Hello everyone, today we have a great article from Intune Support Engineer Mohammed Abudayyeh. In this article, Mohammed walks through the process of ingesting Office ADMX files and creating ADMX-backed policies for Win32 and Desktop Bridge apps using Windows 10 MDM.


Please note that we recently released ADMX-backed administrative templates in public preview for Intune. The preview allows a templated access of select Group Policy administrative templates (ADMX-backed policies) for Windows PCs via the Policy configuration service provider (CSP). If the policy you're wanting to implement is available in these administrative templates then that would be the recommended method to use vs ADMX ingestion as discussed here. You can read more about this here: https://docs.microsoft.com/intune/administrative-templates-windows.


As always, if you have any feedback please leave us a comment below.





Starting with Windows 10 version 1703, we can now import ADMX files (aka ADMX ingestion) and set ADMX-backed policies for Win32 and Desktop Bridge apps using Windows 10 Mobile Device Management (MDM). In this scenario, the ADMX files that define the policy information are delivered to your devices using the Policy CSP URI ./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall and then the ingested ADMX files are processed into MDM policies. This post covers the following topics:

  • The Registry keys used
  • The steps to ingest ADMX files
  • Reviewing the settings after deployment
  • An example using PowerPoint


Registry Keys


When the ADMX policies are imported, the registry keys to which each policy is written are checked so that known system registry keys, or registry keys that are used by existing inbox policies or system components, are not overwritten. This precaution helps to avoid security concerns over opening the entire registry. Currently, the ingested policies are not allowed to write to locations within the System, Software\Microsoft, and Software\Policies\Microsoft keys, except for the following locations:

  • Software\Policies\Microsoft\Office\
  • Software\Microsoft\Office\
  • Software\Microsoft\Windows\CurrentVersion\Explorer\
  • Software\Microsoft\Internet Explorer\
  • software\policies\microsoft\shared tools\proofing tools\
  • software\policies\microsoft\imejp\
  • software\policies\microsoft\ime\shared\
  • software\policies\microsoft\shared tools\graphics filters\
  • software\policies\microsoft\windows\currentversion\explorer\
  • software\policies\microsoft\softwareprotectionplatform\
  • software\policies\microsoft\officesoftwareprotectionplatform\
  • software\policies\microsoft\windows\windows search\preferences\
  • software\policies\microsoft\exchange\
  • software\microsoft\shared tools\proofing tools\
  • software\microsoft\shared tools\graphics filters\
  • software\microsoft\windows\windows search\preferences\
  • software\microsoft\exchange\
  • software\policies\microsoft\vba\security\
  • software\microsoft\onedrive

Steps to ingest ADMX files


Step 1 - Download the ADMX files

The first thing we need to do is download the ADMX files for Office 16 to your computer. They can be found at https://www.microsoft.com/en-us/download/details.aspx?id=49030. You will notice that each product under Microsoft office has its own ADMX-Backed Policies.


Step 2 - Create the OMA-URI custom policy

Now we need to deliver these ADMX policies to the computers you want to manage:


1. In the Azure portal, select All services, filter on Intune, then select Microsoft Intune.

2. Select Device configuration -> Profiles -> Create profile.

3. Enter the following settings:

    • Name: Enter a name for the profile, such as Office 16 custom profile.
    • Description: Enter a description for the profile.
    • Platform: Choose Windows 10 and later.
    • Profile type: Choose Custom.


4. Under Custom OMA-URI Settings click Add and enter the following settings:

    • Name: Enter a unique name for the OMA-URI setting to help you identify it in the list of settings.
    • Description: Enter a description that gives an overview of the setting, and any other important details.
    • OMA-URI (this is case sensitive): Enter the OMA-URI you want to use as a setting ./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/Office16/Policy/Office16Policy
    • Data type: Choose the data type you'll use for this OMA-URI setting. Select String.
    • Value: Enter the data value you want to associate with the OMA-URI you entered. In our case we will put the content of Office16 ADMX file into the Value field.

The table below shows the OMA-URI, Data Type and Value for the rest of the Office apps. 


Office Application OMA-URI Data Type Value
Microsoft Access 2016 ./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/Office16/Policy/Access16 String The content inside access16.admx
Microsoft Excel 2016 ./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/Office16/Policy/Excel16 String The content inside excel16.admx
Microsoft Lync 2016 ./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/Office16/Policy/lync16 String The content inside lync16.admx
Microsoft OneNote 2016 ./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/Office16/Policy/Onenote String The content inside onent16.admx
Microsoft Outlook 2016 ./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/Office16/Policy/Outlook16 String The content inside outlk16.admx
Microsoft PowerPoint 2016 ./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/Office16/Policy/Powerpoint16 String The content inside ppt16.admx
Microsoft Project 2016 ./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/Office16/Policy/Project16 String The content inside proj16.admx
Microsoft Publisher 2016 ./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/Office16/Policy/Publisher16 String The content inside pub16.admx
Microsoft Visio 2016 ./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/Office16/Policy/Visio16 String The content inside visio16.admx
Microsoft Word 2016 ./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/Office16/Policy/Word16 String The content inside word16.admx


Note that you can put all application settings in one profile by repeating step 4 for each. 


5. Select OK to save your changes. Continue to add more settings as needed.

6. When finished, choose OK and then Create to create the Intune profile.


Step 3 - Assign the policy to users


1. Click Assignments, then click Select Groups and select the group you want to assign your policy to. In this example we’re assigning the policy to the All Users & All Devices group.

2. Click Save to save the assignment.




When complete, your profile is shown in the Device configuration - Profiles list.




Reviewing the settings after deployment


1. On a targeted computer, run RegEdit and navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\AdmxInstalled\. Drill down and you should see policy settings, similar to those shown in the screen shot below.



2. Now navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\AdmxDefault.You should see entries similar to the ones below depending on the policies you configured in step 2 above.




An example using PowerPoint


Now that we’ve gone over through how this works, let’s walk through an example. We’ll configure the default save location for PowerPoint files and customize the AutoRecover frequency and AutoRecover save location for PowerPoint as well.


1. In the Azure portal, select All services, filter on Intune, then select Microsoft Intune.

2. Select Device configuration -> Profiles -> Create profile.

3. Enter the following settings:

    • Name: Enter a name for the profile, such as Customer PowerPoint Save Location.
    • Description: Enter a description for your profile.
    • Platform: Choose Windows 10 and later.
    • Profile type: Choose Custom

4. Under Custom OMA-URI Settings, select Add and enter the following settings:

    • Name: Enter a unique name for the OMA-URI setting to help you identify it in the list of settings.
    • Description: Enter a description that gives an overview of the setting, and any other important details.
    • OMA-URI (case sensitive): Enter the OMA-URI you want to use as a setting. In this example it will be ./User/Vendor/MSFT/Policy/Config/Office16~Policy~L_MicrosoftOfficePowerPoint~L_PowerPointOptions~L_Save
    • Data Type: String
    • Value: <enabled/><data id="L_defaultfilelocation0" value="default"/> 

So how did we know all that? We can see this in the Registry:




Looking in the ppt16.admx file (you can open it in Notepad) we can also see other important information that this setting uses:


<policy name="L_Defaultfilelocation" class="User" displayName="$(string.L_Defaultfilelocation)" explainText="$(string.L_Specifiesthedefaultlocationforpresentationfiles)" presentation="$(presentation.L_Defaultfilelocation)" key="software\policies\microsoft\office\16.0\powerpoint\options">

      <parentCategory ref="L_Save" />

      <supportedOn ref="windows:SUPPORTED_Windows7" />


        <text id="L_defaultfilelocation0" key="software\policies\microsoft\office\16.0\powerpoint\recentfolderlist" valueName="default" required="true" expandable="true" />




So when we’re done it should look something like this:




5. Select OK to save your changes. In this example I’m going to add a few other settings like L_AutoRecoversavefrequencyminutes as it will be enabled by just inputting the required settings (i.e. we do not need to add <enabled/>


<policy name="L_SaveAutoRecoverinfo" class="User" displayName="$(string.L_SaveAutoRecoverinfo)" explainText="$(string.L_CheckedCheckstheoptionSaveAutoRecoverinfoUncheckedUnchecksth)" presentation="$(presentation.L_SaveAutoRecoverinfo)" key="software\policies\microsoft\office\16.0\powerpoint\options">

      <parentCategory ref="L_Save" />

      <supportedOn ref="windows:SUPPORTED_Windows7" />


        <boolean id="L_EnablesaveAutoRecoverinfo" valueName="saveautorecoveryinfo">


            <decimal value="1" />



            <decimal value="0" />



        <decimal id="L_AutoRecoversavefrequencyminutes" valueName="frequencytosaveautorecoveryinfo" minValue="1" maxValue="9999" />

        <text id="L_AutoRecoversavelocation" valueName="pathtoautorecoveryinfo" expandable="true" />




This policy includes multiple values inside of it like, the highlighted ones above (boolean, decimal and text). For these kinds of policies, I suggest adding the ADMX inside windows policy definitions and the ADML files inside Policy Definition/en-us in order to review the policy settings and the parameters inside it. Using gpedit.msc and looking under Microsoft PowerPoint 2016 we can see the data inside these parameters to enable it.




Putting all this together, the settings from the Intune side to enable this policy are as follows:


  • OMA-URI: ./User/Vendor/MSFT/Policy/Config/ Office16~Policy~L_MicrosoftOfficePowerPoint~L_PowerPointOptions~L_Save/L_SaveAutoRecoverinfo
  • Data-Type: String
  • Value:

<data id="L_AutoRecoversavefrequencyminutes" value="1"/>

<data id="L_AutoRecoversavelocation" value="%USERPROFILE%\Application Data\Microsoft\PowerPoint"/>


It will look something like this:



When finished, choose OK and then Create to create your Intune profile. When complete, your profile will be shown under Device configuration -> Profiles.




This guide shows us the full cycle of ingesting ADMX files for Office and how to work with the policies inside, noting that each policy has its own configuration settings and that you need to be aware of how to deal with them to deliver them successfully to your targeted computers.


I also mentioned how some policies inside each ADMX file are different from other, and how you need to review the required policy from the administrative template since as it will show you a clear view of the settings included in each policy.


One last note: we have a new preview feature that has been recently added to Intune called Administrative Templates which include some of these same ingested settings, however at this point it does not yet include all of them.


Mohammed Abudayyeh

Intune Support Engineer

Senior Member

This is a great post. useful information about where to confirm the ADMX has come down correctly. I have used it to deploy OneDrive auto configure with great success. Makes Autopilot devices have an even better experience.


Is there any plans to allow the following registry location to be used?



I see this being useful to be able to auto Mount MS Team sites within OneDrive via AD groups (attached to the MS Teams Site). I know it is a beta feature of OneDrive, but seems like a great and integrated idea.


Very useful , helpful and great article thanks for the publish Mohammed.

Senior Member
Very useful post, thanks. With Intune now natively supporting 'Administrative Templates' (still in preview I know) I have to ask the question if manually ingesting the ADMX is still required for Office/ODB etc.. Any advice on why I should use one over the other would be really appreciated. One reason I can think of is that maybe 'Administrative Templates' does not yet cover all settings? Regards, Jan

@Alan - Thanks for the comment. We're always looking to improve and add new features so I'd suggest you post this on our UserVoice site here: https://microsoftintune.uservoice.com/forums/291681-ideas. The product team takes a great deal of direction from the ideas and feedback there so that's the best way to let them know what you'd like to see.


@Jan - That's a great question! Which one to use really comes down to whichever method does what you want, and for me, whichever one is easier. You're right that Administrative Templates don't yet cover all settings yet but we're working to expand that, and that method is probably the easier of the two to implement in most scenarios. The end result on the device should be the same either way so I'd say it comes down to personal preference right now. 

Frequent Visitor

@J.C. Hornbeck Great guide! But something is not working in our intune. I followed it step by step and imported the Office16.admx with the URI "./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/Office16/Policy/Office16Policy".

The Error in Intune ist just telling "-2016281112 (Remediation failed)". Then I looked it out lokal and get this Error (2. Screenshot). What is wrong? :manindifferent:



When I try it with the excel.admx it is working fine. Just not with the office16.admx



In the REG: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\AdmxInstalled\...\Office16\Policy\Office16Policy, there is now an entry with the Name: "ErrorMessage", Value: "hr=-2147024891,Tag=key,line=18266,pos=146,depth=3"



 Anmerkung 2019-03-19 155334.png

Occasional Contributor

Thanks for this. It's good that we can still deploy settings even though they aren't immediately available in the Administrative Templates section. It would be really nice to be able to actually ingest rather than drip feed an ADMX in, manually setting by setting. I feel like if everyone who had to use this method clubbed together we could pay someone to put in all these settings just once into the system so we didn't have to build them all manually. If we could even upload an ADMX and have it build the OMA-URI for us or... something ! Like I said, great that you've built in the flexibility but if GPOs worked like this I don't think I'd ever have got as far as I have.

Occasional Contributor

@SMP-BenI am getting the same issue, but with a different line number. I wonder if there is a size limit on the XML? The Office one is over 18,000 line long and the others are around 5000 or less. Can anyone confirm?



I Removed some policies from the file and reduced the size to 18251 lines, deleted the registry entry detailing the error and rebooted the machine and now it loaded the ADMX fine.