How can I keep Office 2607 on one managed device temporarily?

Another option is to configure Office to use a network share as its update source. Keep only the approved 2607 files on that share, so the device cannot see a newer build, while still giving you a controlled place to publish an update when the application is fixed. This needs to be tested carefully and maintained so the device continues receiving appropriate security updates.

Excluding the device from an Intune policy may not be enough. If a Cloud Update profile is active in the Microsoft 365 Apps admin center, Cloud Update can take precedence over other management settings. Check config.office.com for an active Cloud Update profile and use its exclusion or opt-out setting for this device. After it is no longer managed by Cloud Update, apply a separate policy that explicitly targets the device and pins Office to the 2607 build. Simply removing it from another policy leaves the default update behavior enabled.

For a temporary hold, use an Office Deployment Tool configuration that explicitly disables updates, such as . Reinstall or reconfigure Office with that XML, then check whether management settings are being written back under HKLMSOFTWAREPoliciesMicrosoftoffice16.0commonofficeupdate. Look for values such as UpdateBranch or TargetVersion, and check Task Scheduler for the Office Automatic Updates 2.0 task. On managed installations, the Disable Updates button in Office is often unavailable or ineffective, so it is better to enforce the setting through deployment or policy.

If the application needs to remain on a fixed Office feature version for a longer period, consider an Office LTSC release. It is designed for a more stable feature set and can still receive applicable security updates, although licensing and compatibility should be checked. For the immediate problem, explicitly deploying a policy that disables updates or pins the target build is more appropriate than relying on the Office UI.