Microsoft AutoUpdate and Deferred Updates

Starting from Version 4.68.1, Microsoft AutoUpdate supports the following cases where more time is required:

• Deferring an update by many days (maximum of 28 days). Referred to as "Deferral Days" in the document.
• Setting "don't update beyond" version (to the maximum of 90 days). Referred to as "Deferral Version" in this document.

If both are defined, Deferral Version takes precedence over the Deferral Days setting for the app.

Deferral Days

This feature allows the deferral of available updates for many days.

Global Deferral Days setting

Deferral Days can be set globally with the following preferences setting:

Example of Configuring Deferral Days

This example demonstrates how to set Deferral Days to 14. In this configuration, Microsoft AutoUpdate will postpone offering or applying updates for 14 days after the build date:

<key>OptionalUpdatesDeferralsDays</key>
<integer>14</integer>

App specific Deferral Days setting

Deferral Days can also be set for individual applications. If set, app-specific deferral days take precedence over the global setting.

App-specific deferral days can be set with the following preferences setting:

Example of setting different Deferral Days for Word and Excel

This example shows how to set Deferral Days to seven for Microsoft Word 2019 and to 12 for Microsoft Excel 2019. With this setup, Microsoft AutoUpdate delays offering or applying updates after they're built. It delays updates to Microsoft Word by seven days and updates to Microsoft Excel by 12 days.

<key>OptionalUpdatesDeferrals</key>
<dict>
    <key>DeferralDays</key>
    <dict>
        <key>MSWD2019</key>
        <integer>7</integer>
        <key>XCEL2019</key>
        <integer>12</integer>
    </dict>
</dict>

Deferral Version

This feature allows users to set an upper limit to the update version. That is, discovered updates are offered/applied to and including the specified version.

To allow for updates to be discovered and applied, only the Major.Minor version number scheme is recognized. For example, 16.82 needs to be specified to receive any 16.82.xxxxxxxx builds.

Due to differences in version numbers among Microsoft applications, this option needs to be set individually for each app with the following preference settings:

Possible values for the version are specified as Major.Minor version numbers. There's no default value for this setting.

Example of Setting Deferral versions for Word and Excel

This example shows how to set the Deferral Version to 16.82 for Microsoft Word 2019 and to 16.81 for Microsoft Excel 2019:

<key>OptionalUpdatesDeferrals</key>
<dict>
    <key>DeferralVersions</key>
    <dict>
        <key>MSWD2019</key>
        <string>16.82</string>
        <key>XCEL2019</key>
        <string>16.81</string>
    </dict>
</dict>

For example, the following table shows available updates for Microsoft Word 2019 (MSWD2019) and which one is offered/applied once the 90-day window is passed:

Interaction with Forced Update Settings

When using Deferral Days in combination with Forced Update settings (such as UpdateDeadline.ApplicationsForcedUpdateSchedule or UpdateDeadline.DaysBeforeForcedQuit), it’s important to understand that these mechanisms operate sequentially, not simultaneously:

• Deferral Days is the first filter applied. It determines which updates are visible to the user. Updates marked as Recommended are subject to deferral; Required updates bypass deferral and are always visible immediately. The deferral period is calculated based on the build date of the update.

• Forced Update logic only applies to updates that have passed the deferral filter and are visible to the user. The version specified in the ForcedUpdate configuration represents the minimum version that will be installed—if newer versions are available and visible, Microsoft AutoUpdate installs the latest eligible version instead.

Forced Update Logic and Version Selection

Forced Update logic applies only to updates that have passed the Deferral Days filter and are visible to the user. The version specified in the ForcedUpdateVersion setting represents the minimum version that MAU installs. If a newer version becomes available and isn't hidden by deferral, MAU installs the latest eligible version, not necessarily the one specified.

Key Behavior Explained

New Version During Forced Quit Period:

If a new version (for example, a Required update) is released during the Forced Quit countdown:

• It is considered immediately if it's marked as Required (Required updates bypass deferral).

• If it's Recommended, it's subject to the Deferral Days filter. If the build date is within the deferral window, it remains hidden until the deferral expires.

Which Version Gets Installed?

MAU installs the latest visible version that is:

• Not hidden by deferral

• Equal to or newer than the ForcedUpdateVersion

• Available on the CDN

Can Admins Control the Installed Version?

Admins can influence but not strictly control the version installed:

• Use ForcedUpdateVersion to set a minimum version.

• Use DeferralVersion to pin the maximum version offered.

• Use both together to narrow the version window, but MAU will still install the latest version within that range.

Example Scenario

• Installed Version: 16.95.25040241 (built April 3)

• Deferral Days: 14

• Forced Quit Period: 7 days

• Date: June 2

• Available Updates:

  • 16.97.25051114 (Required, built May 13) → Visible immediately

  • 16.97.25051816 (Recommended, built May 18) → Visible (15 days old)

  • 16.98.25052611 (Recommended, built May 27) → Hidden (6 days old)

If a new Required update (for example, 16.99.250529xx) is released on May 29:

• It is visible immediately and eligible for forced update if the forced update deadline hasn't yet passed.

• MAU installs this newer version instead of the originally targeted 16.97.25051114.

This image illustrates the example scenario.

Key Takeaways

1. Deferral Days take precedence over Forced Update timing. If an update is still within the deferral window (based on its build date, not release date), it will not be forced-even if a forced update date is configured.

2. Forced Update applies only to visible updates. MAU enforces the update only if the targeted version-or a newer one-is visible after deferral filtering. Updates still hidden due to deferral are excluded from forced update logic.

3. ForcedUpdateVersion sets a minimum, not a pin. The version specified in ForcedUpdateVersion is the minimum version MAU installs. If a newer version is available and not deferred, MAU installs the latest eligible version instead.

4. Required updates are never deferred. They bypass the deferral window and are always visible and eligible for forced update enforcement.

5. Admins can influence, but not guarantee, the installed version. To narrow the version range, use DeferralVersion in combination with ForcedUpdateVersion. This helps ensure the intended version is both visible and enforceable.