Last updated: 2026-04-27T00:00:00.000Z
Learn how to use Microsoft Intune Administrative Templates to remove the Office update toggle from end users, ensuring automatic updates cannot be manually interfered with across your organisation.
When users can toggle Office automatic updates on or off, organisations risk running outdated software with known security vulnerabilities. Hiding this option removes the possibility of accidental or intentional disabling of updates, keeping your Microsoft 365 environment consistently patched and reducing your attack surface.
Follow the steps below to create and deploy the Intune Administrative Template policy that hides the Office update option from end users.
Sign in to the Microsoft Intune admin centre at intune.microsoft.com. In the left-hand navigation panel, click Devices, then under Manage devices select Configuration.
Click + Create and select New policy. Set Platform to Windows 10 and later, then set Profile type to Templates. From the template list, choose Administrative Templates and click Create.
On the Basics tab, enter a clear Name and matching Description for the profile. Using a consistent naming convention such as PSA-71557 - Enable 'Hide Option to Enable or Disable Updates (MS Office) helps with auditability. Click Next to continue.
On the Configuration settings tab, expand Computer Configuration, then Microsoft Office 2016 (Machine), then click Updates. This reveals all available update-related policy settings for Office.
Click on Hide option to enable or disable updates from the settings list. In the side panel, select Enabled and click OK. This policy hides the Enable Update and Disable Updates buttons from users in all Click-to-Run Office applications.
Click Next through Scope tags. On the Assignments tab, click Add groups and select the target Entra ID group. Click Next, review all settings on the Review + create tab, and click Create to deploy the policy.
Explore related Secure Score controls and services to further strengthen your Microsoft 365 environment.
No. This policy only hides the user interface option that allows users to manually enable or disable updates. Automatic updates configured through Intune or your Office update channel will continue to run as normal.
No. This policy only applies to Microsoft 365 Apps installed via Click-to-Run. It has no effect on Office versions installed via the traditional MSI installer.
If the policy is not configured or is disabled, users will be able to see and use the Enable Updates and Disable Updates options within any Click-to-Run Office application, which may allow them to turn off automatic updates.
The policy is supported on Windows Server 2008 R2, Windows 7, and later versions. When creating the Intune profile, select Windows 10 and later as the platform to target modern managed devices.
No. The update option is silently removed from the Product Information area in Office apps. Users will not receive a notification or error — the option simply will not be visible.
Our Microsoft 365 security specialists can review your Secure Score, identify gaps, and implement the right controls for your organisation — including Intune policy configuration and ongoing management.