How to keep Office 2016 up-2-date ?

There are many ways to do this and it can become cumbersome especially with Office 2016 updates being individual and not a group updater like Office 2011.

You can use this site to get the updates:

http://macadmins.software/

After that, what I do is cache the updates in a custom hidden location on the user's Mac (i.e., /var/updates) and have EAs to pick up once it's cached. Once that EA is confirmed, the user gets put in to a smart group stating it has the cached update and that it has an out of date version of an office app. I have EAs and Smart Groups for each app.

Once they are in the smart group, a script runs on the reoccurring check-in to install the update. There is a notification before and after it completes. In my testing, I found that as long as the user is on 15.18 or above, the updates can be run without harm while the apps are open and being used. However, in that beginning notification, I instruct the user the app is about to be updated and to save any work they are working on (just in case).

Hopefully this all becomes a lot easier once we get "official" patching in the JSS but for now, it takes a bit of work and customization to get it going.

Might another option be to just get your Office 2016 updates via pushing out updated VL combo installers? That way you're pushing out 1 combo package instead of 5 or 6 individual app updaters.

I suppose many managers want updates pushed out faster than the VL installer receives updates.

@rblaas I should have mentioned.. I'm in an all O365 environment. If you use VL, might be a different workflow, as @SGill suggests.

@perrycj so i've not been brave enough to try updating these apps while in use. I know some people do and some do not. In fact Paul Bowden has said straight up on Slack that the apps must be closed when updated (CYA though I'm sure!)

My patch compliance on Office is pretty weak because I run these at login with a full screen curtain. Of course most users don't 'login' much anymore.

So you blast these out 'hot', middle of the work day, while people are using the apps and have not seen any ill effect? I worry most about corrupting mailboxes.

@SGill Yes we are using the VL (or going to) can we just use the latest Combo updater? (and are those also available at macadmins.software)

@perrycj Thanks for your update. So basically the updates for Office 2016, although sandboxed, are still pretty nasty...

@dpertschi I wish I could get on slack to take advantage of all the knowledge on there but unfortunately, as of now, it is blocked at my workplace.

But yes, I update live (after extensive engineer testing with my immediate team and then a group of pilot users). So far there have been no ill effects. Of course every environment is different but that has worked so far for us.

And you're right, no one logs out anymore which is another reason why I do it the way I do it. It was the only way, for us, to ensure they get updated. It is a little bit of a pain to manually update the packages each month but it's not the end of the world.

@rblaas Yes. They are usually rather large (close to 1 GB each) and that is why I cache and install later with a separate script.

Yes, the macadmins page (which is awesome!) has a VL link that sends you to Microsoft's Enterprise login page and you get it from there via your org's login. I had good luck rolling out the 15.20 VL combo right over the older 15.18 VL combo install.

Haven't tested the 15.21 version, since we haven't yet rolled it out.

Edit: btw, I don't "hot-blast" Office updates at all...I lock them down to only install at logout. This might have a big effect on success rates in larger numbers. I realize with 1-to-1 and laptops you don't always have this level of control.

I've been pushing out the retail install package each time (so that it's one ~2.5GB package rather than five 750MB-1GB packages), followed by the VL serializer from the volume license installer. That has seemed to work fine, and retain our volume license across updates.