Working with Office Add-Ins and External Users

Working with Office Add-Ins and External Users

Office add-ins are a great way to extend the experience of the Office Clients and help users achieve their tasks. By helping users in their existing context it is easier to achieve their tasks. With the latest revision of the validation policies for the Office Store you can see that it is possible to add add-ins to Word Online and Excel Online. Something that requires some changes in the add-in manifest, so we took it to hearth to get the Mavention Post To Yammer working with that.

Before submitting the updated add-in we did do some testing ourselves and one thing stood out. It is not just related to the Word and Excel Online clients, yet we just didn’t test it in this scenario before.

External Sharing

With Office 365 it is easy to share any document or library with external parties. When something is shared you have the option to give those users the option to edit a document. When editing a document that contains an Office Add-In any employee can add a add-in from the corporate catalog. These add-ins are available for your employees and can be added as soon as you have read access to your app catalog. Besides the read access you will need to have contribute permissions on the file.

Now if you share a document you can hand out those contribute permissions, however if you open a document as an external user without access to the App Catalog you will be prompted with an error.

App Catalog Access Denied Error

Depending on your Office 365 tenant configuration any user can share documents. Yet without access to the app catalog the add-ins will throw an error. As by default the documents will show the add-in the error is prompted each time you open a document. Luckily once you have added the external user to the App Catalog all problems are solved. Out of the box when you create a new App Catalog site you will see that the everyone group does not have any permissions. And in a real world you would probably would never add a single user. So it would be a best practice to add the Everyone group to the visitors group. This should give them enough permissions to view the add-ins and work with them.

Obviously there is a downside on this as well, it means that all add-ins that are available through the corporate catalog can be used by external users in documents that they have contribute permissions for as well. Yet without those permissions users are presented with an error and that would break their flow.

There are 4 comments for this article
  1. Stu RB at 18:17

    Albert. This has taken me weeks to work out. I have an Add-In that I have written. I want to give it to my customers as part of a package, but it is infuriatingly difficult. It looks like you might have the answer here. I know almost nothing about the workings of SharePoint or Office 365. But I don't want to spend hours and money finding out all about them if it can't ever do what I want. It's so hard to find out if things are possible. So here is my scenario:

    I have an Excel Add-in. It works perfectly in Excel 2013 or later, but is way too slow to work in Excel online or Excel 365 (because it uses a big spreadsheet.)
    So I can get it working on a clients machine by adding a share on to their PC and then linking up the share with the manifest file and the trust center in Excel. Great, but the file stores a link to their Add-in. So if someone else opens it, you get the problem that you have described. (By the way, to fix this, add ".zip" to the file name e.g., open the archive, delete the webextensions folder, save it, close it, remove the ".zip" extension. Then you can open the file without a broken Add-in)

    So for every client I have to set up a new share etc. Its a big barrier to sales and no one can share files without going through the .zip rigmarole.

    So it seems you have a way around this. I have tried setting up a free trial on SharePoint and in Office 365 Admin center I have created an App Catalog (for some reason not showing as Add-in Catalog). In here I now have some site collections and I have created one like this I click on this and go to Site collection properties, then click on the link and I get a new window, where it says 'Apps for Office' (again not Add-ins). In here I have uploaded my .xml manifest file.

    Hope you are still with me, is this complicated or what, just to share my app? Why isn't there just a box in Excel where I can past in the path to my app, I guess because MS don't get to control me that way, even though I am going to be encouraging loads of people to buy Excel 2013 or later, anyway I digress….

    Now in my Excel Trust center I have added a trusted location as follows: and ticked Allow Trusted locations on my network for good measure.

    Then in Trusted Add-in Catalogs I have added a path to my .xml file like this:

    Then I go to Excel Insert tab -> My Add-ins -> My Organisation and I get 'Access denied to catalog'

    If I log in to Office 356 and go via Excel online it does work of course (but unrealistically slow compared to desktop) But as soon as I open it up in Excel I get your problem.

    Any pointers as to how to share my manifest file with the big wide world without having to submit to the MS App Store (which I am doing, but whatever they say, Excel online just does not behave the same as Excel) would be very very gratefully received.


Leave a Reply