Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 9 additions & 9 deletions docs/concepts/add-in-development-best-practices.md
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
---
---
title: Best practices for developing Office Add-ins
description: Apply the best practices when developing Office Add-ins.
ms.topic: best-practice
Expand All @@ -23,11 +23,11 @@ Build add-ins that help users complete tasks quickly and efficiently. Focus on s

Make sure users understand your add-in's value immediately by [creating an engaging first-run experience](#create-an-engaging-first-run-experience).

When you're ready to promote your add-in, learn how to create an [effective AppSource listing](/partner-center/marketplace-offers/create-effective-office-store-listings).
When you're ready to promote your add-in, learn how to create an [effective Microsoft Marketplace listing](/partner-center/marketplace-offers/create-effective-office-store-listings).

- Make your add-in's benefits clear in the title and description. Don't rely only on your brand to communicate what your add-in does.
- Ensure your add-in provides sufficient value to justify users' investment. It shouldn't be just a simple utility or have limited scope.
- [!INCLUDE [AppSource enterprise info](../includes/appsource-enterprise.md)]
- [!INCLUDE [Microsoft Marketplace enterprise info](../includes/appsource-enterprise.md)]

## Create an engaging first-run experience

Expand Down Expand Up @@ -131,27 +131,27 @@ Performance directly impacts user satisfaction. Follow these guidelines to keep

Ready to share your add-in with the world? Here's how to get started.

- **Create a Partner Center account.** This process can take time, so if you plan to publish to AppSource, start early. See [Partner Center account](/partner-center/marketplace-offers/open-a-developer-account).
- **Create a Partner Center account.** This process can take time, so if you plan to publish to Microsoft Marketplace, start early. See [Partner Center account](/partner-center/marketplace-offers/open-a-developer-account).

- **Create an effective AppSource listing.** Follow these tips:
- **Create an effective Microsoft Marketplace listing.** Follow these tips:

- Use succinct, descriptive titles (128 characters or fewer).
- Write short, compelling descriptions that answer "What problem does this add-in solve?"
- Convey your add-in's value proposition clearly in the title and description. Don't rely only on your brand.

Learn more about [creating effective AppSource listings](/partner-center/marketplace-offers/create-effective-office-store-listings).
Learn more about [creating effective Microsoft Marketplace listings](/partner-center/marketplace-offers/create-effective-office-store-listings).

- **Publish to AppSource.** Follow the AppSource [prepublish checklist](/partner-center/marketplace-offers/checklist) and [submission guide](/partner-center/marketplace-offers/add-in-submission-guide). Make sure to:
- **Publish to Microsoft Marketplace.** Follow the Microsoft Marketplace [prepublish checklist](/partner-center/marketplace-offers/checklist) and [submission guide](/partner-center/marketplace-offers/add-in-submission-guide). Make sure to:

- Test your add-in thoroughly on all supported operating systems, browsers, and devices.
- Provide detailed testing instructions and resources for certification reviewers.

- **Create a website.** Help users discover your add-in outside of AppSource.
- **Create a website.** Help users discover your add-in outside of Microsoft Marketplace.

- **Promote your add-in** from your website. See [how to promote your add-in](/partner-center/marketplace-offers/promote-your-office-store-solution).

> [!IMPORTANT]
> [!INCLUDE [AppSource enterprise info](../includes/appsource-enterprise.md)]
> [!INCLUDE [Microsoft Marketplace enterprise info](../includes/appsource-enterprise.md)]

## Support older Microsoft webviews and Office versions (recommended but not required)

Expand Down
4 changes: 2 additions & 2 deletions docs/concepts/browsers-used-by-office-web-add-ins.md
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,8 @@ Which webview is used depends on:
>
> We recommend (but don't require) that you continue to support these combinations, at least in a minimal way, by providing users of your add-in a graceful failure message when your add-in is launched in one of these webviews. Keep these additional points in mind:
>
> - Office on the web no longer opens in Internet Explorer or Microsoft Edge Legacy. Consequently, [AppSource](/partner-center/marketplace-offers/submit-to-appsource-via-partner-center) doesn't test add-ins in Office on these web browsers.
> - AppSource still tests for combinations of platform and Office *desktop* versions that use Trident or EdgeHTML. However, it only issues a warning when the add-in doesn't support these webviews; the add-in isn't rejected by AppSource.
> - Office on the web no longer opens in Internet Explorer or Microsoft Edge Legacy. Consequently, [Microsoft Marketplace](/partner-center/marketplace-offers/submit-to-appsource-via-partner-center) doesn't test add-ins in Office on these web browsers.
> - Microsoft Marketplace still tests for combinations of platform and Office *desktop* versions that use Trident or EdgeHTML. However, it only issues a warning when the add-in doesn't support these webviews; the add-in isn't rejected by Microsoft Marketplace.
> - The [Script Lab tool](../overview/explore-with-script-lab.md) no longer supports Trident.
>
> For more information about supporting Trident or EdgeHTML, including configuring a graceful failure message on your add-in, see [Support older Microsoft webviews and Office versions](../develop/support-ie-11.md).
Expand Down
8 changes: 4 additions & 4 deletions docs/concepts/duplicate-legacy-metaos-add-ins.md
Original file line number Diff line number Diff line change
Expand Up @@ -25,11 +25,11 @@ Use the following steps.
1. Open the extension object in the [`"extensions"`](/microsoft-365/extensibility/schema/root#extensions) array.
1. Create an [`"alternates"`](/microsoft-365/extensibility/schema/element-extensions#alternates) array property, if there isn’t one already.
1. In the `"alternates"` array, create an alternate object that has a [`"hide"`](/microsoft-365/extensibility/schema/extension-alternate-versions-array#hide) property.
1. If the existing add-in is marketed through AppSource, give the `"hide"` object a [`"storeOfficeAddin"`](/microsoft-365/extensibility/schema/extension-alternate-versions-array-hide#storeofficeaddin) property. Otherwise, skip to step 6.
1. If the existing add-in is marketed through Microsoft Marketplace, give the `"hide"` object a [`"storeOfficeAddin"`](/microsoft-365/extensibility/schema/extension-alternate-versions-array-hide#storeofficeaddin) property. Otherwise, skip to step 6.
1. Give the `"storeOfficeAddin"` object two properties:

- An `"officeAddinId"` with the GUID of the old add-in as its value.
- An `"assetId"` with the AppSource asset ID as its value.
- An `"assetId"` with the Microsoft Marketplace asset ID as its value.

The following is an example:

Expand Down Expand Up @@ -59,7 +59,7 @@ Use the following steps.
> - The asset ID of the add-in in your unified manifest must match with an existing add-in that has been published by your seller account on Partner Center. If the asset ID of the add-in that you have linked in your unified manifest doesn't match an existing offer published by your seller account, the unified manifest submission will fail. You'll need to update the manifest to use the correct add-in asset ID and re-submit the unified manifest.
> - An existing add-in can only be hidden by a single unified manifest. At this time, you may not use multiple unified manifests to hide the same add-in. If you try to hide an already linked add-in using a different unified manifest, the submission will fail. You'll need to remove the linking and re-submit the unified manifest.

1. If the old add-in isn't distributed through AppSource, then give the `"hide"` object a [`"customOfficeAddin"`](/microsoft-365/extensibility/schema/extension-alternate-versions-array-hide-custom-office-addin) property.
1. If the old add-in isn't distributed through Microsoft Marketplace, then give the `"hide"` object a [`"customOfficeAddin"`](/microsoft-365/extensibility/schema/extension-alternate-versions-array-hide-custom-office-addin) property.
1. Give the `"customOfficeAddin"` object an `"officeAddinId"` property with the GUID of the old add-in as its value. The following is an example.

```json
Expand All @@ -82,7 +82,7 @@ Use the following steps.
]
```

Don't remove the existing add-in from AppSource or the Microsoft 365 Admin Center, or earlier versions of Office will no longer be able to use your add-in.
Don't remove the existing add-in from Microsoft Marketplace or the Microsoft 365 Admin Center, or earlier versions of Office will no longer be able to use your add-in.

## Maintain both versions for the immediate future

Expand Down
22 changes: 11 additions & 11 deletions docs/concepts/privacy-and-security.md
Original file line number Diff line number Diff line change
Expand Up @@ -52,9 +52,9 @@ In supported web clients, Office Add-ins are hosted in an **iframe** that runs u

![Diagram of the infrastructure that supports Office Add-ins in Office on the web clients.](../images/dk2-agave-overview-03.png)

## Add-in integrity in AppSource
## Add-in integrity in Microsoft Marketplace

You can make your Office Add-ins available to the public by publishing them to AppSource. AppSource enforces the following measures to maintain the integrity of add-ins.
You can make your Office Add-ins available to the public by publishing them to Microsoft Marketplace. Microsoft Marketplace enforces the following measures to maintain the integrity of add-ins.

- Requires the host server of an Office Add-in to always use Secure Sockets Layer (SSL) to communicate.

Expand Down Expand Up @@ -85,7 +85,7 @@ This section describes the protection offered by the Office Add-ins platform fro

### End users' perspective

Office Add-ins are built using web technologies that run in a browser control or **iframe**. Because of this, using add-ins is similar to browsing to web sites on the Internet or intranet. Add-ins can be external to an organization (if you acquire the add-in from AppSource) or internal (if you acquire the add-in from an Exchange Server add-in catalog, SharePoint app catalog, or file share on an organization's network). Add-ins have limited access to the network and most add-ins can read or write to the active document or mail item. The add-in platform applies certain constraints before a user or administrator installs or starts an add-in. But as with any extensibility model, users should be cautious before starting an unknown add-in.
Office Add-ins are built using web technologies that run in a browser control or **iframe**. Because of this, using add-ins is similar to browsing to web sites on the Internet or intranet. Add-ins can be external to an organization (if you acquire the add-in from Microsoft Marketplace) or internal (if you acquire the add-in from an Exchange Server add-in catalog, SharePoint app catalog, or file share on an organization's network). Add-ins have limited access to the network and most add-ins can read or write to the active document or mail item. The add-in platform applies certain constraints before a user or administrator installs or starts an add-in. But as with any extensibility model, users should be cautious before starting an unknown add-in.

> [!NOTE]
> Users may see a security prompt to trust the domain the first time an add-in is loaded. This will happen if the add-in's domain host is outside of the domain of Exchange on-premise or Office Online Server.
Expand All @@ -94,7 +94,7 @@ The add-in platform addresses end users' privacy concerns in the following ways.

- Data communicated with the web server that hosts a content, Outlook or task pane add-in as well as communication between the add-in and any web services it uses must be encrypted using the Secure Socket Layer (SSL) protocol.

- Before a user installs an add-in from AppSource, the user can view the privacy policy and requirements of that add-in. In addition, Outlook add-ins that interact with users' mailboxes surface the specific permissions that they require; the user can review the terms of use, requested permissions and privacy policy before installing an Outlook add-in.
- Before a user installs an add-in from Microsoft Marketplace, the user can view the privacy policy and requirements of that add-in. In addition, Outlook add-ins that interact with users' mailboxes surface the specific permissions that they require; the user can review the terms of use, requested permissions and privacy policy before installing an Outlook add-in.

- When sharing a document, users also share add-ins that have been inserted in or associated with that document. If a user opens a document that contains an add-in that the user hasn't used before, the Office client application prompts the user to grant permission for the add-in to run in the document. In an organizational environment, the Office client application also prompts the user if the document comes from an external source.

Expand All @@ -106,11 +106,11 @@ The add-in platform addresses end users' privacy concerns in the following ways.

A user's device capabilities include their camera, geolocation, and microphone. To learn more, see [View, manage, and install add-ins for Excel, PowerPoint, and Word](https://support.microsoft.com/office/16278816-1948-4028-91e5-76dca5380f8d).

- Users can enable or disable the access to AppSource. For content and task pane add-ins, users manage access to trusted add-ins and catalogs from the **Trust Center** on the host Office client (opened from **File** > **Options** > **Trust Center** > **Trust Center Settings** > **Trusted Add-in Catalogs**).
- Users can enable or disable the access to Microsoft Marketplace. For content and task pane add-ins, users manage access to trusted add-ins and catalogs from the **Trust Center** on the host Office client (opened from **File** > **Options** > **Trust Center** > **Trust Center Settings** > **Trusted Add-in Catalogs**).

In Outlook, access to manage add-ins depends on the user's Outlook client. To learn more, see [Use add-ins in Outlook](https://support.microsoft.com/office/1ee261f9-49bf-4ba6-b3e2-2ba7bcab64c8).

Administrators can also manage access to AppSource [through the admin center](/microsoft-365/admin/manage/manage-addins-in-the-admin-center).
Administrators can also manage access to Microsoft Marketplace [through the admin center](/microsoft-365/admin/manage/manage-addins-in-the-admin-center).

- The design of the add-in platform provides security and performance for end users in the following ways.

Expand Down Expand Up @@ -152,9 +152,9 @@ The following lists some specific PII protection guidelines for you as a develop

- Using some applications can reveal PII. Make sure that you securely store data for your users' identity, location, access times, and any other credentials so that data won't become available to other users of the add-in.

- If your add-in is available in AppSource, the AppSource requirement for HTTPS protects PII transmitted between your web server and the client computer or device. However, if you re-transmit that data to other servers, make sure you observe the same level of protection.
- If your add-in is available in Microsoft Marketplace, the requirement for HTTPS protects PII transmitted between your web server and the client computer or device. However, if you re-transmit that data to other servers, make sure you observe the same level of protection.

- If you store users' PII, make sure you reveal that fact, and provide a way for users to inspect and delete it. If you submit your add-in to AppSource, you can outline the data you collect and how it's used in the privacy statement.
- If you store users' PII, make sure you reveal that fact, and provide a way for users to inspect and delete it. If you submit your add-in to Microsoft Marketplace, you can outline the data you collect and how it's used in the privacy statement.

## Developers' permission choices and security practices

Expand Down Expand Up @@ -315,7 +315,7 @@ Developers should also take note of the following security practices.

- Developers shouldn't embed keys that they use to access APIs or services from Microsoft and others (such as Bing, Google, or Facebook) directly in the HTML pages of their add-in. Instead, they should create a custom web service or store the keys in some other form of secure web storage that they can then call to pass the key value to their add-in.

- Developers should do the following when submitting an add-in to AppSource.
- Developers should do the following when submitting an add-in to Microsoft Marketplace.

- Host the add-in they are submitting on a web server that supports SSL.
- Produce a statement outlining a compliant privacy policy.
Expand All @@ -325,15 +325,15 @@ Other than resource usage rules, developers for Outlook add-ins should also make

## IT administrators' control

In a corporate setting, IT administrators have ultimate authority over enabling or disabling access to AppSource and any private catalogs.
In a corporate setting, IT administrators have ultimate authority over enabling or disabling access to Microsoft Marketplace and any private catalogs.

The management and enforcement of Office settings is done with group policy settings. These are configurable through the [Office Deployment Tool](/deployoffice/overview-office-deployment-tool), in conjunction with the [Office Customization Tool](/deployoffice/admincenter/overview-office-customization-tool).

| Setting name | Description |
|--------------|-------------|
| Allow Unsecure web add-ins and Catalogs | Allows users to run non-secure Office Add-ins, which are Office Add-ins that have webpage or catalog locations that are not SSL-secured (https://) and are not in users' Internet zones. |
| Block Web Add-ins | Allows you to prevent users from running Office Add-ins that use web technologies. |
| Block the Office Store | Allows you to prevent users from getting or running Office Add-ins that come from [AppSource](https://appsource.microsoft.com). |
| Block the Office Store | Allows you to prevent users from getting or running Office Add-ins that come from [Microsoft Marketplace](https://marketplace.microsoft.com). |

To specify permissions to install and manage Outlook add-ins in an organization that uses Exchange Online, configure administrative and user roles in the Exchange admin center. For more information, see [Specify the administrators and users who can install and manage add-ins for Outlook in Exchange Online](/exchange/clients-and-mobile-in-exchange-online/add-ins-for-outlook/specify-who-can-install-and-manage-add-ins).

Expand Down
4 changes: 2 additions & 2 deletions docs/concepts/requirements-for-running-office-add-ins.md
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
---
---
title: Requirements for running Office Add-ins
description: Learn about the client and server requirements that an end user needs to run Office Add-ins.
ms.date: 08/13/2025
Expand Down Expand Up @@ -31,7 +31,7 @@ To test and run an Outlook add-in, the user's Outlook email account must reside
- The server must be Exchange 2016 or later.
- Exchange Web Services (EWS) must be enabled and must be exposed to the Internet. Many add-ins require EWS to function properly.
- The server must have a valid authentication certificate in order for the server to issue valid identity tokens. New installations of Exchange Server include a default authentication certificate. For more information, see [Digital certificates and encryption in Exchange 2016](/Exchange/architecture/client-access/certificates) and [Set-AuthConfig](/powershell/module/exchangepowershell/set-authconfig).
- To access add-ins from [AppSource](https://appsource.microsoft.com/marketplace/apps?product=office), the client access servers must be able to communicate with AppSource.
- To access add-ins from [Microsoft Marketplace](https://marketplace.microsoft.com/marketplace/apps?product=office), the client access servers must be able to communicate with Microsoft Marketplace.

> [!NOTE]
> POP3 and IMAP email accounts in Outlook don't support Office Add-ins.
Expand Down
Loading