Share via

Why does Outlook Web media-src CSP block all media not hosted with Microsoft

adithya 5 Reputation points
2025-06-18T07:37:14.3766667+00:00

I have encountered an issue with Outlook Web where media content (such as images) hosted on non-Microsoft domains is being blocked from loading. After investigation, it appears that the Content Security Policy (CSP) for media-src is strictly set to allow only Microsoft-owned domains.
Example of the issue:
-> Media URL (not loading in Outlook Web): https://mydomain.com/media/sample-image.png.
-> Error in browser console: Refused to load media from 'https://mydomain.com/media/sample-image.png' because it violates the following Content Security Policy directive: "media-src ...".

Can you please clarify the intended behaviour of this CSP policy?

Outlook Windows Classic Outlook for Windows For business

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.