%3CLINGO-SUB%20id%3D%22lingo-sub-1254139%22%20slang%3D%22en-US%22%3ERe%3A%20Configuring%20Office%20365%20ProPlus%20updates%20for%20remote%20workers%20using%20VPN%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1254139%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%20great%20post%20that%20summarize%20options%20to%20manage%20O365%20updates.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20a%20question%20for%20option%202.%20if%20we%20have%20already%20downloaded%20the%20updates%20and%20made%20them%20available%20for%20our%20on-prem%20users%2C%20will%20it%20still%20work%3F%20Do%20we%20have%20to%20make%20sure%20that%20VPN%20clients%20will%20not%20fallback%20to%20any%20DP%2C%20so%20that%20they%20will%20for%20sure%20download%20from%20the%20CDN%2C%20while%20still%20being%20managed%20by%20configmgr%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESecond%20question%2C%20how%20can%20we%20be%20sure%20that%20they%20will%20not%20use%20delivery%20optimization%20between%20their%20vpn%20peers%20while%20they%20download%20the%20updates%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ethank%20in%20advance%20and%20don't%20hesitate%20if%20you%20have%20any%20questions.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1254914%22%20slang%3D%22en-US%22%3ERe%3A%20Configuring%20Office%20365%20ProPlus%20updates%20for%20remote%20workers%20using%20VPN%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1254914%22%20slang%3D%22en-US%22%3E%3CP%3EWhat%20about%20configuring%20'Prefer%20Cloud%20Distribution%20Points%20over%20Distribution%20Points'%20for%20VPN%20boundaries%3F%3C%2FP%3E%3CP%3EThe%20docs%20suggest%20that%20Microsoft%20Update%20is%20added%20as%20a%20cloud%20source%20in%201902%2C%20does%20this%20not%20include%20Office%20365%20content%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1254993%22%20slang%3D%22en-US%22%3ERe%3A%20Configuring%20Office%20365%20ProPlus%20updates%20for%20remote%20workers%20using%20VPN%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1254993%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Stewpollock%2C%3C%2FP%3E%0A%3CP%3EGreat%20question%20%3B)%3C%2Fimg%3E%3C%2FP%3E%0A%3CP%3EI%20guess%20you%20refer%20to%20this%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fconfigmgr%2Fcore%2Fservers%2Fdeploy%2Fconfigure%2Fboundary-groups%23bkmk_bgoptions4%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Edoc.%3C%2FA%3E%3CBR%20%2F%3EThe%20only%20way%20I%20know%20to%20use%20Office%20CDN%20content%20instead%20of%20Content%20on%20the%20DP%20is%20to%20not%20provide%20content%20on%20the%20DP%20to%20fallback%20to%20CDN.%3CBR%20%2F%3ESo%20my%20understanding%20is%20that%20%22Microsoft%20Update%22%20option%20does%20not%20apply%20to%20C2R%20products.%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F222575%22%20target%3D%22_blank%22%3E%40Dave%20Guenthner%3C%2FA%3E%26nbsp%3Bcan%20you%20confirm%20my%20understanding%3F%3CBR%20%2F%3EKind%20Regards%2C%3C%2FP%3E%0A%3CP%3EEsteban%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1255888%22%20slang%3D%22en-US%22%3ERe%3A%20Configuring%20Office%20365%20ProPlus%20updates%20for%20remote%20workers%20using%20VPN%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1255888%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F332021%22%20target%3D%22_blank%22%3E%40lalanc01%3C%2FA%3E%20Esteban's%20points%20are%20spot%20on.%26nbsp%3B%20SCCM%20uses%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice%2Fclient-developer%2Fshared%2Fmanageability-applications-with-the-office-365-click-to-run-installer%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EAPI%3C%2FA%3E%20and%20passes%20reference%20to%20use%20BITS%20as%20transport%20so%20DO%20won't%20be%20used%20when%20OfficeMgmtCom%20is%20Enabled.%26nbsp%3B%20For%20non-Office%20updates%20which%20may%20fall%20into%20scope%20for%20DO%20you%20may%20want%20to%20take%20a%20look%20at%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows%2Fdeployment%2Fupdate%2Fwaas-delivery-optimization-reference%23enable-peer-caching-while-the-device-connects-via-vpn%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EDO%20VPN%20GPO%3C%2FA%3E%20.%26nbsp%3B%20Based%20on%20initial%20testing%20you%20do%20need%20to%20ensure%20Office%20clients%20are%20directed%20to%20DPs%20where%20content%20is%20not%20present%20in%20order%20for%20fallback%20to%20cloud.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1255897%22%20slang%3D%22en-US%22%3ERe%3A%20Configuring%20Office%20365%20ProPlus%20updates%20for%20remote%20workers%20using%20VPN%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1255897%22%20slang%3D%22en-US%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CDIV%20class%3D%22lia-message-author-avatar%20lia-component-author-avatar%20lia-component-message-view-widget-author-avatar%20UserAvatarWrapper%22%20style%3D%22box-sizing%3A%20border-box%3B%20color%3A%20%23333333%3B%20display%3A%20inline-block%3B%20float%3A%20left%3B%20font-family%3A%20%26amp%3Bquot%3B%20segoeui%26amp%3Bquot%3B%2C%26amp%3Bquot%3Blato%26amp%3Bquot%3B%2C%26amp%3Bquot%3Bhelvetica%20neue%26amp%3Bquot%3B%2Chelvetica%2Carial%2Csans-serif%3B%20font-size%3A%2014px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20300%3B%20letter-spacing%3A%20normal%3B%20orphans%3A%202%3B%20padding-right%3A%2010px%3B%20position%3A%20relative%3B%20text-align%3A%20left%3B%20text-decoration%3A%20none%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20white-space%3A%20normal%3B%20word-spacing%3A%200px%3B%22%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F528300%22%20target%3D%22_blank%22%3E%40stewpollock%3C%2FA%3E%20'Prefer%20Cloud'%20is%20not%20working%20as%20expected%20for%20Office%20365%20Client%20Updates.%26nbsp%3B%20My%20tests%20show%20Client%20fetching%20updates%20from%20DP%20even%20with%20setting%20in%20place.%26nbsp%3B%20I've%20filed%20a%20bug%20for%20this%20issue%20and%20will%20add%20to%20FAQ%20for%20tracking.%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1258943%22%20slang%3D%22en-US%22%3ERe%3A%20Configuring%20Office%20365%20ProPlus%20updates%20for%20remote%20workers%20using%20VPN%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1258943%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F222575%22%20target%3D%22_blank%22%3E%40Dave%20Guenthner%3C%2FA%3E%26nbsp%3BThanks%20for%20testing%20this%2C%20will%20look%20forward%20to%20hearing%20an%20update%20r.e.%20the%20bug.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1259185%22%20slang%3D%22en-US%22%3ERe%3A%20Configuring%20Office%20365%20ProPlus%20updates%20for%20remote%20workers%20using%20VPN%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1259185%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F222575%22%20target%3D%22_blank%22%3E%40Dave%20Guenthner%3C%2FA%3E%2C%20thank%20you%20for%20the%20tests%2Fvalidations.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EJust%20wanted%20to%20be%20sure%2C%20yes%20sccm%20uses%20bits%20to%20download%20it's%20content%2C%20but%20if%20the%20content%20isn't%20there%20and%20tries%20to%20get%20it%20from%20the%20CDN%2C%20will%20it%20try%20to%20get%20the%20content%20from%20other%20peers%20in%20the%20same%20VPN%20subnet%2C%20using%20DO%20or%20will%20it%20always%20just%20get%20all%20the%20content%20from%20the%20CDN%20directly%3F%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3Ethks%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1259353%22%20slang%3D%22en-US%22%3ERe%3A%20Configuring%20Office%20365%20ProPlus%20updates%20for%20remote%20workers%20using%20VPN%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1259353%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F332021%22%20target%3D%22_blank%22%3E%40lalanc01%3C%2FA%3E%20When%20OfficeMgmtCOM%20is%20Enabled%2C%20only%20BITS%20transport%20will%20be%20used.%26nbsp%3B%20Therefore%2C%20with%20this%20configuration%20DO%20is%20out%20of%20scope.%26nbsp%3B%20To%20use%20DO%2C%20OfficeMgmtCOM%20must%20be%20Disabled.%26nbsp%3B%20When%20%3CSPAN%20style%3D%22display%3A%20inline%20!important%3B%20float%3A%20none%3B%20background-color%3A%20%23ffffff%3B%20color%3A%20%23333333%3B%20cursor%3A%20text%3B%20font-family%3A%20inherit%3B%20font-size%3A%2016px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20300%3B%20letter-spacing%3A%20normal%3B%20line-height%3A%201.7142%3B%20orphans%3A%202%3B%20text-align%3A%20left%3B%20text-decoration%3A%20none%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20white-space%3A%20normal%3B%20word-spacing%3A%200px%3B%22%3EOfficeMgmtCOM%3C%2FSPAN%3E%20is%20Enabled%20and%20content%20is%20not%20on%20DP%2C%20fallback%20to%20CDN%20will%20occur%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Foffice-365-proplus%2Fconfiguring-fallback-for-office-365-proplus-updates-in%2Fm-p%2F141358%22%20target%3D%22_self%22%3E(with%20the%20checkbox%20in%20the%20deployment)%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1254701%22%20slang%3D%22en-US%22%3ERe%3A%20Configuring%20Office%20365%20ProPlus%20updates%20for%20remote%20workers%20using%20VPN%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1254701%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Lalanc01%2C%3C%2FP%3E%0A%3CDIV%3EFor%20option2%2C%20The%20current%20behavior%20is%20when%20OfficeCOMMgmt%20is%20enabled%20AND%20Configuration%20Manager%20is%20triggering%20the%20update%2C%20Delivery%20Optimization%20is%20not%20used.%3C%2FDIV%3E%0A%3CP%3Ethis%20is%20documented%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fdeployoffice%2Fdelivery-optimization%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehere.%3C%2FA%3E%3CBR%20%2F%3E%3CSPAN%3E%22If%20you%E2%80%99re%20using%20Configuration%20Manager%20or%20local%20network%20shares%20to%20manage%20installing%20and%20updating%20Office%20365%20ProPlus%20on%20devices%2C%20Delivery%20Optimization%20won't%20be%20used.%26nbsp%3B%22.I%20don't%20think%20we%20use%20the%20peer%20cache%20configured%20when%20fallingback%20to%20CDN%20to%20get%20the%20content.Kind%20Regards%2C%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EEsteban%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1294382%22%20slang%3D%22en-US%22%3ERe%3A%20Configuring%20Office%20365%20ProPlus%20updates%20for%20remote%20workers%20using%20VPN%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1294382%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F528300%22%20target%3D%22_blank%22%3E%40stewpollock%3C%2FA%3E%20Thank%20you%20for%20bringing%20this%20issue%20to%20our%20attention.%26nbsp%3B%20Please%20see%20FAQ%20section%20as%20its%20been%20updated%20to%20reflect%20resolution.%20ConfigMgr%202002%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1456267%22%20slang%3D%22en-US%22%3ERe%3A%20Configuring%20Office%20365%20ProPlus%20updates%20for%20remote%20workers%20using%20VPN%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1456267%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F222575%22%20target%3D%22_blank%22%3E%40Dave%20Guenthner%3C%2FA%3E%26nbsp%3BDoes%20this%20configuration%20use%20Office365%20express%20updates%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1456280%22%20slang%3D%22en-US%22%3ERe%3A%20Configuring%20Office%20365%20ProPlus%20updates%20for%20remote%20workers%20using%20VPN%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1456280%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F696327%22%20target%3D%22_blank%22%3E%40SayeedM365%3C%2FA%3E%26nbsp%3BCan%20you%20rephrase%20the%20question%3F%26nbsp%3B%20Define%20the%20desired%20outcome%20as%20I'm%20not%20clear%20on%20the%20question.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1456796%22%20slang%3D%22en-US%22%3ERe%3A%20Configuring%20Office%20365%20ProPlus%20updates%20for%20remote%20workers%20using%20VPN%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1456796%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F222575%22%20target%3D%22_blank%22%3E%40Dave%20Guenthner%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHi%20Dave%2C%20what%20we're%20trying%20to%20achieve%20is%26nbsp%3B%3CSTRONG%3EOption%202%3A%20SCCM%20managed%20but%20offload%20content%20distribution%26nbsp%3B%3C%2FSTRONG%3Eas%20detailed%20in%20this%20article.%3C%2FP%3E%3CP%3ECurrently%20we%20have%20SCCM%20managing%20all%20the%20Office365%20client%20updates.%20I%20was%20just%20reading%20your%20other%20blog%20post%20here%3A%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Foffice-365-blog%2Funderstanding-office-365-proplus-updates-for-it-pros-cdn-vs-sccm%2Fba-p%2F795728%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Foffice-365-blog%2Funderstanding-office-365-proplus-updates-for-it-pros-cdn-vs-sccm%2Fba-p%2F795728%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20have%20VPN%20connected%20clients%20therefore%20we%20can't%20use%20peer%20cache%20or%20delivery%20optimisation.%20I'm%20trying%20to%20understand%20if%20clients%20will%20download%20the%20full%20data%20or%20just%20delta%20data%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1456886%22%20slang%3D%22en-US%22%3ERe%3A%20Configuring%20Office%20365%20ProPlus%20updates%20for%20remote%20workers%20using%20VPN%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1456886%22%20slang%3D%22en-US%22%3E%3CP%3EFor%20Office%2C%20updates%20are%20always%20a%20delta%2C%20it%20never%20pulls%20down%20the%20full%20source%20files%20to%20update%20the%20product.%20There%20are%20basically%20two%20types%20of%20delta%3A%20binary%20delta%20and%20regular%20delta.%20Update%20sizes%20are%20documented%20here%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fofficeupdates%2Fdownload-sizes-microsoft365-apps-updates%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fofficeupdates%2Fdownload-sizes-microsoft365-apps-updates%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIf%20Office%20updates%20to%20version%20N%20and%20the%20installed%20client%20is%20on%20N-1%2C%20it%20will%20download%20only%20the%20actual%20changes%20per%20file.%20E.g.%201K%20changed%20in%20excel.exe%2C%20it%20will%20download%20just%20this%201%20K%20instead%20of%20the%20(compressed)%2055MB%20excel.exe.%20This%20is%20called%20%22binary%20delta%22.%20As%20mentioned%2C%20this%20is%20leveraged%20when%20updates%20are%20only%20one%20release%20apart%20OR%20when%20a%20new%20SAEC-Preview%20comes%20along%20(e.g.%20from%202002%20to%202008)%20or%20a%20new%20SAEC%20(e.g.%20from%201902%20to%201908)%20for%20the%20first%20time.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIf%20installed%20version%20and%20targeted%20version%20are%20not%20in%20one%20of%20the%20above%20mentioned%20relations%20to%20each%20other%20(e.g.%20updating%20a%20machine%20which%20was%20offline%20for%20a%20while%20from%20Current%20Channel%202001%20to%20Current%20Channel%202004)%2C%20it%20will%20download%20each%20changed%20file%20(e.g.%20the%20compressed(!)%20excel.exe)%20and%20stage%20this%20on%20disk.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ENote%3A%20When%20assessing%20the%20update%20size%2C%20always%20measure%20what%20is%20actually%20going%20over%20the%20wire.%20Looking%20at%20files%20on%20disc%20is%20misleading%2C%20as%20these%20files%20are%20already%20decompressed%2C%20sometimes%20sparse%20files%20and%20merged%20from%20downloaded%20bits%20and%20files%20already%20on%20disk.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1253491%22%20slang%3D%22en-US%22%3EConfiguring%20Office%20365%20ProPlus%20updates%20for%20remote%20workers%20using%20VPN%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1253491%22%20slang%3D%22en-US%22%3E%3CP%3EDue%20to%20the%20dynamic%20situation%20with%20COVID-19%20many%20IT%20pros%20are%20being%20challenged%20to%20assess%20ways%20to%20configure%20Office%20365%20Client%20to%20update%20directly%20from%20Microsoft%20CDN.%20Today%2C%20the%20majority%20of%20customers%20I%20engage%20with%20manage%20updates%20using%20Configuration%20Manager%20(ConfigMgr)%2C%20predominately%20on-premises.%20The%20objective%20of%20this%20posting%20is%20how%20to%20minimize%20internet%20egress%20through%20customer%20VPN%20network%20for%20Office%20updates.%26nbsp%3B%20We%20also%20have%20guidance%20for%20initial%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Foffice-365-blog%2Fdeploy-office-365-proplus-to-remote-workers%2Fba-p%2F1258514%22%20target%3D%22_blank%22%20rel%3D%22noopener%22%3Eremote%20install%3C%2FA%3E%20and%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fdeployoffice%2Ffieldnotes%2Fbuild-dynamic-lean-universal-packages%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3Esecond%20installs%20(e.g.%20Visio%2FProject)%3C%2FA%3E%20of%20Office.%26nbsp%3B%20Further%2C%20we%20offer%20additional%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Foffice-365-blog%2Fhow-to-secure-your-remote-workers-with-office-cloud-policy%2Fba-p%2F1308579%22%20target%3D%22_blank%22%20rel%3D%22noopener%22%3Efree%20security%20layer%3C%2FA%3E%20to%20protect%20machines%20whether%20they%20are%26nbsp%3B%20on-premises%20or%20remote%20regardless%20if%20machine%20is%20%22managed%22%20or%20not.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20class%3D%22lia-align-center%22%20id%3D%22toc-hId--1383125388%22%20id%3D%22toc-hId--1383125388%22%3E%3CSTRONG%3ENetwork%20considerations%3C%2FSTRONG%3E%3C%2FH2%3E%0A%3CP%3EThere%20are%20an%20infinite%20number%20of%20ways%20customers%20configure%20network%20access%2C%20no%20two%20customers%20are%20identical%20in%20configuration.%26nbsp%3B%20Speaking%20generally%2C%20the%20VPN%20client%20needs%20to%20support%20split%20tunneling%20or%20be%20configured%20so%20network%20traffic%20destined%20for%20Office%20365%20are%20directed%20to%20internet%20and%20are%20not%20required%20to%20pass%20through%20VPN%20Server.%26nbsp%3B%20Microsoft%20provides%20a%20list%20of%20all%20Office%20365%20URLs%20and%20IP%20address%20ranges%20in%20the%20following%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fenterprise%2Furls-and-ip-address-ranges%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3Edocument%3C%2FA%3E.%26nbsp%3B%20Some%20customers%20have%20VPN%20clients%20dynamically%20aware%20of%20Office%20365%20Services%20using%20Microsoft%20Graph%20API%2C%20some%20support%20URLs%20and%20others%20only%20support%20IP%20exclusions.%26nbsp%3B%20You%E2%80%99ll%20notice%20item(s)%2090%20and%2092%20which%20provide%20specific%20URLs%20used%20by%20the%20Office%20365%20Client%20to%20perform%20updates.%3C%2FP%3E%0A%3CTABLE%20width%3D%2296%25%22%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTD%3E%3CP%3E%3CFONT%20size%3D%221%22%20style%3D%22box-sizing%3A%20border-box%3B%20color%3A%20%23333333%3B%20font-family%3A%20%26amp%3Bquot%3B%20segoeui%26amp%3Bquot%3B%2C%26amp%3Bquot%3Blato%26amp%3Bquot%3B%2C%26amp%3Bquot%3Bhelvetica%20neue%26amp%3Bquot%3B%2Chelvetica%2Carial%2Csans-serif%3B%20font-size%3A%2010.06px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20300%3B%20letter-spacing%3A%20normal%3B%20orphans%3A%202%3B%20text-align%3A%20left%3B%20text-decoration%3A%20none%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20white-space%3A%20normal%3B%20word-spacing%3A%200px%3B%22%3E90%3C%2FFONT%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3E%3CFONT%20size%3D%221%22%3EDefault%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20size%3D%221%22%3ERequired%3C%2FFONT%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3E%3CFONT%20size%3D%221%22%3Emrodevicemgr.officeapps.live.com%20(Description%3A%20Device%20Management%20Service%20(DMS)%20is%20used%20to%20advertise%20the%20C2R%20builds%20to%20the%20machines%20which%20are%20non-admin%20managed%20based%20on%20the%20meta%20data%20passed%20by%20the%20machine.)%3C%2FFONT%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3E%3CFONT%20size%3D%221%22%3E%3CSTRONG%3ETCP%3A%20%3C%2FSTRONG%3E443%3C%2FFONT%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CP%3E%3CFONT%20size%3D%221%22%3E92%3C%2FFONT%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3E%3CFONT%20size%3D%221%22%3EDefault%3C%2FFONT%3E%3CBR%20%2F%3E%3CFONT%20size%3D%221%22%3ERequired%3C%2FFONT%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3E%3CFONT%20size%3D%221%22%3Eofficecdn.microsoft.com%2C%20officecdn.microsoft.com.edgesuite.net%20(Description%3A%20Office%20CDN%20where%20content%20is%20downloaded)%3C%2FFONT%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3E%3CFONT%20size%3D%221%22%3E%3CSTRONG%3ETCP%3A%3C%2FSTRONG%3E%20443%2C%2080%3C%2FFONT%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EConcerning%20Office%20updates%2C%20one%20challenge%20is%20that%20the%20CNAME%20officecdn.microsoft.com%20doesn't%20belong%20to%20the%20%22optimize%22%20category.%26nbsp%3B%20Therefore%2C%20the%20IP%20addresses%20which%20may%20be%20defined%20for%20VPN%20Forced%20Tunnel%20with%20exceptions%20won't%20include%20OfficeCDN%20IP%20addresses%20(hosted%20by%20Akamai)%20so%20Office%20updates%20will%20be%20directed%20to%20the%20VPN%20tunnel%20and%20back%20to%20corporate.%26nbsp%3B%20If%20you%20have%20VPN%20Selective%20Tunnel%20implemented%2C%20then%20all%20network%20traffic%20for%20Office%20updates%20will%20go%20directly%20to%20the%20internet.%26nbsp%3B%20Reviewing%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fenterprise%2Foffice-365-vpn-implement-split-tunnel%23common-vpn-scenarios%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ecommon%20VPN%20scenarios%3C%2FA%3E%20and%20comparing%20it%20to%20your%20environment%20is%20an%20important%20first%20step.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETip%3A%20Please%20review%20blog%20posting%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Foffice-365-blog%2Fhow-to-quickly-optimize-office-365-traffic-for-remote-staff-amp%2Fba-p%2F1214571%22%20target%3D%22_blank%22%20rel%3D%22noopener%22%3E%3CFONT%20face%3D%22SegoeUI%2CLato%2C%26quot%3BHelvetica%20Neue%26quot%3B%2CHelvetica%2CArial%2Csans-serif%22%20style%3D%22background-color%3A%20%23ffffff%3B%22%3EHow%20to%20quickly%20optimize%20Office%20365%20traffic%20for%20remote%20staff%20%26amp%3B%20reduce%20the%20load%20on%20your%20infrastructure%3C%2FFONT%3E%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%3CFONT%20face%3D%22SegoeUI%2CLato%2C%26quot%3BHelvetica%20Neue%26quot%3B%2CHelvetica%2CArial%2Csans-serif%22%20style%3D%22background-color%3A%20%23ffffff%3B%22%3ETip%3A%20Please%20review%20blog%20posting%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fconfiguration-manager-blog%2Fmanaging-remote-machines-with-cloud-management-gateway-in%2Fba-p%2F1233895%22%20target%3D%22_blank%22%20rel%3D%22noopener%22%3EManaging%20remote%20machines%20with%20cloud%20management%20gateway%20in%20Microsoft%20Endpoint%20Configuration%20Manager%3C%2FA%3E%20%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20class%3D%22lia-align-center%22%20id%3D%22toc-hId-1104387445%22%20id%3D%22toc-hId-1104387445%22%3E%3CSTRONG%3EBackground%20on%20how%20Office%20365%20Client%20works%20by%20default%3C%2FSTRONG%3E%3C%2FH2%3E%0A%3CP%3EOffice%20365%20ProPlus%20is%20designed%20by%20default%20to%20update%20from%20CDN.%26nbsp%3B%20A%20scheduled%20task%20called%20%E2%80%9COffice%20Automatic%20Updates%202.0%E2%80%9D%20uses%20a%20trigger%20to%20routinely%20check%20for%20updates%20as%20advertised%20by%20DMS%20service.%26nbsp%3B%20The%20Office%20client%20will%20always%20move%20to%20the%20latest%20version%5Cbuild%20available%20by%20assigned%20channel%20documented%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fofficeupdates%2Fupdate-history-office365-proplus-by-date%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehere%3C%2FA%3E.%26nbsp%3B%20%3CSPAN%20style%3D%22display%3A%20inline%20!important%3B%20float%3A%20none%3B%20background-color%3A%20%23ffffff%3B%20color%3A%20%23333333%3B%20cursor%3A%20text%3B%20font-family%3A%20inherit%3B%20font-size%3A%2016px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20300%3B%20letter-spacing%3A%20normal%3B%20line-height%3A%201.7142%3B%20orphans%3A%202%3B%20text-align%3A%20left%3B%20text-decoration%3A%20none%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20white-space%3A%20normal%3B%20word-spacing%3A%200px%3B%22%3EDocumentation%20around%20what%20to%20expect%20from%20a%20user%20experience%20when%20updates%20are%20delivered%20from%20CDN%20can%20be%20found%20%3C%2FSPAN%3E%3CA%20style%3D%22background-color%3A%20transparent%3B%20box-sizing%3A%20border-box%3B%20color%3A%20%23146cac%3B%20font-family%3A%20%26amp%3Bquot%3B%20segoeui%26amp%3Bquot%3B%2C%26amp%3Bquot%3Blato%26amp%3Bquot%3B%2C%26amp%3Bquot%3Bhelvetica%20neue%26amp%3Bquot%3B%2Chelvetica%2Carial%2Csans-serif%3B%20font-size%3A%2016px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20300%3B%20letter-spacing%3A%20normal%3B%20orphans%3A%202%3B%20text-align%3A%20left%3B%20text-decoration%3A%20underline%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20white-space%3A%20normal%3B%20word-spacing%3A%200px%3B%22%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fdeployoffice%2Fend-user-update-notifications-for-office-365-proplus%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehere.%3C%2FA%3E%3CSPAN%20style%3D%22display%3A%20inline%20!important%3B%20float%3A%20none%3B%20background-color%3A%20%23ffffff%3B%20color%3A%20%23333333%3B%20cursor%3A%20text%3B%20font-family%3A%20inherit%3B%20font-size%3A%2016px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20300%3B%20letter-spacing%3A%20normal%3B%20line-height%3A%201.7142%3B%20orphans%3A%202%3B%20text-align%3A%20left%3B%20text-decoration%3A%20none%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20white-space%3A%20normal%3B%20word-spacing%3A%200px%3B%22%3E%26nbsp%3B%20If%20ConfigMgr%20Office%20365%20Client%20Management%20integration%20is%20enabled%20by%20Configuration.xml%20during%20initial%20installation%2C%20ConfigMgr%20Client%20settings%2C%20or%20Domain%20Policy%2C%20the%20scheduled%20task%20will%20continue%20to%20execute%20but%20will%20only%20perform%20software%20updates%20from%20ConfigMgr.%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20class%3D%22lia-align-center%22%20style%3D%22box-sizing%3A%20border-box%3B%20color%3A%20inherit%3B%20font-family%3A%20inherit%3B%20font-size%3A%2024px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20normal%3B%20letter-spacing%3A%20normal%3B%20line-height%3A%201.2%3B%20margin-bottom%3A%2012px%3B%20margin-top%3A%2024px%3B%20orphans%3A%202%3B%20text-align%3A%20center%3B%20text-decoration%3A%20none%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20white-space%3A%20normal%3B%20word-spacing%3A%200px%3B%22%20id%3D%22toc-hId--703067018%22%20id%3D%22toc-hId--703067018%22%3E%3CSTRONG%3EOptions%20available%20to%20update%20from%20CDN%3C%2FSTRONG%3E%3C%2FH2%3E%0A%3CP%3E%3CSTRONG%3EOption%201%3A%20Cloud%20managed%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3ESteps%3A%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EDisable%20OfficeMgmtCOM%20(required%20if%20previously%20ConfigMgr%20managed)%3CUL%3E%0A%3CLI%3E%3CSPAN%20style%3D%22display%3A%20inline%20!important%3B%20float%3A%20none%3B%20background-color%3A%20%23ffffff%3B%20color%3A%20%23333333%3B%20cursor%3A%20text%3B%20font-family%3A%20inherit%3B%20font-size%3A%2016px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20300%3B%20letter-spacing%3A%20normal%3B%20line-height%3A%201.7142%3B%20orphans%3A%202%3B%20text-align%3A%20left%3B%20text-decoration%3A%20none%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20white-space%3A%20normal%3B%20word-spacing%3A%200px%3B%22%3EOn%20the%20next%20restart%20of%20Microsoft%20Office%20Click-to-Run%20Service%2C%20Office%20COM%20application%20will%20de-registered.%26nbsp%3B%20%3C%2FSPAN%3EAllows%20Office%20Client%20to%20do%20its%20thing%20and%20get%20updates%20from%20the%20CDN.%20%26nbsp%3B%3C%2FLI%3E%0A%3CLI%3EThis%20can%20be%20done%20by%20changing%20client%20settings%20in%20ConfigMgr%20or%20by%20Group%20Policy.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FLI%3E%0A%3CLI%3ESet%20UpdatesEnabled%20GPO%20to%20True%20(optional)%3CUL%3E%0A%3CLI%3EAllows%20the%20client%20to%20resume%20normal%20update%20checks%20from%20the%20CDN%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FLI%3E%0A%3CLI%3EUpdateDeadline%20GPO%20as%20an%20integer%20(optional)%20in%20days%20(ex.%2012)%20to%20ensure%20the%20client%20is%20updated%20to%20ensure%20compliance.%26nbsp%3B%20Using%20an%20integer%20value%20allows%20the%20admin%20to%20not%20have%20to%20continually%20change%20the%20date%20to%20a%20future%20date%2Ftime%20for%20every%20update.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CSTRONG%3EOption%202%3A%20SCCM%20managed%20but%20offload%20content%20distribution%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3EUse%20normal%20deploy%20software%20updates%20wizard%20within%20ConfigMgr%20console%20selecting%20deploy%20option.%20When%20completing%20deployment%20package%20screen%2C%20it%20is%20important%20to%20select%20option%20%3CSTRONG%3E%E2%80%9CNo%20deployment%20package%E2%80%9D%3C%2FSTRONG%3E.%20In%20this%20way%2C%20clients%20will%20download%20content%20directly%20from%20CDN%20but%20keep%20existing%20controls%20and%20user%20experience%20during%20software%20update%20workflow.%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3ESteps%3A%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Deploy1.png%22%20style%3D%22width%3A%20531px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F179481iC9E166104E9ED1CD%2Fimage-dimensions%2F531x191%3Fv%3D1.0%22%20width%3D%22531%22%20height%3D%22191%22%20role%3D%22button%22%20title%3D%22Deploy1.png%22%20alt%3D%22Deploy1.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22NoDeployPackage.png%22%20style%3D%22width%3A%20528px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F179482i95D9423F81C68871%2Fimage-dimensions%2F528x468%3Fv%3D1.0%22%20width%3D%22528%22%20height%3D%22468%22%20role%3D%22button%22%20title%3D%22NoDeployPackage.png%22%20alt%3D%22NoDeployPackage.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EFAQ%3A%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EHow%20can%20I%20verify%20ConfigMgr%20integration%20is%20disabled%3F%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3EStart%20-%26gt%3B%20Run%20-%26gt%3B%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3Edcomcnfg%3C%2FFONT%3E.exe%20and%20look%20for%20presence%20of%20OfficeC2Rcom%20application.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22COMEnabled.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F179483iEBF62DA4616C55C3%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22COMEnabled.png%22%20alt%3D%22COMEnabled.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22COMDisabled.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F179484iB58176B9F8DBBB08%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22COMDisabled.png%22%20alt%3D%22COMDisabled.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EWhere%20in%20the%20Office%20logs%20can%20I%20confirm%20Office%20updates%20are%20coming%20from%20CDN%3F%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3EUse%26nbsp%3B%3CA%20href%3D%22http%3A%2F%2Faka.ms%2Foffice365logcollector%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttp%3A%2F%2Faka.ms%2Foffice365logcollector%3C%2FA%3E%20to%20collect%20Office%20logs%20or%20search%20for%20files%20in%20C%3A%5Cwindows%5Ctemp%20which%20have%20your%20NetBIOS%20name%20like%26nbsp%3B%3CFONT%20face%3D%22SegoeUI%2CLato%2C%26quot%3BHelvetica%20Neue%26quot%3B%2CHelvetica%2CArial%2Csans-serif%22%20style%3D%22background-color%3A%20%23ffffff%3B%22%3EMININT-314VFT4-20200318-0857.log.%26nbsp%3B%20(There%20will%20be%20a%20bunch%20of%20them).%26nbsp%3B%20Use%20your%20favorite%20text%20editor%20to%20search%20for%20strings%20like%20'officecdn.microsoft.com'%20or%20the%20build%20number%20you%20deployed.%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CFONT%20face%3D%22SegoeUI%2CLato%2C%26quot%3BHelvetica%20Neue%26quot%3B%2CHelvetica%2CArial%2Csans-serif%22%20style%3D%22background-color%3A%20%23ffffff%3B%22%3EStarting%20with%20version%201902%2C%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fconfigmgr%2Fcore%2Fservers%2Fdeploy%2Fconfigure%2Fboundary-groups%23bkmk_bgoptions4%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3E'Prefer%20cloud%20based%20sources%20over%20on-premise%20sources'%3C%2FA%3E%3C%2FFONT%3E%20allows%20IT%20Pro%20to%20prioritize%20Cloud%20content.%26nbsp%3B%20Does%20this%20feature%20extend%5Csupport%20Office%20365%20Client%20updates%3F%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CEM%3E%3CSTRONG%3E%3CFONT%20color%3D%22%23000000%22%3E%3CU%3E**Updated%2010%2F28%2F2020**%26nbsp%3B%3C%2FU%3E%3C%2FFONT%3E%3C%2FSTRONG%3E%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3EThe%20fix%20for%20this%20was%20not%20included%20in%202002%20as%20originally%20expected%20and%20is%20still%20under%20development.%26nbsp%3B%20We%20expect%20technical%20preview%20in%20coming%20weeks%20available%20for%20testing.%26nbsp%3B%20Please%20see%20official%20guidance%20for%20latest%20updates%20on%20this%20specific%20issue%3A%3C%2FP%3E%0A%3CP%3E%3CA%20title%3D%22Manage%20Microsoft%20365%20Apps%20with%20Configuration%20Manager%22%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmem%2Fconfigmgr%2Fsum%2Fdeploy-use%2Fmanage-office-365-proplus-updates%23limitations%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3EManage%20Microsoft%20365%20Apps%20with%20Configuration%20Manager%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fmem%2Fconfigmgr%2Fcore%2Fplan-design%2Fhierarchy%2Fuse-a-cloud-based-distribution-point%23limitations%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3EUse%20a%20cloud%20distribution%20point%20in%20Configuration%20Manager%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%5Boriginal%20statement%20below%5D%3C%2FP%3E%0A%3CP%3ENo%2C%20this%20appears%20to%20be%20a%20bug%20which%20is%20under%20investigation.%26nbsp%3B%20Workaround%20is%20to%20ensure%20Distribution%20Points%20used%20by%20VPN%20clients%20do%20not%20host%20Office%20365%20Client%20updates%20resulting%20in%20error%20404.%26nbsp%3B%20If%20the%20software%20deployment%20has%20selection%26nbsp%3B%3CFONT%20face%3D%22SegoeUI%2CLato%2C%26quot%3BHelvetica%20Neue%26quot%3B%2CHelvetica%2CArial%2Csans-serif%22%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E%E2%80%98If%20software%20updates%20are%20not%20available%20on%20distribution%20point%20in%20current%2C%20neighbor%20or%20site%20boundary%20groups%2C%20download%20content%20from%20Microsoft%20Updates'%2C%20this%20should%20allow%20new%20location%20of%20CDN%20fallback%20to%20be%20used.%26nbsp%3B%20I%20will%20update%20this%20item%20with%20updates%20when%20available.%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId-1941579500%22%20style%3D%22box-sizing%3A%20border-box%3B%20font-family%3A%20SegoeUI%2C%20Lato%2C%20'Helvetica%20Neue'%2C%20Helvetica%2C%20Arial%2C%20sans-serif%3B%20font-weight%3A%20normal%3B%20line-height%3A%201.2%3B%20color%3A%20%23333333%3B%20margin%3A%200px%3B%20font-size%3A%2024px%3B%20font-style%3A%20normal%3B%20font-variant-ligatures%3A%20normal%3B%20font-variant-caps%3A%20normal%3B%20letter-spacing%3A%20normal%3B%20orphans%3A%202%3B%20text-align%3A%20left%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20white-space%3A%20normal%3B%20widows%3A%202%3B%20word-spacing%3A%200px%3B%20-webkit-text-stroke-width%3A%200px%3B%20background-color%3A%20%23ffffff%3B%20text-decoration-style%3A%20initial%3B%20text-decoration-color%3A%20initial%3B%22%20id%3D%22toc-hId-1784445815%22%20id%3D%22toc-hId-1784445815%22%3E%3CFONT%20size%3D%224%22%20style%3D%22box-sizing%3A%20border-box%3B%22%3EThe%20Authors%3C%2FFONT%3E%3C%2FH2%3E%0A%3CP%20style%3D%22box-sizing%3A%20border-box%3B%20margin%3A%200px%3B%20font-family%3A%20SegoeUI%2C%20Lato%2C%20'Helvetica%20Neue'%2C%20Helvetica%2C%20Arial%2C%20sans-serif%3B%20color%3A%20%23333333%3B%20font-size%3A%2016px%3B%20font-style%3A%20normal%3B%20font-variant-ligatures%3A%20normal%3B%20font-variant-caps%3A%20normal%3B%20font-weight%3A%20300%3B%20letter-spacing%3A%20normal%3B%20orphans%3A%202%3B%20text-align%3A%20left%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20white-space%3A%20normal%3B%20widows%3A%202%3B%20word-spacing%3A%200px%3B%20-webkit-text-stroke-width%3A%200px%3B%20background-color%3A%20%23ffffff%3B%20text-decoration-style%3A%20initial%3B%20text-decoration-color%3A%20initial%3B%22%3EThis%20blog%20post%20is%20brought%20to%20you%20by%20Dave%20Guenthner%20and%20Martin%20Nothnagel%2C%20two%20ProPlus%20Rangers%20at%20Microsoft.%26nbsp%3B%20We%E2%80%99re%20looking%20forward%20to%20your%20questions%20and%20feedback%20in%20the%20comments%20below.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-1253491%22%20slang%3D%22en-US%22%3E%3CP%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3ELearn%20how%20to%20reduce%20the%20load%20on%20your%20network%20quickly%20by%20enabling%20Office%20365%20ProPlus%20to%20receive%20updates%20from%20the%20cloud%20and%20stay%20in%20control.%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22BlogDefault.png%22%20style%3D%22width%3A%20200px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F179480i775F7F55A1283830%2Fimage-size%2Fsmall%3Fv%3D1.0%26amp%3Bpx%3D200%22%20role%3D%22button%22%20title%3D%22BlogDefault.png%22%20alt%3D%22BlogDefault.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1253491%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3Ec2r%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Enetwork%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%20ProPlus%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESCCM%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Evpn%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Microsoft

Due to the dynamic situation with COVID-19 many IT pros are being challenged to assess ways to configure Office 365 Client to update directly from Microsoft CDN. Today, the majority of customers I engage with manage updates using Configuration Manager (ConfigMgr), predominately on-premises. The objective of this posting is how to minimize internet egress through customer VPN network for Office updates.  We also have guidance for initial remote install and second installs (e.g. Visio/Project) of Office.  Further, we offer additional free security layer to protect machines whether they are  on-premises or remote regardless if machine is "managed" or not.

 

Network considerations

There are an infinite number of ways customers configure network access, no two customers are identical in configuration.  Speaking generally, the VPN client needs to support split tunneling or be configured so network traffic destined for Office 365 are directed to internet and are not required to pass through VPN Server.  Microsoft provides a list of all Office 365 URLs and IP address ranges in the following document.  Some customers have VPN clients dynamically aware of Office 365 Services using Microsoft Graph API, some support URLs and others only support IP exclusions.  You’ll notice item(s) 90 and 92 which provide specific URLs used by the Office 365 Client to perform updates.

90

Default
Required

mrodevicemgr.officeapps.live.com (Description: Device Management Service (DMS) is used to advertise the C2R builds to the machines which are non-admin managed based on the meta data passed by the machine.)

TCP: 443

92

Default
Required

officecdn.microsoft.com, officecdn.microsoft.com.edgesuite.net (Description: Office CDN where content is downloaded)

TCP: 443, 80

 

Concerning Office updates, one challenge is that the CNAME officecdn.microsoft.com doesn't belong to the "optimize" category.  Therefore, the IP addresses which may be defined for VPN Forced Tunnel with exceptions won't include OfficeCDN IP addresses (hosted by Akamai) so Office updates will be directed to the VPN tunnel and back to corporate.  If you have VPN Selective Tunnel implemented, then all network traffic for Office updates will go directly to the internet.  Reviewing common VPN scenarios and comparing it to your environment is an important first step.

 

Tip: Please review blog posting How to quickly optimize Office 365 traffic for remote staff & reduce the load on your infrastructure

Tip: Please review blog posting Managing remote machines with cloud management gateway in Microsoft Endpoint Configuration Manager

 

Background on how Office 365 Client works by default

Office 365 ProPlus is designed by default to update from CDN.  A scheduled task called “Office Automatic Updates 2.0” uses a trigger to routinely check for updates as advertised by DMS service.  The Office client will always move to the latest version\build available by assigned channel documented hereDocumentation around what to expect from a user experience when updates are delivered from CDN can be found here.  If ConfigMgr Office 365 Client Management integration is enabled by Configuration.xml during initial installation, ConfigMgr Client settings, or Domain Policy, the scheduled task will continue to execute but will only perform software updates from ConfigMgr. 

 

Options available to update from CDN

Option 1: Cloud managed

Steps:

  • Disable OfficeMgmtCOM (required if previously ConfigMgr managed)
    • On the next restart of Microsoft Office Click-to-Run Service, Office COM application will de-registered.  Allows Office Client to do its thing and get updates from the CDN.  
    • This can be done by changing client settings in ConfigMgr or by Group Policy.
  • Set UpdatesEnabled GPO to True (optional)
    • Allows the client to resume normal update checks from the CDN
  • UpdateDeadline GPO as an integer (optional) in days (ex. 12) to ensure the client is updated to ensure compliance.  Using an integer value allows the admin to not have to continually change the date to a future date/time for every update.

Option 2: SCCM managed but offload content distribution

Use normal deploy software updates wizard within ConfigMgr console selecting deploy option. When completing deployment package screen, it is important to select option “No deployment package”. In this way, clients will download content directly from CDN but keep existing controls and user experience during software update workflow.

Steps:

Deploy1.png

NoDeployPackage.png

FAQ:

How can I verify ConfigMgr integration is disabled?

Start -> Run ->dcomcnfg.exe and look for presence of OfficeC2Rcom application.

COMEnabled.png

COMDisabled.png

Where in the Office logs can I confirm Office updates are coming from CDN?

Use http://aka.ms/office365logcollector to collect Office logs or search for files in C:\windows\temp which have your NetBIOS name like MININT-314VFT4-20200318-0857.log.  (There will be a bunch of them).  Use your favorite text editor to search for strings like 'officecdn.microsoft.com' or the build number you deployed.

 

Starting with version 1902, 'Prefer cloud based sources over on-premise sources' allows IT Pro to prioritize Cloud content.  Does this feature extend\support Office 365 Client updates?

**Updated 10/28/2020** 

The fix for this was not included in 2002 as originally expected and is still under development.  We expect technical preview in coming weeks available for testing.  Please see official guidance for latest updates on this specific issue:

Manage Microsoft 365 Apps with Configuration Manager

Use a cloud distribution point in Configuration Manager

 

[original statement below]

No, this appears to be a bug which is under investigation.  Workaround is to ensure Distribution Points used by VPN clients do not host Office 365 Client updates resulting in error 404.  If the software deployment has selection ‘If software updates are not available on distribution point in current, neighbor or site boundary groups, download content from Microsoft Updates', this should allow new location of CDN fallback to be used.  I will update this item with updates when available.

 

The Authors

This blog post is brought to you by Dave Guenthner and Martin Nothnagel, two ProPlus Rangers at Microsoft.  We’re looking forward to your questions and feedback in the comments below.

14 Comments
Senior Member

Hi, great post that summarize options to manage O365 updates.

 

I have a question for option 2. if we have already downloaded the updates and made them available for our on-prem users, will it still work? Do we have to make sure that VPN clients will not fallback to any DP, so that they will for sure download from the CDN, while still being managed by configmgr?

 

Second question, how can we be sure that they will not use delivery optimization between their vpn peers while they download the updates?

 

thank in advance and don't hesitate if you have any questions.

Hi Lalanc01,

For option2, The current behavior is when OfficeCOMMgmt is enabled AND Configuration Manager is triggering the update, Delivery Optimization is not used.

this is documented here.
"If you’re using Configuration Manager or local network shares to manage installing and updating Office 365 ProPlus on devices, Delivery Optimization won't be used. ".
I don't think we use the peer cache configured when fallingback to CDN to get the content.
Kind Regards,

Esteban

Senior Member

What about configuring 'Prefer Cloud Distribution Points over Distribution Points' for VPN boundaries?

The docs suggest that Microsoft Update is added as a cloud source in 1902, does this not include Office 365 content?

Hi Stewpollock,

Great question ;)

I guess you refer to this doc.
The only way I know to use Office CDN content instead of Content on the DP is to not provide content on the DP to fallback to CDN.
So my understanding is that "Microsoft Update" option does not apply to C2R products.
@Dave Guenthner can you confirm my understanding?
Kind Regards,

Esteban

Microsoft

@lalanc01 Esteban's points are spot on.  SCCM uses API and passes reference to use BITS as transport so DO won't be used when OfficeMgmtCom is Enabled.  For non-Office updates which may fall into scope for DO you may want to take a look at DO VPN GPO .  Based on initial testing you do need to ensure Office clients are directed to DPs where content is not present in order for fallback to cloud.

Microsoft

 

@stewpollock 'Prefer Cloud' is not working as expected for Office 365 Client Updates.  My tests show Client fetching updates from DP even with setting in place.  I've filed a bug for this issue and will add to FAQ for tracking.
Senior Member

@Dave Guenthner Thanks for testing this, will look forward to hearing an update r.e. the bug.

Senior Member

@Dave Guenthner, thank you for the tests/validations.

 

Just wanted to be sure, yes sccm uses bits to download it's content, but if the content isn't there and tries to get it from the CDN, will it try to get the content from other peers in the same VPN subnet, using DO or will it always just get all the content from the CDN directly?

 

thks

Microsoft

@lalanc01 When OfficeMgmtCOM is Enabled, only BITS transport will be used.  Therefore, with this configuration DO is out of scope.  To use DO, OfficeMgmtCOM must be Disabled.  When OfficeMgmtCOM is Enabled and content is not on DP, fallback to CDN will occur (with the checkbox in the deployment)

Microsoft

@stewpollock Thank you for bringing this issue to our attention.  Please see FAQ section as its been updated to reflect resolution. ConfigMgr 2002

Senior Member

@Dave Guenthner Does this configuration use Office365 express updates?

Microsoft

@SayeedM365 Can you rephrase the question?  Define the desired outcome as I'm not clear on the question.

Senior Member

@Dave Guenthner 

Hi Dave, what we're trying to achieve is Option 2: SCCM managed but offload content distribution as detailed in this article.

Currently we have SCCM managing all the Office365 client updates. I was just reading your other blog post here:

https://techcommunity.microsoft.com/t5/office-365-blog/understanding-office-365-proplus-updates-for-...

 

We have VPN connected clients therefore we can't use peer cache or delivery optimisation. I'm trying to understand if clients will download the full data or just delta data?

For Office, updates are always a delta, it never pulls down the full source files to update the product. There are basically two types of delta: binary delta and regular delta. Update sizes are documented here: https://docs.microsoft.com/en-us/officeupdates/download-sizes-microsoft365-apps-updates

 

If Office updates to version N and the installed client is on N-1, it will download only the actual changes per file. E.g. 1K changed in excel.exe, it will download just this 1 K instead of the (compressed) 55MB excel.exe. This is called "binary delta". As mentioned, this is leveraged when updates are only one release apart OR when a new SAEC-Preview comes along (e.g. from 2002 to 2008) or a new SAEC (e.g. from 1902 to 1908) for the first time.

 

If installed version and targeted version are not in one of the above mentioned relations to each other (e.g. updating a machine which was offline for a while from Current Channel 2001 to Current Channel 2004), it will download each changed file (e.g. the compressed(!) excel.exe) and stage this on disk.

 

Note: When assessing the update size, always measure what is actually going over the wire. Looking at files on disc is misleading, as these files are already decompressed, sometimes sparse files and merged from downloaded bits and files already on disk.