Enterprise deployment reference · updated June 2026
Microsoft 365 Apps for Enterprise: Deployment + Lifecycle (2026)
The update channels compared, the six enterprise deployment patterns, Office Deployment Tool and Customization Tool, Office Cloud Policy Service, Intune Settings Catalog, Apps Health, and the 5-phase EPC Group M365 Apps Modernization Accelerator — from the team behind 1.83 million users migrated across 216+ M&A tenant consolidations.
What is Microsoft 365 Apps for Enterprise and how is it deployed?
Microsoft 365 Apps for Enterprise — formerly Office 365 ProPlus, formerly Office Professional Plus subscription — is the subscription-licensed, Click-to-Run, cloud-policy-managed, channel-updated desktop Office product that ships under Microsoft 365 E3 / E5 / Business Premium / A-SKUs / G-SKUs. It is the only path forward for Microsoft Copilot, Loop, New Outlook for Windows, and Teams 2.0 deep integration. Enterprise deployment in 2026 uses four update channels (Monthly Enterprise, Semi-Annual Enterprise, Current Channel, Insider), the Office Deployment Tool with the Office Customization Tool, Microsoft Intune Settings Catalog for device-targeted configuration, Office Cloud Policy Service for user-identity-targeted policy, and the Microsoft 365 Apps Admin Center (config.office.com) as the specialist administrative surface. This reference is the map. Built from EPC Group's 1.83 million users migrated and 216+ M&A tenant consolidations.
Microsoft 365 Apps for Enterprise (formerly Office 365 ProPlus) is the subscription-licensed Click-to-Run desktop Office product that ships under M365 E3 / E5 / Business Premium. Enterprise deployment uses four update channels — Monthly Enterprise (MEC, EPC Group default), Semi-Annual Enterprise (SAEC, regulated workloads), Current Channel (CC, power users / IT), and Insider (early-warning ring). Click-to-Run installs flow through Intune with the Microsoft 365 Apps app type. Policy splits between Office Cloud Policy Service (user-identity-targeted, cross-platform), Group Policy ADMX (AD-joined device-targeted), and Intune Settings Catalog (modern Entra-joined device-targeted). The EPC Group M365 Apps Modernization Accelerator is a fixed-fee 5-phase engagement priced $120K–$400K. Built from 1.83 million users migrated across 216+ M&A tenant consolidations.
Key Facts
Microsoft 365 Apps for Enterprise is the current product name — formerly Office 365 ProPlus, formerly Office Professional Plus subscription. Perpetual Office Professional Plus 2019 / 2021 / LTSC is a separate product line and cannot coexist with Microsoft 365 Apps on the same Windows device
Four update channels in 2026 — Monthly Enterprise Channel (MEC, EPC Group default for general enterprise), Semi-Annual Enterprise Channel (SAEC, regulated workloads with formal validation cycles), Current Channel (CC, power users + IT + Copilot champions), and Insider (small named early-warning ring, not production)
Click-to-Run deployment via Intune is the modern baseline — Microsoft 365 Apps app type in Intune Admin Center, configured for channel + architecture + language packs + excluded apps, required-assigned to the Autopilot device group, install completes inside Autopilot Enrollment Status Page
Policy management splits three ways — Office Cloud Policy Service (user-identity-targeted, cross-platform including Mac and BYOD), Group Policy ADMX (AD-joined device-targeted), Intune Settings Catalog (modern Entra-joined device-targeted) — most enterprises run a documented hybrid
Microsoft 365 Apps Admin Center at config.office.com is the specialist surface — Office Customization Tool builder, Office Cloud Policy Service, channel recommendations, servicing profiles, and the Apps Health signals
Apps Health under Apps Admin Center surfaces the Outlook signal (add-in load times, crash rates), Office Cloud Health, and Office update success — the lightweight observability layer for the Office product fleet
EPC Group M365 Apps Modernization Accelerator is a fixed-fee 5-phase engagement priced $120K–$400K based on device count, deployment complexity, and regulatory scope
Senior-architect-led delivery, Microsoft Solutions Partner, compliance-native baselines for HIPAA, SOC 2, FedRAMP, FINRA, CMMC, GxP regulated workloads
Microsoft 365 Apps for Enterprise — The Modern Office Deployment Reference
The desktop Office product line has had three names in the last decade — Office Professional Plus (subscription), Office 365 ProPlus, and now Microsoft 365 Apps for Enterprise. The name has changed; the underlying product is the subscription-licensed Click-to-Run Office that ships under Microsoft 365 E3, E5, Business Premium, the A-SKU education tier, and the G-SKU government tier. It is the only Office desktop path forward for Microsoft Copilot, Loop, New Outlook for Windows, and Teams 2.0 deep integration — the perpetually-licensed Office 2019 / 2021 / LTSC product line is locked at the build it shipped on and is not eligible for those features.
Modern enterprise deployment in 2026 is a small number of decisions made well. Which update channel for which population. Which deployment vehicle (Intune Click-to-Run is the modern baseline; Configuration Manager content distribution is the legacy path; the Office Deployment Tool with a custom Configuration.xml is the universal underlying mechanism). Which policy authority for which setting — Office Cloud Policy Service for user-identity-targeted policy, Group Policy ADMX for AD-joined device-targeted policy, Intune Settings Catalog for modern Entra-joined device-targeted policy. How to run Apps Health as a lightweight observability layer. And how to land the migration off perpetual Office, the M&A device join pattern, and the shared-device frontline pattern.
This reference is the map. It covers the four update channels compared, six enterprise deployment patterns, the Office Customization Tool and Office Deployment Tool, Group Policy ADMX vs Intune Settings Catalog vs Office Cloud Policy Service, the Apps Admin Center and Apps Health, the $120K–$400K EPC Group M365 Apps Modernization Accelerator, and eight FAQs. It is written for the IT director, M365 administrator, endpoint engineer, and CIO who need the strategic / architectural lens on Microsoft 365 Apps deployment — not the click-by-click Microsoft Learn tutorial. See also Microsoft 365 Admin Center Enterprise Reference for the broader six-console topology.
The Four Update Channels Compared
Update channel selection is the single highest-impact Microsoft 365 Apps deployment decision. It governs how often features and security updates land on your endpoints, how disruptive each update window is for your users and your help desk, and how aligned your tenant is with the Microsoft Copilot and Teams feature curve. The four channels Microsoft ships in 2026 are below — assigned per device through Intune Settings Catalog (preferred) or through the Office Deployment Tool Configuration.xml at install time.
Monthly Enterprise Channel (MEC)
MEC
Cadence: Feature + security updates on the second Tuesday of each month — predictable, single change window per month
Best for: EPC Group recommended default for the majority of enterprise populations. Predictable cadence is the deciding factor — IT operations gets one known change window per month rather than the open-ended in-channel rollouts of Current Channel. Aligns with the standard Patch Tuesday cycle that the Windows, Defender, and Edge teams already plan around.
Pitfall: Customers used to the older Semi-Annual Enterprise rhythm sometimes underestimate the validation cadence — MEC is monthly, not semi-annual. The fix is a small representative validation ring (200–500 devices) that gets MEC one or two weeks before the broad rollout, run by the application packaging team.
Semi-Annual Enterprise Channel (SAEC)
SAEC
Cadence: Feature updates twice a year (January and July), security updates monthly — slowest production cadence Microsoft offers
Best for: Regulated industry workloads where every feature change must pass formal validation against compliance evidence — pharmaceutical computer-systems validation (CSV / GxP), federal civilian and DoD environments under change-control boards, and clinical / EHR-integrated workstations where Office add-ins are validated against the clinical workflow. SAEC buys six months of feature stability between change windows.
Pitfall: SAEC populations fall behind on the Copilot, Teams 2.0, Loop, and New Outlook feature curve — and Microsoft is increasingly building those features against more current channels. SAEC is the right answer for the regulated slice, not the full enterprise. The frequent mistake is leaving the entire tenant on SAEC because IT operations is comfortable with the slow cadence.
Current Channel (CC)
CC
Cadence: Continuous — feature updates roll out as Microsoft ships them, security updates monthly
Best for: Power users, the IT department itself, the security team, and any population that benefits from the latest Copilot, Teams, Loop, and collaboration features. Current Channel is the channel Microsoft uses internally and the channel the Microsoft Copilot and Teams product teams target first — for organizations actively rolling out Copilot, putting champions on Current Channel materially accelerates Copilot literacy.
Pitfall: Open-ended rollout windows are hard for IT operations to plan around — a feature can land on a Tuesday morning that changes the Outlook ribbon or the Teams join flow without a discrete change window. Acceptable for power users and IT; not acceptable for regulated workloads or large frontline populations.
Current Channel (Preview) and Beta Channel (Insider)
Insider
Cadence: Insider Preview rings — weekly Beta drops; Current Channel (Preview) ships approximately one month ahead of Current Channel
Best for: A small, named ring of IT pros, application packagers, and product owners who need to see what is coming. EPC Group recommends a 10–50 device Insider ring inside every enterprise — not for production use, but as the early-warning system for breaking changes (Outlook add-in deprecation, Teams API changes, Office macro behavior).
Pitfall: Insider is not a production channel. Every documented incident of "Office broke overnight in production" we have investigated traces back to a population that drifted onto Insider through manual installs or an outdated provisioning package. Insider devices belong on a documented allowlist tracked in Intune.
Channel assignment policy is enforced through Intune Settings Catalog (Microsoft Office 2016 > Updates > Update Channel) with device groups driven by Entra dynamic membership rules — channel drift through manual installs or stale provisioning packages is the most common cause of mixed-channel populations in inherited tenants.
Six Enterprise Deployment Patterns
Every Microsoft 365 Apps enterprise deployment EPC Group has shipped fits one of the six patterns below — typically a tenant runs three or four of them in parallel. The pattern decides the deployment vehicle, the channel assignment, the licensing posture, and the policy authority.
Pattern 1
Regulated industry slow-cadence (SAEC for the validated population, MEC for everyone else)
When it applies: Healthcare, life sciences, federal civilian, DoD, and large financial institutions where a defined subset of the workforce sits on validated clinical workstations, GxP-validated research desktops, or formally accredited federal endpoints. Feature changes against those endpoints require requalification — sometimes a 4–8 week regulated cycle.
EPC Group approach: Two-channel pattern: SAEC for the validated population (clinical, GxP, ATO-scoped, broker-dealer trading desktops), MEC for the rest of the enterprise. Channel assignment is enforced through Intune Settings Catalog with device groups driven by Entra dynamic membership rules — not a per-user setting that drifts. SAEC population is documented in the validation master plan and reviewed at every audit.
Pattern 2
Click-to-Run deployment via Intune (modern baseline for new devices)
When it applies: New device provisioning under Windows Autopilot with Microsoft 365 Apps installed at first-boot enrollment. The Intune-managed Click-to-Run deployment replaces the legacy SCCM / Configuration Manager content distribution model that dominated 2015–2022 enterprises.
EPC Group approach: Microsoft 365 Apps app type in Intune (purpose-built for Click-to-Run Office, not a Win32 wrapper). Configuration set in the app blade — channel, architecture (64-bit baseline), language packs, excluded apps (Skype for Business, Groove, OneNote 2016 legacy). Required assignment to the Autopilot-enrolled device group. First-boot install completes inside Autopilot Enrollment Status Page so the user lands on a desktop with Office already installed and licensed.
Pattern 3
MSI legacy deprecation (Office 2016 / 2019 / 2021 perpetual MSI to Microsoft 365 Apps Click-to-Run)
When it applies: Organizations still carrying volume-licensed perpetual Office (Office 2016, 2019, 2021, LTSC) on a subset of devices — often acquired through M&A, sometimes carried for kiosk or task-worker scenarios, sometimes never modernized. MSI Office cannot coexist with Microsoft 365 Apps Click-to-Run on the same device. Click-to-Run is the only forward path for Copilot, Loop, and New Outlook features.
EPC Group approach: Inventory MSI Office estate (Intune device inventory query — Office MSI products, builds, install paths). Stage MSI removal through the Office Deployment Tool RemoveMSI configuration. Re-install with Microsoft 365 Apps Click-to-Run via Intune. The ODT RemoveMSI element handles the removal in a single supported step rather than the older multi-step manual uninstall path. EPC Group typically batches MSI deprecation in waves of 500–2,000 devices against a documented compatibility matrix.
When it applies: Acquired-company devices joining the surviving M365 tenant — devices may carry the acquired company's Microsoft 365 Apps installation tied to the source tenant, or may carry MSI Office, or may be unmanaged. Net new tenant association requires re-licensing the Office installation against the target tenant.
EPC Group approach: Choose between (1) full reimage to Autopilot baseline with Microsoft 365 Apps deployed by target-tenant Intune, or (2) tenant-attach the existing device and re-license Office via the change-product-key flow. EPC Group default for clean tenants is full reimage during a documented Wave 1 / Wave 2 / Wave 3 cutover — re-license is faster but carries more inherited risk. The 90-day M&A Tenant Consolidation Accelerator includes the Office re-licensing workstream against the consolidated MEC / SAEC baseline.
When it applies: Frontline workers on shared kiosks, manufacturing-floor terminals, retail registers, healthcare aide stations, and shift-based shared workstations. Multiple users sign in to the same physical device across a shift, often using Microsoft 365 Frontline (F1 / F3) licensing. Per-user Office activation does not fit this model.
EPC Group approach: Shared Computer Activation (SCA) configured through the Office Deployment Tool SharedComputerLicensing element. SCA stores a per-user license token that does not consume a device activation slot — a 100-user shift on a 10-device shared station works correctly under SCA, fails under standard activation. EPC Group recommends pairing SCA with Windows multi-session for full multi-user device patterns.
Pattern 6
BYOD self-service install (employee-owned device with corporate licensing)
When it applies: Employee-owned device scenarios — typically Mac, sometimes Windows home edition, sometimes Linux running web Office. User signs in with corporate credentials and consumes a Microsoft 365 Apps installation against their assigned license entitlement. Five-device-per-user install entitlement applies.
EPC Group approach: Self-service install from the Microsoft 365 portal (apps.microsoft.com / aka.ms/office-install). Office Cloud Policy Service applies policy by user identity, not by device — so a BYOD Mac picks up the same Outlook trust center, Excel macro, and Copilot enablement policies as a corporate-managed Windows device. Conditional access requires compliant device or approved client app for the underlying M365 service connection.
The Office Deployment Tool (ODT) is the underlying executable Microsoft ships for downloading and installing Microsoft 365 Apps from a configurable XML file. The Office Customization Tool is the web UI at config.office.com that produces the Configuration.xml file ODT consumes. Together they are the universal mechanism behind every Microsoft 365 Apps install — whether you use Intune (which wraps the ODT under the hood), Configuration Manager (which also wraps ODT), or a direct ODT install on a kiosk image.
Office Customization Tool (config.office.com)
Web UI that produces Configuration.xml. Pick architecture (64-bit baseline for almost every enterprise scenario), update channel, language packs, excluded apps (Skype for Business, Groove, OneNote 2016 legacy), proofing tools, and licensing options (Shared Computer Activation, AutoActivate, ForceAppShutdown). The output XML is portable across Intune, Configuration Manager, and standalone ODT installs — one source of truth for the Office install configuration.
Office Deployment Tool (ODT executable)
Setup.exe shipped by Microsoft that downloads Office content from the Microsoft Content Delivery Network and installs against the supplied Configuration.xml. Two-phase flow — setup.exe /download Configuration.xml stages content locally, setup.exe /configure Configuration.xml performs the install. The RemoveMSI element handles MSI Office uninstall in the same step as Click-to-Run install — the supported single-step path for perpetual-to-subscription migrations.
EPC Group standard for every Modernization Accelerator engagement: maintain a versioned Configuration.xml per channel (MEC.xml, SAEC.xml, CC.xml) in source control alongside the Intune profile definitions, treat the XML as configuration-as-code, review changes through the same change-control process that governs Conditional Access policy and DLP rule changes.
Policy Authority — Group Policy ADMX, Intune Settings Catalog, Office Cloud Policy Service
Office settings management has three competing policy authorities in 2026. Running them without a documented map of which authority owns which setting is the most common cause of “the setting won't stick” help-desk tickets. The breakdown below is the EPC Group standard authority map.
Group Policy ADMX Templates
The legacy authority — device-targeted, AD-joined endpoints, applied through Group Policy Objects. Authoritative for the small set of Office settings that are GPO-only, and for environments with a deep AD footprint. Microsoft continues to ship updated ADMX templates each release — download from the Microsoft 365 Apps Administrative Templates package.
Intune Settings Catalog
The modern device-targeted authority — Entra-joined Windows devices managed by Intune. Settings Catalog exposes the full Microsoft 365 Apps settings tree (Microsoft Office 2016 > …) for assignment to device groups. EPC Group default for channel assignment, telemetry posture, update behavior, and any device-targeted Office setting in Entra-joined environments.
Office Cloud Policy Service (OCPS)
The modern user-identity-targeted authority — administered at config.office.com, applied by Entra group membership, follows the user across Windows + Mac + BYOD. Authoritative for trust center settings, macro execution policy, file save defaults, Copilot enablement, and any setting that should follow the user rather than the device. The right answer for the majority of policy scenarios in 2026.
EPC Group authority map standard: OCPS for user-identity-targeted policy (trust center, macros, file save, Copilot enablement, signature behavior, file format defaults). Intune Settings Catalog for device-targeted policy on Entra-joined Windows (channel assignment, telemetry posture, update behavior, language packs at the device layer). Group Policy ADMX only for AD-joined endpoints and for the small set of settings that remain GPO-only. The authority map is documented in the engagement runbook and reviewed quarterly — running multiple competing policy authorities without an explicit map is the single largest source of Office policy chaos in inherited tenants.
Per-Office-Setting Management — Where Each Knob Lives
A pragmatic mental model: an Office setting either follows the user (trust center, macro execution, Copilot enablement, file save defaults, signatures, file format) or it follows the device (channel assignment, telemetry posture, update behavior, language packs at the device layer). User-following settings belong in Office Cloud Policy Service. Device-following settings belong in Intune Settings Catalog on Entra-joined devices, or in Group Policy ADMX on AD-joined devices.
User-following (OCPS, the right answer in 2026): Trust center settings (file block, protected view), Excel macro execution policy, VBA digital signature requirements, Outlook auto-archive behavior, OneDrive Known Folder Move, file save default to OneDrive vs local, Copilot enablement at the per-app level, Word AutoRecover interval, sensitivity label client behavior, the New Outlook for Windows opt-in / opt-out, Microsoft 365 Apps update notification behavior to the user, telemetry-to-user surface.
Device-following (Intune Settings Catalog on Entra-joined, GPO ADMX on AD-joined): Update channel assignment (MEC / SAEC / CC), update deadline behavior, Office update auto-restart policy, language pack installation, optional client services configuration, telemetry diagnostic data level at the device tier, Office shared-computer activation enablement, AppLocker exclusions for Office processes, Defender Application Control rules touching Office binaries.
Apps Health — The Lightweight Office Observability Layer
Apps Health under the Microsoft 365 Apps Admin Center surfaces the operational signals that let an enterprise admin team detect Office regressions before they become Tier-1 ticket waves. Three signals matter most in 2026.
Outlook Signal
Add-in load times, crash rate by add-in, sync time, and the slow-Outlook user list. The single most useful Apps Health signal — Outlook performance regressions almost always trace back to one or two misbehaving COM add-ins, and the Outlook signal surfaces them by name. EPC Group standard: review the Outlook signal weekly during any active Office channel rollout.
Office Cloud Health
Cloud connectivity health from the Office client to the Microsoft 365 service — file open / save latency, sign-in success, sync conflicts, and OneDrive client health. Useful for diagnosing client-side issues that look like a service outage but are actually a local proxy, ZTNA agent, or network path regression.
Apps Admin Center inventory
The Apps Admin Center inventory view surfaces installed channel + build per device + update lag against the channel target. The single best place to detect channel drift, stuck devices that have not updated in 90+ days, and devices accidentally enrolled to Insider. Run as a monthly health check.
EPC Group M365 Apps Modernization Accelerator — 5-Phase Fixed-Fee ($120K–$400K)
The Modernization Accelerator is the fixed-fee EPC Group engagement that takes an enterprise from inherited Office estate (mixed channels, perpetual MSI residue, undocumented policy authority, no Apps Health visibility) to a modern Microsoft 365 Apps deployment with documented channel architecture, configuration-as-code Office.xml in source control, OCPS + Settings Catalog authority map, Apps Health monitoring, and a runbook handoff to ongoing operations. Five phases over 60 to 120 days depending on scope.
Phase 1
Discover
Phase 2
Design
Phase 3
Pilot
Phase 4
Deploy
Phase 5
Operate
Phase 1 — Discover (days 1–14). Office estate inventory across the tenant — channel distribution by device, perpetual MSI residue, language packs in use, COM add-in inventory by load count, Outlook signal baseline, Configuration Manager packages still in flight, Group Policy Objects touching Office, OCPS policies currently published, Intune Settings Catalog Office profiles, Apps Health current state. Output: a documented estate map and the gap list.
Phase 2 — Design (days 14–30). Channel architecture (MEC default, SAEC for the named regulated population, CC for power users + IT, Insider as a 10–50 device early-warning ring). Configuration.xml versioned per channel. Policy authority map across OCPS / Settings Catalog / GPO ADMX. Intune Settings Catalog profiles defined. OCPS user-targeted policy set defined. Apps Health monitoring posture. New Outlook and Teams 2.0 readiness map. Sign-off from IT operations and the change advisory board.
Phase 3 — Pilot (days 30–45). Validation ring deployment — 200–500 devices selected to represent the population. MEC and SAEC profiles deployed against the validation ring. OCPS policies applied. Apps Health monitoring active. Two-week soak. Documented results, ticket volume, regressions caught, and configuration adjustments.
Phase 4 — Deploy (days 45–90). Broad rollout in waves of 1,000–3,000 devices. MSI removal where applicable through the ODT RemoveMSI configuration in a single supported step. Channel reassignment for drift-corrected devices. OCPS rollout across the user population. Help desk briefed on the change and the rollback procedure. Hyper-care window with senior engineers on bridge.
Phase 5 — Operate (days 90–120). Apps Health weekly review cadence handed off to the customer admin team. Configuration.xml change-control process documented. Apps Admin Center inventory review monthly. New Outlook and Teams 2.0 readiness reviewed quarterly. Optional handoff to a Managed M365 Operations retainer for steady-state senior-architect coverage.
EPC Group's M365 Apps Deployment Credential Stack
The Modernization Accelerator playbook above is the working model behind every Microsoft 365 Apps engagement EPC Group has shipped — across 70+ Fortune 500 clients, 216+ M&A tenant consolidations, 1.83 million users migrated, and a 29-year operating history on the Microsoft platform since 1997. Nearly three decades of Office deployment evolution — from Office 97 enterprise rollouts through Office 365 ProPlus to Microsoft 365 Apps for Enterprise with Copilot integration.
1.83 million
Users migrated in M&A consolidations
216+
M&A tenant consolidations
11,000+
Microsoft engagements over 29 years
70+
Fortune 500 clients
Microsoft Press authorship on M365 migrations
Founder and CEO Errin O'Connor is a four-time Microsoft Press bestselling author, with titles covering large-scale Microsoft 365 migrations, Power BI, SharePoint, and Azure — the same architectural patterns that inform every M365 Apps engagement we deliver. Microsoft 365 consulting services →
All six current Microsoft Solutions Partner Designations
Data & AI, Modern Work, Infrastructure, Security, Digital & App Innovation, Business Applications — full coverage of the Microsoft cloud stack with no subcontracting. The Modern Work and Security Designations are the named credentials behind every Microsoft 365 Apps engagement we deliver. See the Microsoft Cloud Orchestrator.
The EPC Group Lifecycle — Assess → Modernize → Govern → Operate → Enable
The named, single-accountable-partner delivery model that lets the same senior architects own a Microsoft 365 Apps engagement from estate assessment through year-two managed operations. Microsoft Adoption Accelerator →
Compliance-native delivery for regulated workloads
Microsoft 365 Apps engagements delivered with documented control mapping to the named regulatory baseline — HIPAA, SOC 2, FedRAMP, FINRA, CMMC, GxP. FedRAMP-aligned delivery posture for federal civilian and DoD scenarios. See the Intune + Defender for Endpoint UEM hub for the related endpoint posture.
Microsoft 365 Apps Under the EPC Group Lifecycle
Every Microsoft 365 Apps engagement runs under the EPC Group Lifecycle — Assess, Modernize, Govern, Operate, Enable — so the same senior architects move with your tenant from the estate assessment through year-two managed operations. One contract. One escalation path. One named owner for the Office product fleet.
What is the difference between Microsoft 365 Apps for Enterprise and the older Office Professional Plus?
Microsoft 365 Apps for Enterprise (formerly Office 365 ProPlus, and before that Office Professional Plus subscription) is the subscription-licensed, Click-to-Run, cloud-policy-managed, channel-updated Office product line that ships under M365 E3 / E5 / Business Premium / A-SKUs / G-SKUs. Office Professional Plus 2019 / 2021 / LTSC are the perpetually-licensed, MSI-installed, semi-annual or one-time channel products purchased through volume licensing. The two cannot coexist on the same Windows device. Microsoft 365 Apps for Enterprise is the only path forward for Microsoft Copilot, Loop, New Outlook for Windows, Teams 2.0 deep integration, and the modern enterprise feature curve — perpetual Office is locked at the build it shipped on. EPC Group has migrated tens of thousands of devices off perpetual Office to Microsoft 365 Apps Click-to-Run as part of M365 modernization engagements, and the Office Deployment Tool RemoveMSI configuration is the supported single-step path.
Should I choose Monthly Enterprise Channel or Semi-Annual Enterprise Channel for my Office deployment?
Monthly Enterprise Channel (MEC) is the EPC Group recommended default for the majority of enterprise populations. MEC delivers feature and security updates on the second Tuesday of each month — a single, predictable change window that aligns with the broader Patch Tuesday cycle the Windows, Edge, and Defender teams already plan around. Semi-Annual Enterprise Channel (SAEC) delivers feature updates only twice a year (January and July) with monthly security updates, and is appropriate for the regulated slice of the workforce — clinical workstations validated under GxP / CSV, federal endpoints under formal change-control boards, broker-dealer trading desktops with documented application-validation cycles, and similar scenarios where a feature change requires a 4–8 week requalification cycle. The mistake we see most often is leaving the entire enterprise on SAEC because IT operations is comfortable with the slow cadence — that decision strands the entire workforce off the Copilot, Teams 2.0, Loop, and New Outlook feature curve. The right answer for most tenants is MEC as the default with SAEC reserved for the named regulated population, enforced through Intune Settings Catalog channel assignment.
Group Policy ADMX vs Office Cloud Policy Service — which should I use to manage Office settings?
Office Cloud Policy Service (OCPS) is the EPC Group recommended path for the majority of policy scenarios in 2026 — it applies policy by user identity (not by device), supports BYOD and unmanaged Mac scenarios that Group Policy cannot reach, and is administered from config.office.com under Entra identity. Group Policy ADMX templates remain authoritative for device-targeted policies in environments that have a deep Active Directory or hybrid Entra footprint, and for the specific settings that are Group Policy-only (a small and shrinking set). The pragmatic enterprise answer is hybrid: OCPS for user-targeted policies that need to follow the user across devices (trust center settings, macro execution, Copilot enablement, file save defaults), Group Policy ADMX for device-targeted policies in AD-joined environments, and Intune Settings Catalog as the modern replacement for Group Policy on Entra-joined and Intune-managed Windows devices. EPC Group documents the policy authority for every Office setting in every Modernization Accelerator engagement — running multiple competing policy sources without a documented authority map is the most common cause of "the setting won't stick" tickets.
What is new Outlook for Windows, and how should we plan the migration off classic Outlook?
New Outlook for Windows is the unified web-built Outlook client Microsoft is rolling forward as the eventual replacement for classic Outlook desktop. It shares the web Outlook codebase, integrates more deeply with the Microsoft 365 Copilot pane, and reaches feature parity with classic Outlook progressively across the 2026–2027 release calendar. As of mid-2026, classic Outlook remains the EPC Group recommended default for the majority of enterprise mailboxes — feature parity gaps remain around offline access depth, certain shared mailbox patterns, COM add-ins, and PST handling. The right enterprise posture is: (1) enable new Outlook as opt-in for power users and the IT department on Current Channel for early feedback; (2) run an inventory of COM add-ins against the new Outlook supported add-in model and flag the gap list; (3) document a 12–18 month transition plan tied to Microsoft's published parity milestones; (4) hold the broad enterprise on classic Outlook until COM add-in parity and offline depth land for your specific scenarios. EPC Group maintains a living new Outlook readiness matrix for every Managed M365 Operations retainer customer.
Is Teams 2.0 the only supported Teams client now, and what happened to classic Teams?
Yes. New Teams (Teams 2.0) is the only supported Teams client for Microsoft 365 commercial customers — Microsoft retired classic Teams across 2024 / 2025 and removed install paths in 2026. New Teams is faster, lower-memory, and built on the WebView2 / React stack that ships under the Microsoft Edge runtime. New Teams installs automatically through Microsoft 365 Apps Click-to-Run on supported channel deployments, and through Intune for Teams-only or kiosk-only device scenarios. The remaining customer questions are typically (1) line-of-business app compatibility (Teams JavaScript SDK apps that targeted the classic client require recompilation), (2) Teams Rooms device firmware (Teams Rooms on Windows and Android both received New Teams updates on different cadences), and (3) virtual desktop infrastructure scenarios under Azure Virtual Desktop and Windows 365 (New Teams requires specific media optimization configuration). EPC Group includes the New Teams readiness assessment in every M365 Apps Modernization Accelerator and every Tenant Consolidation engagement.
How do we deploy and manage Microsoft 365 Apps on Mac at enterprise scale?
Mac deployment uses the Microsoft AutoUpdate (MAU) framework for channel updates and policy enforcement, with deployment through Jamf Pro, Intune for Mac, or Microsoft Defender for Endpoint onboarding workflows. The high-level Mac pattern: (1) license assignment under the user's Microsoft 365 Apps entitlement (five-device install applies across Windows + Mac); (2) installation via the Microsoft 365 Installer package from Microsoft, distributed by Jamf Pro / Intune for Mac as a managed package; (3) channel assignment via the MAU preference (com.microsoft.autoupdate2 plist) — MEC, SAEC, and Current Channel all supported on Mac; (4) policy management via the Office Cloud Policy Service (which works user-identity-targeted across platforms) plus Mac configuration profiles for device-targeted Office preferences; (5) Defender for Endpoint onboarding and Conditional Access enforced on the underlying M365 service connections. Mac deployment fits cleanly into the EPC Group M365 Apps Modernization Accelerator — typically as a parallel Mac workstream rather than a separate engagement.
What is the Apps Admin Center and how does it relate to the broader admin console topology?
The Microsoft 365 Apps Admin Center (config.office.com) is the dedicated administrative surface for Microsoft 365 Apps for Enterprise — it owns the Office Customization Tool builder, the Office Cloud Policy Service, channel inventory and recommendations, security update health, servicing profile management, and the apps health signals that surface in Apps Health. It sits inside the broader six-console Microsoft 365 admin topology — M365 Admin Center (admin.microsoft.com) for tenant operations, Microsoft Entra Admin Center for identity, Microsoft Defender Portal for security, Microsoft Purview Portal for governance and compliance, Teams Admin Center for voice and meetings, SharePoint Admin Center for sites and OneDrive, plus the Intune Admin Center (intune.microsoft.com) for endpoint management. Apps Admin Center is the specialist surface for Office product policy and configuration — most Office admin time is split between Apps Admin Center and the Intune Admin Center.
How much does the EPC Group M365 Apps Modernization Accelerator cost and what is included?
The EPC Group M365 Apps Modernization Accelerator is a fixed-fee five-phase engagement priced between $120,000 and $400,000 depending on device count, deployment complexity, and regulatory scope. The base $120K tier covers small / mid-market deployments — 1,000–3,000 devices, single-channel or dual-channel (MEC + SAEC) baseline, single regulatory framework, no Mac fleet, no shared device requirement. The $400K tier covers large-enterprise deployments — 10,000+ devices, multiple regulatory frameworks (HIPAA + FedRAMP + CMMC, or HIPAA + GxP for life sciences), parallel Mac fleet, shared-device frontline scenarios, M&A consolidation pattern, AD + Entra hybrid identity, and migration off perpetual Office. Included in every tier: channel architecture and Intune Settings Catalog configuration, Office Cloud Policy Service rollout, Office Customization Tool baseline, Autopilot integration, MSI removal where applicable, validation ring design, Apps Health monitoring setup, training for the customer admin team, and a documented runbook handoff. Larger engagements roll forward into a Managed M365 Operations retainer for steady-state.
A 60-minute call with a senior architect — not a sales lead. We will give you an honest read on your current Microsoft 365 Apps deployment posture across channel architecture, policy authority, perpetual Office residue, and Apps Health visibility, and whether a Modernization Accelerator engagement or a Managed M365 Operations retainer is the right next step. If your situation does not warrant an EPC Group engagement, we will say so on the call.