Requirements for cloud update

As you prepare to implement cloud update for your organization, refer to the following list of requirements.

Supported built-in admin roles

You can use the following built-in Microsoft Entra roles for accessing and managing the feature:

Important

Microsoft recommends that you use roles with the fewest permissions. This helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.

Role Description
Office Apps Administrator (Recommended) This role can manage Office apps cloud services, including policy and settings management, and manage the ability to select, unselect, and publish 'what's new' feature content to end-user's devices.
Security Administrator This role can read security information and reports and manage configuration in Microsoft Entra ID and Office 365.
Global Administrator This role can manage all aspects of Microsoft Entra ID and Microsoft services that use Microsoft Entra identities.

Note

Global Reader is another built-in role supported by the Microsoft 365 Apps admin center, but it does not support some features like cloud update or the Modern App Settings page.

Licensing requirements

Your user must be assigned to one of the following subscription plans:

Type Subscription Plan
Education
  • Microsoft 365 A3
  • Microsoft 365 A5
    		•
    Business
  • Microsoft 365 Business Standard
  • Microsoft 365 Business Premium
    		•
    Enterprise
  • Office 365 E3
  • Office 365 E5
  • Microsoft 365 E3
  • Microsoft 365 E5
    		•

    Important

    The following plans are not supported:

    • Microsoft 365 operated by 21Vianet
    • Microsoft 365 GCC
    • Microsoft 365 GCC High and DoD

    Product version requirements

    You can manage Microsoft 365 Apps on Windows with the following version requirements:

    Network requirements

    Devices running Microsoft 365 Apps require access to the following endpoints:

    Environment Microsoft service URLs required on allowlist
    Commercial and GCC Microsoft 365 Apps admin center
  • login.live.com
  • *.office.com
  • *.office.net
  • *.config.office.com
  • *.config.office.net
    		•
    GCC High Microsoft 365 Apps admin center
  • *.office365.us
    		•
    DoD Microsoft 365 Apps admin center
  • *.apps.mil
  • *.office365.us
    		•

    Source: Microsoft 365 URLs and IP address ranges

    Microsoft Entra groups requirements

    Using Microsoft Entra groups is supported under the following conditions:

    • Both device objects and user objects can be used and also added to the same group.
    • Device objects must be Microsoft Entra joined or hybrid joined.
    • User objects must be present in Microsoft Entra ID and have a supported license assigned.
    • Multiple groups can be used, but a single group should contain no more than 20,000 objects.
    • Nested groups support up to three levels deep.
    • Last updated on