Windows Intune software deployment capabilities can provide a solution for organizations who are looking to distribute Office 365 client software to their managed PCs.  This blog article describes the steps involved to deploy Office Professional Plus 2010 and Lync 2010 to enrolled and provisioned Intune clients on Windows 7.  This article is intended as an example of how this can be done, so the steps may need to be updated to accommodate changes in either Office 365 or Intune services.  It does not cover topics such as deploying to Windows XP, upgrading from older versions of Office, or configuring Office applications to work with Office 365 online services.

Overview

Step 1: Acquire the necessary client software and updates.

Step 2: Prepare the Office installation package

Step 3: Upload the installation packages to Intune

Step 4: Deploy to computer groups

This procedure is the same as for deploying other software applications and is an effective way to rapidly distribute the Office 365 client bits to all of your managed PCs.

Step 1: Acquire the necessary client software and updates.

Your Office 365 subscription plan must be one that includes Office Professional Plus 2010.  The setup files can be acquired through the Office 365 admin portal by logging in and selecting Downloads under Resources.  Additionally you may wish to deploy Lync 2010, which is also available for download from the O365 admin portal.

Note that Office Professional Plus 2010 obtained through Office 365 channels (I'll refer to it as Office Subscription) contains different licensing binaries than the Volume Licensing version.  Office setup will automatically convert an Office VL installation to Office Subscription, but one side effect of this is that there will be two Office Pro Plus entries in Add/Remove Programs.  To remove Office you must uninstall both. 

In addition to the Office client setup files, you will also need to deploy the Microsoft Online Sign-in Assistant (SIA).  The SIA is a service and a set of DLLs that allows Office to validate users with Microsoft Online Services in the cloud.  If SIA is not deployed, Office Subscription will autorun SIA setup in interactive mode, and your users will have to walk through the installation themselves.  Once installed, SIA will automatically display a dialog that prompts for username and password.  If a user does not enter his or her Microsoft Online credentials into the SIA UI, Office will enter a reduced functionality mode after a thirty day grace period.  When deploying the Sign-In Assistant, you will need to deploy the architecture that matches the PC itself rather than that of Office.  So for example, a 64-bit machine running 32-bit Office should have the 64-bit Sign-In Assistant installed.

Lastly, there are two updates that are necessary to ensure Office applications work well with Office 365.  These updates are not available individually through Microsoft Update, therefore they will not be automatically available for approval in the Intune console.

By installing the Sign-In Assistant and updates, you are effectively performing the functions of Office 365 Desktop Setup.  Note that configuration tasks are not performed by Intune, such as configuring applications to access Sharepoint.

Step 2: Prepare the Office installation package

Intune installs applications on clients unattended under System security context.  Intune will automatically install MSIs in "silent mode" however EXEs require that the admin is responsible for configuring this.  Many setup EXEs will accept a command line argument, however Office setup requires that this be done either as through a config.xml file (or using the Office Customization Tool, which is not covered here).

First, extract the Office setup file:

MicrosoftOffice.exe /extract:<path>

Then, create config.xml in the root directory and add:

<Configuration Product="ProPlusSub">

    <Display Level="none" CompletionNotice="no" SuppressModal="yes" AcceptEula="yes" />

</Configuration>

Last, extract the .msp files from the updates and place them in the Updates subdirectory of the expanded Office setup directory.  (You could also upload the .msp files to Intune as Non-Microsoft Updates however by putting them directly with the Office installation package you are ensuring they will be installed immediately).

onenote2010-kb2523130-fullfile-x86-glb.exe /quiet /extract:<path>

outlook2010-kb2597011-fullfile-x86-glb.exe /quiet /extract:<path>

(Optional Step 2a: Test your silent installations)

To save yourself some time, it is advisable to test your silent installations for both Lync and Office before uploading them to Intune and waiting for them to download and install on a client.  Peek ahead to Step 3 to get the command line arguments, and then just try them locally.

Step 3: Upload the installation packages and updates to Intune

The next step is to upload everything to Intune using the Windows Intune Software Publisher. 

Office

In the Intune admin console, go to Software > Managed Software and click Upload.  Select the setup.exe file from the expanded Office setup files, and check "Include additional files and subfolders from the same folder."  In order to detect the Office 365 edition of Office Pro Plus, add the following detection rules:

File exists:

%ProgramFiles%\Common Files\microsoft shared\OFFICE14\osaui.exe

(This is the Office Subscription Agent. Note that on 64 bit machines Intune will check both C:\Program Files and C:\Program Files (x86))

MSI product code exists:

<Extracted Folder>\ProPlusSub.WW\ProPlusSubWW.msi

Registry key exists:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform

A command-line argument is necessary for Office setup to parse the config.xml file that sets it to silent mode:

/config config.xml

Lync

Once Office is uploaded, start up the Windows Intune Software Publisher to upload Lync.  You don't need to extract the Lync setup files since the EXE accepts a command line argument to run in silent mode.  For detection rules, you can specify the main executable:

File exists:

%ProgramFiles%\Microsoft Lync\communicator.exe

The command-line argument for running in silent mode is:

/Install /Silent

Sign-in Assistant

You can deploy this as Managed Software or as an Update.  Both should work.  Uploading the Sign-in Assistant MSI is easy because Intune will automatically run it in silent mode and will use metadata from the MSI file to detect whether it is installed.

Step 4: Deploy to computer groups

Now that the installers are all uploaded to Intune, all that needs to be done is to deploy them.  It is recommended that the deadlines all match so that all components are installed around the same time.  

Note that once everything is installed, users will not be prompted for their Online Services credentials until the next reboot.  However, Office will continue to function without online validation for up to thirty days.  You may also wish to force computers to restart from the admin console.

Done!

Feel free to comment with your feedback, questions, or additional recommendations.

- Chris Green, Program Manager

Audience:

Office 365 for professionals and small businesses
Office 365 for enterprises