view.officeapps.live.com to view files

Question

Could you please clarify how long files are cached on view.officeapps.live.com, whether the cached files could be accessed by others, and what security measures are in place to protect temporary documents?

---

Moved from Microsoft 365 and Office | Office Online Server

Answer 1

Hi Allen,

Files opened through view.officeapps.live.com (Office for the web) are not publicly accessible by default. Only you can access them unless you explicitly share the file or link. Documents created or opened online are automatically stored in your personal OneDrive, and access is controlled by your Microsoft account permissions.

Regarding caching, Microsoft doesn’t specify an exact duration, but files are only temporarily cached for performance purposes and are tied to your authenticated session. These cached copies are not directly accessible to other users and are automatically cleared by the service over time or when sessions expire.

In terms of security, Microsoft uses authentication tokens, access controls, and encrypted connections (HTTPS) to ensure that only authorized users can access files. Additionally, any temporary data is handled within Microsoft’s secure cloud infrastructure and is not exposed publicly.

Answer 2

Files rendered through Microsoft 365 for the web (such as via view.officeapps.live.com) are stored in a local document cache to optimize viewing performance.

1. Cache duration

• The cache is not time-based but based on available space and usage.
• Documents remain in the cache while they are “popular.”
  • Unpopular files may expire from the cache in only a few days.
  • Popular documents may remain in the cache for up to 30 days.

2. Access to cached files by others

• Documents in the cache are indexed using a SHA256 hash generated from the file contents or another unique file attribute, not from user information.
• No user information is used to index the file, and the SHA256 hash is not logged when the file is cached.
• Because the hash is derived from file-specific data and is not tied to a user, Microsoft 365 for the web cannot retrieve information specific to a given user from the cache without participation from the WOPI host that validates access tokens.
• This design makes it effectively impossible for Microsoft 365 for the web to locate or expose cached content for a specific host or user without that host’s involvement.

3. Security measures for temporary documents

• Documents are indexed with a SHA256 hash, which is an extremely large number with essentially no chance of collision, helping ensure that each cached file is uniquely and securely referenced.
• As of May 2016, the contents of the cache are encrypted using a FIPS 140-2–compliant encryption algorithm.
• Access to a file still requires a valid access token from the WOPI host on each request, so simply being in the cache does not bypass normal authorization.

---

References:

• Considerations for security and privacy