Enterprise Auto Update policies for the Zoom client

Zoom’s Enterprise Auto Update policies allow system administrators the ability to keep managed desktop client installations up to date in accordance with their own policies and preferences. These policies will afford administrators granular control over desktop client auto-update behavior and UI, giving them the ability to tailor the experience at a group level to meet the needs of a wide variety of user cohorts.

Requirements for using the Auto Update policies

*Note: VDI Client version 5.12.7 or higher must be manually installed by admins in order to support auto-update without admin privileges going forward.

Outdated policies

The EnableSilentAutoUpdate, AlwaysCheckLatestVersion, ZoomAutoUpdate, and SetUpdatingChannel options are no longer supported.

If any of the AU2 policies below are used, these outdated policies are superseded by the behavior of the AU2 policies set.

*Note: By default, auto update functionality is disabled with MSI deployments, as the AU2 policy is not set and the older ZoomAutoUpdate is disabled by default. To enable these auto update behaviors, set ZoomAutoUpdate=1 or explicitly enable any of the AU2 policies listed below.

Auto Update Policies

Policy	Description	Set by	Value type and default
AU2_EnableAutoUpdate	Enable auto updates through the client. Disabling this policy also disables the following AU2 policies: AU2_SetUpdateChannel AU2_LimitManualUpdateVersion AU2_DeploySpecificVersion AU2_SetUpdateSchedule AU2_InstallAtIdleTime AU2_SafeUpgradePeriod	MSI* GPO PLIST ZDM	Boolean, Enabled
AU2_SetUpdateChannel	Set the cadence of updates applied to the desktop client: Slow (0): Fewer updates and better stability. Fast (1): Newest features and updates. Custom auto-update channels, created and managed by account admins, can be also chosen.	MSI GPO PLIST ZDM	String, 0 (Slow)
AU2_UpdateChannelCandidates	Define additional update channel options. The format should follow <channel ID>:<channel name>, with multiple channels separated by a semicolon. For example: 0:Slow;1:Fast;3:Custom Channel Custom channels must be created by admins through the web portal and require the user be authenticated before the custom channel is recognized, otherwise the Slow channel will be used by default. The default Slow and Fast tracks are always available, even if not included in the policy string.	MSI GPO PLIST ZDM	String, <empty>
AU2_EnableShowZoomUpdates	Show the Zoom Updates section of the General tab in client settings. Depending on if AutoUpdate and SetUpdateChannel are required or not, users may only be able to view this setting.	MSI GPO PLIST ZDM	Boolean, Enabled
AU2_LimitManualUpdateVersion	Allow users to manually check for updates to the desktop client, and if their installed version is lower than the version specified by their update channel (Slow, Fast, custom), they will update to that version instead of the latest version available. This policy is dependent on AU2_EnableAutoUpdate and AU2_EnableManualUpdate policies being enabled. If either is disabled, this policy will fail.	MSI GPO PLIST	Disabled, Boolean
AU2_EnableUpdateAvailableBanner	Show the Update Available banner on the Home tab of the client, when an update is available.	MSI GPO PLIST ZDM	Boolean, Enabled
AU2_EnablePromptUpdateForAU2	Prompt users to update when exiting a meeting or webinar, when an update is available.	MSI GPO PLIST ZDM	Boolean, Disabled
AU2_EnableUpdateSuccessNotification	Show notification indicating an update has been successfully installed.	MSI GPO PLIST ZDM	Boolean, Enabled
AU2_EnableManualUpdate	Control the visibility of the Check for Updates option in the client.	MSI GPO PLIST ZDM	Boolean, Enabled
AU2_DeploySpecificVersion	Download and install the specified version, if the currently installed version is below that version. Format should be the official version without spaces or parentheses, ie 5.10.4 (5035) would be entered as 5.10.4.5035	MSI GPO PLIST ZDM	String, (empty)
AU2_SetUpdateSchedule	Set to download an available update version. Update is then initiated by the user through prompt, or during idle time or the specified safe upgrade period. Values are formatted as HHMM-HHMM, such that 1:00 to 2:30 is coded as 0100-0230. Time frames spanning into the next day are supported, such as 1800-0400 meaning 18:00 to 04:00 the next day.	MSI GPO PLIST ZDM	String, (empty)
AU2_InstallAtIdleTime	Auto install an available update when the device is idle. Idle devices must be: No current meeting, phone call, or contact center engagement No upcoming meeting within 30 minutes Screen is locked or screen saver is active	MSI GPO PLIST ZDM	Boolean, Disabled
AU2_SafeUpgradePeriod	Set to install updates within a given time period. This policy depends on AU2_InstallAtIdleTime being enabled. Values are formatted as HHMM-HHMM, such that 1:00 to 2:30 is coded as 0100-0230. Time frames spanning into the next day are supported, such as 1800-0400 meaning 18:00 to 04:00 the next day. MSI example: msiexec /i ZoomInstallerFull.msi ZConfig="AU2_EnableAutoUpdate=true;AU2_InstallAtIdleTime=true; AU2_SafeUpgradePeriod=0000-1200"	MSI GPO PLIST	String, 0000-0400 (Midnight-4:00)

Note: When deploying with MSI, all AU2 policies need to be within the zConfig parameter. For example:

Example configurations

Below are a few possible configurations based on different levels of version control and end-user visibility.

Locked Down - No User Visibility, No Control

In this example, the system administrator wants to control everything about the user experience, and they want to minimize questions and user curiosity by hiding all notifications and configuration UI.

Settings:

End-user experience:
Users cannot see that they are on the Slow Channel, but will be occasionally updated to the latest version promoted to the Slow Channel. They will be prompted for no other available updates and cannot manually update to the latest version.

Some Control - Notifications, IT-specified update and channel settings

In this scenario, the system administrator is providing the Zoom desktop client for a group of technically proficient managers who require Zoom for productive internal operations. Providing this group with some autonomy gives them the flexibility to leverage new tools and services as they become available, while enforcing security policies that require the client to stay updated with the latest security patches.

Settings:

End-user experience:
Users cannot see that they are on the Slow Channel, but will be occasionally updated to the latest version promoted to the Slow Channel. The latest version from the Fast Channel is also available to them, if they wish to manually update.

Full Visibility, Full Control

In this scenario, we want to configure the internal IT test team at a large software company to receive updates as quickly as they can get them. They have a dedicated test lab with client installations, and they run a set of automated manual tests for their critical use-cases. Setting the lab machines to receive auto-update makes life easy for the test engineers, as they don’t have to keep track of whether or not we’ve shipped a new build. If something changes and their tests fail, they’ll see the notifications from their system in real-time. The engineers want the freedom to configure (or disable) auto-update and release channels as needed to support their testing needs.

Settings:

End-user experience:
Users can see that they are on the Slow Channel and will be occasionally updated to the latest version promoted to the Slow Channel, but they can change the cadence to the Fast Channel or manually update to the latest available version.