Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Note
The new profile assignment and channel experience is rolling out gradually and might not be available in your tenant right away. If this experience isn’t available in your tenant, see Channel to profile mapping and Switch device update channel for profile assignment and channel management.
To get started with cloud update, plan how it will fit into your organization’s existing update management approach. This article covers the core components of cloud update to help you prepare so devices are assigned correctly and updates are delivered predictably.
Profiles
Cloud update uses profiles to manage update behavior for Microsoft 365 Apps. Each profile represents an update channel and can include settings such as rollout waves, update deadlines, exclusion windows, pause, and roll back. Profiles are available for Current Channel and Monthly Enterprise Channel.
Profile assignment
Assign a profile to enable cloud update for eligible devices. Devices assigned to a profile use its configured settings for that profile. Devices that aren't included in a profile assignment will not be managed by cloud update.
Profile conflict resolution
If a device is included in more than one profile assignment, cloud update uses the following assignment conflict resolution:
- Microsoft Entra group assignment has first priority. For example, if a user is included in both the Current and Monthly Enterprise profiles and is also a direct member of a Microsoft Entra group assigned to the Monthly Enterprise profile, the user's device is managed by and set to Monthly Enterprise Channel.
- The faster update channel has second priority. For example, if a user is included in both profiles through built-in channel groups, the user's device is managed by and set to Current Channel, as it is the faster of the two channels.
It's always recommended to avoid profile assignment conflicts by ensuring users and device objects do not overlap between profiles.
Update channels
Each profile applies its corresponding update channel. Devices assigned to the Current profile are set to Current Channel. Devices assigned to the Monthly Enterprise profile are set to Monthly Enterprise Channel.
Before you enable cloud update, review channel distribution in inventory in the Microsoft 365 Apps admin center. Devices can be moved to Current Channel or Monthly Enterprise Channel using profile assignment.
Groups, users, and devices
Cloud update uses Microsoft Entra groups for profile assignment, rollout waves, exclusions, and roll back. Use groups that align with your servicing strategy, such as pilot users, production devices, business-critical devices, or devices that require additional validation before broad deployment.
Plan group membership before you enable cloud update or change profile assignments. Keep groups easy to understand and maintain. Avoid overlapping groups unless ownership and expected behavior are clear. If you use dynamic groups, confirm that membership rules are accurate and allow enough time for devices to evaluate group membership.
Use profile assignment to align cloud update with your channel strategy. For example, assign pilot devices to the Current profile and production devices to the Monthly Enterprise profile. This approach lets you validate updates early while keeping most devices on a predictable monthly release cadence.
End-user experience
Cloud update coordinates when updates for Microsoft 365 Apps are installed on managed devices. During installation, Click-to-Run displays notifications that help reduce disruption and give users time to postpone the update when needed. For more information, see End-user update notifications for Microsoft 365 Apps.
Network considerations
Devices managed by cloud update download updates for Microsoft 365 Apps from the Office Content Delivery Network (CDN). Before you enable cloud update, confirm that your network and devices are ready. Estimate how many devices are out of date, the update size for each device, and the release cadence for each channel you plan to manage. Devices that are already on the current release don't download a full update until a newer release is available.
- Confirm that devices can reach the required Microsoft 365 Apps admin center and Office CDN endpoints.
- Review Delivery Optimization options, including bandwidth management, peer-to-peer sharing, and Microsoft Connected Cache.
- Use inventory and security update status to identify devices that are out of date.
- Review update size estimates to understand potential network throughput requirements.
Exclusions
Use exclude groups for devices or users that shouldn't be managed by cloud update. Common examples include non-persistent virtual machines or devices managed by a separate servicing strategy.
Add exclusions by using supported Microsoft Entra groups. Review exclusion group membership regularly so devices aren't left unmanaged longer than needed. If a device is removed from an exclusion group and is eligible for a profile, cloud update can manage the device based on its current profile assignment and channel.
Permissions
Admins must have a supported Microsoft Entra role to use cloud update. Use the Office Apps Administrator role to provide the required access with least privilege.
Microsoft Entra groups aren't required to use cloud update, but they provide more flexibility for profile assignment, exclusions, rollout waves, and rollback. Review the groups you plan to use and confirm who has permission to maintain group membership.