O365 Suite not installing on Intune devices (0x3AFC)

O365 Suite not installing on Intune devices (0x3AFC)

This article will describe what to do when O365 Suite is not installing on Intune devices.


  • Customer coming from SCCM device management & application deployment
  • Migrated to Hybrid Joined Intune MDM managed devices
  • O365 Suite was already installed on certain computers, but not the whole suite


  • Deploying the whole O365 suite (Teams included) to all Hybrid Joined Intune MDM managed devices

What’s been done:

config.office.com: you can make a custom config installation XML through that site. It’s easy to work with and you can copy the XML in your Intune O365 package.

You can just follow the guide, and click the Apps you want in your package, choose the Language, Installation settings, …

At the end of the customization tool, you can download your custom XML and ours looks like this:

<Configuration ID=”b92ce88f-6457-4ffa-ac14-6c42f330e0da”>
<Add OfficeClientEdition=”64″ Channel=”Broad” ForceUpgrade=”TRUE”>
<Product ID=”O365ProPlusRetail”>
<Language ID=”MatchOS” />
<ExcludeApp ID=”Groove” />
<ExcludeApp ID=”OneNote” />
<Property Name=”SharedComputerLicensing” Value=”0″ />
<Property Name=”PinIconsToTaskbar” Value=”TRUE” />
<Property Name=”SCLCacheOverride” Value=”0″ />
<Property Name=”AUTOACTIVATE” Value=”0″ />
<Property Name=”FORCEAPPSHUTDOWN” Value=”FALSE” />
<Property Name=”DeviceBasedLicensing” Value=”0″ />
<Updates Enabled=”TRUE” />
<RemoveMSI />
<Setup Name=”Company” Value=”Stad Lokeren” />
<User Key=”software\microsoft\office\16.0\common\general” Name=”shownfirstrunoptin” Value=”1″ Type=”REG_DWORD” App=”office16″ Id=”L_DisableOptinWizard” />
<User Key=”software\microsoft\office\16.0\firstrun” Name=”disablemovie” Value=”1″ Type=”REG_DWORD” App=”office16″ Id=”L_DisableMovie” />
<User Key=”software\microsoft\office\16.0\firstrun” Name=”bootedrtm” Value=”1″ Type=”REG_DWORD” App=”office16″ Id=”L_DisableOfficeFirstrun” />
<User Key=”software\microsoft\office\16.0\excel\options” Name=”defaultformat” Value=”51″ Type=”REG_DWORD” App=”excel16″ Id=”L_SaveExcelfilesas” />
<User Key=”software\microsoft\office\16.0\powerpoint\options” Name=”defaultformat” Value=”27″ Type=”REG_DWORD” App=”ppt16″ Id=”L_SavePowerPointfilesas” />
<User Key=”software\microsoft\office\16.0\word\options” Name=”defaultformat” Value=”” Type=”REG_SZ” App=”word16″ Id=”L_SaveWordfilesas” />
<Display Level=”Full” AcceptEULA=”TRUE” />
<Logging Level=”Off” />


Now the next step was creating an O365 Suite App package in Intune:

We then deployed it to our pilot group, but all of the O365 App package deployments went into failure with the following error code:

This was an error we couldn’t find any information over in the Microsoft Docs, neither did Google offer any help.

After some troubleshooting, I noticed that the firewall tried to download an ‘exe’ file and it was blocked. (Weird though that Microsoft sends an ‘exe’ file instead of an ‘msi’.)

Finally, we imported the Firewall O365 settings (they were available for import) and activated them, and the installations became available for the endusers.