The getAccessTokenAsync API in Office.js enables users who are signed into Office to get access to an AAD-protected add-in and to Microsoft Graph without needing to sign-in again. This sample is built on ASP.NET and Microsoft Identity Library (MSAL).

Note: The getAccessTokenAsync API is in preview.

• Change History
• Prerequisites
• To use the project
• Questions and comments
• Additional resources

• May 10, 2017: Initial version.
• September 15, 2017: Added support for 2FA.
• December 8, 2017: Added extensive error handling.
• January 7, 2019: Added information about web application security practices.

• An Office 365 account.
• During the preview phase, the SSO requires Office 365 (the subscription version of Office, also called “Click to Run”). You should use the latest monthly version and build from the Insiders channel. You need to be an Office Insider to get this version. For more information, see Be an Office Insider. Please note that when a build graduates to the production semi-annual channel, support for preview features, including SSO, is turned off for that build.
• Visual Studio 2017, version 15.4.0 Preview 1 or later

The samples in this repo are narrowly focused on demonstrating the use of the SSO APIs. To keep it simple, some best practices are not followed, including best practices in web application security. You should not use any of these samples as the starting point of a production add-in unless you are prepared to make substantial changes. We recommend that you begin a production add-in by using one of the Office Add-in projects in Visual Studio, or by generating a new project with the Yeoman Generator for Office Add-ins.

One of the points to keep in mind about these samples:

• The samples send a hardcoded query parameter on the URL for the Microsoft Graph REST API. If you modify this code in a production add-in and any part of query parameter comes from user input, be sure that it is sanitized so that it cannot be used in a Response header injection attack.

This sample is meant to accompany the walkthrough at: Create an ASP.NET Office Add-in that uses Single Sign-on (preview)

There are two versions of the sample, in the folders Before and Completed.

To use the Before version and manually add the crucial SSO-oriented code, follow all the procedures in the article linked to above.

To work with the Completed version, follow all the procedures, except the sections "Code the client-side" and "Code the server-side" in the article linked to above.

We'd love to get your feedback about this sample. You can send your feedback to us in the Issues section of this repository.

Questions about Microsoft Office 365 development in general should be posted to Stack Overflow. If your question is about the Office JavaScript APIs, make sure that your questions are tagged with [office-js] and [API].

• Office add-in documentation
• Office Dev Center
• More Office Add-in samples at OfficeDev on Github

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.

Copyright (c) 2017 Microsoft Corporation. All rights reserved.