How to Install Office 365 Offline for Enterprise Deployment

Download the Office Deployment Tool from the Microsoft Download Center (https://www.microsoft.com/en-us/download/details.aspx?id=49117). Always take the latest version rather than pinning an old build. Run the downloaded self-extracting officedeploymenttool.exe, accept the license, and extract to a working folder such as C:\ODT.

Extraction gives you setup.exe (the tool itself) plus sample configuration.xml files you can adapt.

Pin the download page, not a version number - Microsoft updates the ODT regularly with fixes. If a later step misbehaves, re-download the newest ODT first.

The easiest and least error-prone way to build this file is the Office Customization Tool at https://config.office.com/deploymentsettings - pick the suite, channel, architecture, languages, and apps, then export the XML. You can also edit it by hand. A solid enterprise starting point:

<Configuration>
<Add OfficeClientEdition="64" Channel="MonthlyEnterprise">
<Product ID="O365ProPlusRetail">
<Language ID="en-us" />
<ExcludeApp ID="Groove" />
<ExcludeApp ID="Lync" />
</Product>
</Add>
<Property Name="SharedComputerLicensing" Value="0" />
<Property Name="FORCEAPPSHUTDOWN" Value="TRUE" />
<Display Level="None" AcceptEULA="TRUE" />
<Logging Level="Standard" Path="%temp%" />
</Configuration>

What the key options mean:

• OfficeClientEdition="64" installs the 64-bit build (the default and recommended edition).
• Channel="MonthlyEnterprise" gives predictable monthly updates with extra validation.
• Product ID="O365ProPlusRetail" is Microsoft 365 Apps for enterprise. Use O365BusinessRetail for Business plans.
• ExcludeApp removes apps you don't want. Groove is OneDrive for Business (legacy client), Lync is Skype for Business; use OneDrive, Teams, or Bing to exclude those.
• Display Level="None" with AcceptEULA="TRUE" makes the install silent.

Keep this file under version control per client site. Product IDs differ by SKU: O365ProPlusRetail (enterprise) vs O365BusinessRetail (business). A wrong Product ID is the most common cause of an install that pulls the wrong suite.

From an elevated command prompt in C:\ODT, run the ODT in download mode against your configuration file. This is the only step that requires internet, and you only do it once per channel/language set.

C:\ODT\setup.exe /download C:\ODT\configuration.xml

The tool creates an Office subfolder (with a Data\<version> folder) containing the streamed installation files. If the download is interrupted, run the same command again - ODT resumes and only fetches what's missing.

The download has no visible progress bar - it returns to the prompt when done. Confirm success by checking that Office\Data\<version> exists and the folder size is in the expected GB range, and review the log in %temp% if it fails.

Copy setup.exe, your configuration.xml, and the entire Office folder to a share, for example \\fileserver\M365Source. Then set permissions carefully based on who runs the install:

• Interactive installs run as the signed-in admin, so grant Domain Users (or the relevant admins) Read & Execute.
• Silent deployments via GPO startup script, Configuration Manager, or Intune usually run as SYSTEM / the computer account, so grant Domain Computers Read & Execute on both the share and NTFS.

Grant Full Control to Domain Admins and SYSTEM on the server itself.

The most common silent-deployment failure is granting share access to Domain Users while the job actually runs as the computer account - add Domain Computers read access to avoid it.

Create a second file (for example install.xml) that points at the share with SourcePath and disables CDN fallback. This is the step that actually makes the deployment offline - without SourcePath and AllowCdnFallback="FALSE", Click-to-Run can quietly pull from the internet.

<Configuration>
<Add SourcePath="\\fileserver\M365Source" OfficeClientEdition="64" Channel="MonthlyEnterprise" AllowCdnFallback="FALSE">
<Product ID="O365ProPlusRetail">
<Language ID="en-us" />
<ExcludeApp ID="Groove" />
<ExcludeApp ID="Lync" />
</Product>
</Add>
<Property Name="SharedComputerLicensing" Value="0" />
<Property Name="FORCEAPPSHUTDOWN" Value="TRUE" />
<Updates Enabled="TRUE" />
<Display Level="None" AcceptEULA="TRUE" />
<Logging Level="Standard" Path="%temp%" />
</Configuration>

SourcePath must point at the folder that contains the Office folder - not the Office folder itself. Set SharedComputerLicensing to 1 only for RDS, Citrix, or Windows multi-session (AVD) hosts.

Keep Channel identical to the channel you downloaded. If a language pack isn't in the local source and AllowCdnFallback is FALSE, that language simply won't install - add it to the download source instead of re-enabling fallback.

On a target machine, run the ODT in configure mode from an elevated context against the install configuration on the share:

\\fileserver\M365Source\setup.exe /configure \\fileserver\M365Source\install.xml

For at-scale rollout, call the same command from a GPO startup script (runs as SYSTEM), a Configuration Manager application, or an Intune Win32 app wrapping setup.exe. Because the install is silent (Display Level="None"), there's no user interaction.

The command must run elevated. A non-elevated run is the usual cause of an install that appears to do nothing or exits with an error. Check %temp% logs for the exit code if a client fails.

Read the Click-to-Run configuration registry for version, channel, and excluded apps - this is fast and reliable, unlike querying Win32_Product (which is slow and can trigger MSI repair actions, so avoid it):

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration' | Select-Object ProductReleaseIds, VersionToReport, CDNBaseUrl, O365ProPlusRetail.ExcludedApps

For activation, the authoritative check for standard user-based subscriptions is File > Account inside any Office app, which should show *Product Activated* once the user signs in. ospp.vbs /dstatus is mainly useful for volume/KMS or shared-computer scenarios, not per-user subscription activation.

The channel is encoded in CDNBaseUrl - for example the Monthly Enterprise Channel GUID 55336b82-a18d-4dd6-b5f6-9e5095c314a6. Do not use Get-WmiObject Win32_Product; enumerating it reconfigures every installed MSI and is a known performance and stability trap.

Pick an update strategy and set it in the configuration or via policy:

• CDN updates (simple): leave Updates Enabled="TRUE" and clients pull updates from Microsoft directly.
• Local update source (bandwidth-controlled): download the newer source to a share and point clients at it:

<Configuration>
<Updates Enabled="TRUE" UpdatePath="\\fileserver\M365Updates" />
</Configuration>

- Policy-managed: use the Office ADMX Update Channel policy under Computer Configuration > Administrative Templates > Microsoft Office 2016 (Machine) > Updates, which overrides the channel set by ODT.

Refresh the offline source periodically by re-running setup.exe /download - ODT only fetches the changed files.

Always pilot a new build/channel with a small group before broad release. Feature updates can change behavior, and a bandwidth spike from many clients updating at once can saturate a WAN link.