Blog Post

Microsoft 365 Blog
3 MIN READ

Announcing the new cloud-based policy management service for Office 365 ProPlus

chhopkin's avatar
chhopkin
Icon for Microsoft rankMicrosoft
Jan 08, 2019

Today we are pleased to announce the preview of the Office cloud policy service to help administrators manage policies for all Office 365 ProPlus users in their organization, from an easy-to-use, Internet-based portal focused on Office 365 ProPlus management.

 

Office 365 ProPlus allows users to access full Office experiences from multiple Windows devices. These may be managed or MDM-enrolled devices, but are often also personally-owned and unmanaged. Now with the Office cloud policy service, you can define and enforce Office policies without the infrastructure or MDM services traditionally required.

 

The Office cloud policy service allows administrators to define policies for Office 365 ProPlus and assign these policies to users via Azure Active Directory security groups.  Once defined, these Office policies are automatically enforced as users sign in and use Office 365 ProPlus.

 

  • Build a policy configuration that includes the policies you want to enforce, configured as needed for your organization’s needs.  The service is always up to date and includes the latest policies as they are released. 
  • Target a group of users by assigning the policy configuration to a specific AAD security group. 
  • Policies automatically enforced as users sign into Office 365 ProPlus.

     

 

This service is now available as a preview for all organizations with Office 365 ProPlus.  If you are an administrator, you can start using this service by signing into the Office client management portal and creating Office cloud policy configurations.  As you evaluate this preview, please provide feedback using the feedback button (in the upper right corner) to help us improve the service.

 

For a guided walk-though of this new service, take a look at a this video which also includes a deep dive into the Office Customization Tool.

 

 

 

For additional documentation on how to use this new policy service and its capabilities take a look at this document.

 

FAQ:

Does the Office cloud policy service replace Group Policy management options?
No, this service complements Group Policy-based management as another option. Group Policy management enforces policies on Windows PCs joined to an Active Directory domain, while the Office cloud policy service only requires Azure Active Directory sign-in as part of Office 365 ProPlus.

What are primary differences between the types of policies I can enforce using Office cloud policy service compared to Group Policy?
Office cloud policy service manages user-based policies for Office 365 ProPlus. Group Policy can manage both user-based and machine-based policies.

How does the Office cloud policy service compare with the Office Customization Tool for Click-to-Run’s application preferences settings?
The settings configured as part of Office installation using the Office Customization Tool for Click-to-Run – as well as previous OCT versions – are based on ‘preferences’, meaning that a user can change them. Office cloud policy service settings are enforced, similar to Group Policy enforcement.

 

Is an Intune subscription required?

No.  It is not required that the tenant have an Intune subscription.  This is a feature of Office 365 ProPlus and only requires that the tenant have a subscription that includes Office 365 ProPlus.

 

Does this work with all Office Click-to-Run products?

No.  This is a feature of Office 365 ProPlus and only works with the Office apps that are deployed as a part of the Office 365 ProPlus suite.

 

Does this new policy service support all the policies from the Office ADMX templates?

No.  Currently this preview is limited to a subset of the user based policies defined in the ADMX templates.  All machine based policies are not included.

 

Which admin roles are allowed access to configure policies?

Only the Global Admin, Security Admin or Desktop Analytics Admin (private preview) roles are allowed access to create or view policy configurations.

Updated Feb 10, 2023
Version 9.0

56 Comments

  • Correct, this is only available for the ProPlus suite.

     

    Cheers,

    Chris

  • Hi, so Office 365 Business and Microsoft 365 Business suites and installs do not work with this? Is this preferred option or we should use MDM Intune if it is already in place?

  • Hi Oleg,

     

    Being signed into just one of the Office 365 ProPlus apps will trigger the policy sync which will sync all policies assigned for that user.  OneDrive is excluded as it is not part of the Office 365 ProPlus activation process.  Any security group that is available in AAD, including the security groups you have synced can be targeted.  This will work for any user in the targeted security group(s) that have a valid Office 365 ProPlus license assigned to them.  Exclusion capability is something that we are considering.

     

    Cheers,

    Chris

  • wroot's avatar
    wroot
    Silver Contributor

    I suppose there is no restrictions based on licenses and this will work with any plan?

  • wroot's avatar
    wroot
    Silver Contributor

    I see in documentation, that security group must be in AAD. Does synced on-premise AD groups work also? Is there or planned option for exclusion? Some users might need macros to work, so one might want to exclude some groups, but still apply policy to all users.

  • wroot's avatar
    wroot
    Silver Contributor

    So, is it enough to be signed in into Outlook with Exchange Online account or say OneDrive or do you have to be signed in to Excel/Word also? Usually when activating Office 365 for the first time such login happens, but i often found Excel and Word showing there is an error with your account and asking to sign in again. As we didn't need Office app to be signed in, it wasn't an issue. But i wonder if that won't break such policy enforcement. What is the main agent/service responsible for policy pull down from the server?