The OneDrive sync app update process

This article is for IT admins who manage the new OneDrive sync app (OneDrive.exe) in an enterprise environment. It explains how we release updates to the sync app for Windows and the standalone sync app for Mac through rings of validation, and how the sync app checks for updates. Note that if you deploy the sync app alongside Office (via the Office Deployment Tool or some other means), it will continue to check for updates independent of any Office update restrictions you set.

Note

If you allow your users to sync personal OneDrive accounts, the update process described in this article and any settings you select apply to all instances of the sync app.

The sync app installed from the Mac App Store follows a separate update process. After we finish rolling out updates within the Production ring, we publish them to the Mac App Store, where they're immediately released to everyone.

How we release updates through multiple rings

After we validate updates through rings within Microsoft, we release them to the first public ring, Insiders. To try these latest features, join the Windows Insider program or the Office Insider program. It takes about three days to roll out to this ring. Later, we release to organizations in the default update ring, Production. We roll them out to a small percentage of users in the ring at first, and slowly roll them out to everyone in the ring. This typically takes one to two weeks. At each increase along the way, we monitor telemetry for quality assurance purposes. In the rare case we detect an issue, we suspend the release, address the issue, and release a new update to users in the same order. After updates have completely rolled out within the Production ring, we release them to the next ring, Deferred.

Insiders	>	Production	>	Deferred
1-2 times per week	>	1-2 times per week	>	Every 2-3 months with 60-day window

Important

We recommend selecting several people in your IT department as early adopters to join the Insiders ring and receive features early. We recommend leaving everyone else in the organization in the default Production ring to ensure they receive bug fixes and new features in a timely fashion. See all our recommendations for configuring the sync app

The Deferred ring provides builds that have been monitored throughout the Production rollout, so fewer releases are suspended. The Deferred ring also lets you as an admin:

• Control when you deploy updates (within 60 days of their release).

• Deploy new versions from an internal network location to avoid using Internet bandwidth. (If you don't deploy an update after 60 days, it will be automatically downloaded and installed.)

However, as the slowest ring, the Deferred ring receives performance improvements, reliability fixes, and new features last.

Note

Microsoft reserves the right to bypass the 60-day grace period for critical updates.

To learn how to set the Deferred ring for the Windows sync app using Group Policy, see Set the sync app update ring. To learn how to set it for the Mac sync app, see Configure the new OneDrive sync app on macOS. For info about the Microsoft 365 update process, see Overview of update channels for Microsoft 365 Apps for enterprise. For info about the Windows 10 update process, see Build deployment rings for Windows 10 updates.

How the sync app checks for and applies updates

The OneDrive sync app checks for available updates every 24 hours when it's running. If it has stopped and hasn't checked for updates in more than 24 hours, the sync app will check for updates as soon as it's started. Windows 10 also has a scheduled task that updates the sync app even when it's not running.

To determine if an update is available, the OneDrive sync app checks if:

• The latest version released to the update ring is higher than what's installed on the computer. If the installed version is too old to be updated to the current version, the sync app will first be updated to the minimum version within the ring.

• The update is available to the computer based on the rollout percentage we set within the ring.

If both of these are true, OneDrive downloads the update to a hidden folder without any user interaction. After the download is complete, OneDrive verifies and installs it. If OneDrive is running, it's stopped and then restarted. Users don't need to sign in again, and they don't need administrative rights to install the update.

For info about the latest releases, see New OneDrive sync app release notes.

Note

To apply sync app updates, computers in your organization must be able to reach the following: "oneclient.sfx.ms" and "g.live.com." Make sure you don't block these URLs. They are also used to enable and disable features and apply bug fixes. See More info about the URLs and IP address ranges used in Microsoft 365.

Deploying updates in the Deferred ring

At any given time, the next planned Deferred ring release is published on the OneDrive sync app release notes page with a link to the corresponding installer and the target date when that version will be released. On the specified date, the "Rolling out" version for the Deferred ring becomes the new minimum. All sync apps below that version will automatically download the installer from the Internet and update themselves.

To deploy an updated version of the sync app for Windows, run the following command using Microsoft Endpoint Configuration Manager:

Execute <pathToExecutable>\OneDriveSetup.exe /update /restart

Where pathToExecutable is a location on the local computer or an accessible network share and OneDriveSetup.exe is the target version downloaded from the release notes page. Running this command restarts OneDrive.exe on all computers. If you don't want to restart the sync app, remove the /restart parameter. See Deploy using Microsoft Endpoint Configuration Manager for tips on how to set up the Microsoft Endpoint Configuration Manager deployment package.

To deploy an updated version of the sync app for Mac, deploy the OneDrive.pkg with the target version by using your MDM solution.