Share via

What are the requirements to integrate Microsoft office 365 via WOPI to my application?

Rakshitha Ravindra 20 Reputation points
2026-03-30T08:54:32.16+00:00

What are the requirements to integrate Microsoft office 365 via WOPI to my application?
I want to understand both in terms of licensing and technical requirements.

Microsoft 365 and Office | Development | Other
0 comments
Answer accepted by question author
  1. Gabriel-N 16,240 Reputation points Microsoft External Staff Moderator
    2026-03-30T10:07:12+00:00

    Dear Rakshitha Ravindra

    Thank you for raising this question, it’s a great topic and one that often comes up when planning a WOPI integration.

    First, I recommend referring to the Q&A Assist answer, as it already provides some helpful insights that align closely with my own understanding of the topic.

    In addition, I’d like to add a small clarification based on my research:

    From a licensing perspective, you must be an approved Cloud Storage Partner, and each end user must also have a valid Microsoft 365 license in order to use Office for the web.

    From a technical perspective, your application needs to implement a secure WOPI host, expose the required WOPI REST endpoints, support WOPI discovery, and embed Office for the web using an iframe.

    For more detailed guidance, I recommend reviewing the following Microsoft Learn documents:

    I hope this additional information is helpful.

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    1 person found this answer helpful.
    0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Q&A Assist
    2026-03-30T08:55:00.9133333+00:00
    AI generated content. This question contains an answer created with AI from Q&A Assist. Learn more

    To integrate Microsoft 365 (Office) via WOPI with an application, both licensing/program requirements and technical requirements must be met.

    Licensing and program requirements

    1. Be a Cloud Storage Provider and join CSPP
      Integration with Microsoft 365 for the web and Microsoft 365 for mobile via WOPI is only available to partners in the Microsoft 365 – Cloud Storage Partner Program (CSPP). Key points:
      • Must be an independent software vendor whose business includes cloud file storage and whose solution is offered as SaaS.
      • Must store all end users’ files at rest in a cloud location owned or leased by the partner, not in locations owned/leased by customers.
      • Must own the WOPI host domain URLs used for integration.
      • Must serve more than one external customer.
      • The program is not open to Microsoft 365 customers directly; it is for cloud storage ISVs.
        Application is via the Cloud Storage Partner Program site: https://developer.microsoft.com/office/cloud-storage-partner-program (also referenced as https://aka.ms/cspp-apply).
    2. Acceptance of CSPP Integration Terms
      Participation is governed by the Microsoft Cloud Storage Partner Program Integration Terms. Among other things:
      • Microsoft grants a non‑exclusive, royalty‑free license under “Necessary Claims” to implement WOPI only for integrating with Microsoft 365 technology as described in the Program Documentation.
      • The license covers only what is required to implement WOPI per the technical documentation; it does not extend to other technologies.
      • The partner may sublicense these rights only to third parties acting on its behalf for the partner’s application/service.
      • The Company Application and Company Service must comply with the Terms and Program Documentation before being made available.
    3. Program-level functional requirements
      CSPP participants must:
      • Demonstrate full WOPI integration in compliance with the Integration Terms and documentation.
      • Support upload, download, viewing, and editing in Word, Excel, and PowerPoint for the web, even if the end-user UI exposes only a subset of these apps or features.
      • Inform end users that Microsoft 365 for the web is a Microsoft service and that its use is subject to Microsoft’s terms of use and privacy policy.

    Technical requirements (WOPI integration)

    1. Implement WOPI REST endpoints
      WOPI is a REST-based protocol. The storage service acts as a WOPI host/server, and Microsoft 365 apps (web or mobile) are WOPI clients. The host must implement the required WOPI operations for the target clients:
      • For Microsoft 365 for the web: implement the operations listed in “WOPI implementation requirements on Microsoft 365 for the web integration”.
      • For Microsoft 365 for mobile: implement the operations listed in “WOPI implementation requirements for mobile integration”.
    2. File identity model (File ID)
      The host must define a File ID scheme that:
      • Uniquely represents a single file.
      • Is URL-safe, because it is passed in URLs via the WOPISrc parameter.
      • Remains stable when the file is edited, moved, or renamed, and when ancestor containers are renamed.
      • Is the same for a shared file for all users who access it.
        The File ID is not exposed directly to the client; it is embedded in WOPISrc used in action URLs.
    3. Discovery and action URLs (web integration)
      For Microsoft 365 for the web:
      • Use WOPI discovery to read XML from a Microsoft 365 for the web URL that describes available actions (view/edit) and how to invoke them.
      • Use the discovered action URLs and pass WOPISrc (containing the File ID) and an access token when launching Word/Excel/PowerPoint for the web.
    4. Host page / iframe integration (web)
      • Provide an HTML host page that embeds the Microsoft 365 for the web application in an <iframe>.
      • This is the page users visit to open or edit documents within the partner’s solution.
      • Optionally, integrate custom UI via postMessage to interact with the Microsoft 365 for the web iframe (e.g., custom Share UI).
    5. Mobile integration flow
      For Microsoft 365 for mobile:
      • Join the Office 365 – Cloud Storage Partner Program (same CSPP family) and complete onboarding.
      • Obtain a ProviderId and app store URLs from Microsoft.
      • Add the WOPI domain to the WOPI domain allow list so the WOPI Validator can be used.
      • Implement WOPI operations required for mobile.
      • Implement required changes in the mobile app and use Microsoft-provided test mode for validation.
    6. Authentication and access tokens
      • Authentication is handled by passing Microsoft 365 (web or mobile) an access token generated by the host.
      • For mobile, the token is generated from a Bootstrapper URL.
      • Tokens should have reasonable expiration and ideally be scoped to a single user and a single file to mitigate token leak risks.
    7. Testing and validation (especially mobile)
      • Run the WOPI Validator and fix all issues until it reports 100% pass.
      • Complete required manual validation test cases and submit the report and validator instructions to Microsoft.
      • Microsoft then performs its own manual testing and coordinates launch.

    In summary, integration requires: joining the Cloud Storage Partner Program and accepting its legal terms; operating a qualifying cloud storage SaaS; implementing the WOPI REST protocol (including stable File IDs, discovery, host pages, and access tokens); and passing Microsoft’s validation and testing requirements for web and/or mobile clients.

    References:

    1 person found this answer helpful.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.