OfficeVersionMap = "2010"
      }
      if(($officetype) -and ($officeversion) -and ($officebuild))
      {
      $appstatus = @{"Installation status" = "M365 apps installed"}
      }
      else {
          $appStatus = @{"Installation status" = "No M365 apps installed"}
      }
      return $appStatus | ConvertTo-Json -Compress
   

2. On Intune portal, go to Devices -> Compliance -> Scripts. Click Add-> Windows 10 and later. Give a name for the script like "M365 Detection Script" and create.
3. JSON file:

      {
      "Rules":[ 
          { 
             "SettingName":"Installation status",
             "Operator":"IsEquals",
             "DataType":"String",
             "Operand":"No M365 apps installed",
             "MoreInfoUrl":"https://www.microsoft.com/en-us/microsoft-365/download-office?msockid=39fe2c4b6cda608038173a6d68da6684",
             "RemediationStrings":[ 
                { 
                   "Language":"en_US",
                   "Title":"Device does not have any O365 apps installed.",
                   "Description": "Please make sure that O365 apps are installed on the device. "
                }
             ]
          }
       ]
      }
   

   Save this file locally.

Compliance Policy Configuration:

1. On Intune portal, go to Devices -> Compliance -> Policies -> Create Policy Platform: Windows 10 and later Profile Type: Windows 10/11 compliance policy
2. Click Create and give a name for the policy
3. Under Compliance settings -> Custom Compliance -> Require
4. Select your discovery script and upload the JSON saved locally.
5. Click next and Configure actions of non-compliance
6. Click next, add assignments and create the policy.

Once the devices are synced with the policy, you should be able to see the status of non-compliant ones (No M365 apps installed). Additionally, on the end device you will see the description from the JSON as the reason for compliance.

Hope this helps!

If you found the information above helpful, please Accept the answer. This will assist others in the community who encounter a similar issue, enabling them to quickly find the solution and benefit from the guidance provided.