Merge branch 'main' into live

Author: github-actions

.openpublishing.redirection.json

@@ -1321,6 +1321,10 @@
         {
             "source_path": "docs/outlook/privacy-and-security.md",
             "redirect_url": "/office/dev/add-ins/concepts/privacy-and-security"
+        },
+        {
+            "source_path": "docs/outlook/add-in-requirements.md",
+            "redirect_url": "/office/dev/add-ins/concepts/requirements-for-running-office-add-ins"
         }
     ]
-}
+}

docs/concepts/requirements-for-running-office-add-ins.md

@@ -1,7 +1,7 @@
 ---
 title: Requirements for running Office Add-ins
 description: Learn about the client and server requirements that an end user needs to run Office Add-ins.
-ms.date: 02/05/2025
+ms.date: 06/25/2025
 ms.localizationpriority: medium
 ---
 
@@ -26,10 +26,15 @@ For all types of add-ins (content, Outlook, and task pane add-ins and add-in com
 
 For content and task pane add-ins, in the supported Office client applications - Excel, PowerPoint, Project, or Word - you also need either an [app catalog](../publish/publish-task-pane-and-content-add-ins-to-an-add-in-catalog.md) on SharePoint to upload the add-in's XML-formatted add-in only manifest file, or you need to deploy the add-in using [Integrated Apps](/microsoft-365/admin/manage/test-and-deploy-microsoft-365-apps).
 
-To test and run an Outlook add-in, the user's Outlook email account must reside on Exchange 2016 or later, which is available through Microsoft 365, Exchange Online, or through an on-premises installation. The user or administrator installs manifest files for Outlook add-ins on that server.
+To test and run an Outlook add-in, the user's Outlook email account must reside on Exchange 2016 or later, which is available through Microsoft 365, Exchange Online, or through an on-premises installation. The user or administrator installs manifest files for Outlook add-ins on that server. For Exchange on-premises installations, the following requirements apply.
+
+- The server must be Exchange 2016 or later.
+- Exchange Web Services (EWS) must be enabled and must be exposed to the Internet. Many add-ins require EWS to function properly.
+- The server must have a valid authentication certificate in order for the server to issue valid identity tokens. New installations of Exchange Server include a default authentication certificate. For more information, see [Digital certificates and encryption in Exchange 2016](/Exchange/architecture/client-access/certificates) and [Set-AuthConfig](/powershell/module/exchange/organization/Set-AuthConfig).
+- To access add-ins from [AppSource](https://appsource.microsoft.com/marketplace/apps?product=office), the client access servers must be able to communicate with AppSource.
 
 > [!NOTE]
-> POP and IMAP email accounts in Outlook don't support Office Add-ins.
+> POP3 and IMAP email accounts in Outlook don't support Office Add-ins.
 
 ## Client requirements: Windows desktop and tablet
 

docs/outlook/add-in-requirements.md

@@ -4,7 +4,7 @@ description: Nested app authentication and Outlook legacy tokens deprecation FAQ
 ms.service: microsoft-365
 ms.subservice: add-ins
 ms.topic: faq
-ms.date: 05/22/2025
+ms.date: 06/18/2025
 ---
 
 # Nested app authentication and Outlook legacy tokens deprecation FAQ
@@ -24,7 +24,7 @@ Legacy Exchange online tokens have already been turned off for most tenants. We'
 | Date     | Legacy tokens status |
 | -------- | ------------------------------------------------------ |
 | Now | Legacy tokens turned off for most tenants. Admins can reenable legacy tokens via PowerShell. |
-| Jun 2025 | Legacy tokens turned off for all tenants. Admins can no longer reenable legacy tokens via PowerShell. Admins can request an exception through Microsoft Support at [https://aka.ms/LegacyTokensByOctober](https://aka.ms/LegacyTokensByOctober) (this link requires you to sign in to your tenant). |
+| June 16 2025 - July 2025 | Legacy tokens are turned off for all tenants. This process will take several weeks to complete. Admins can no longer reenable legacy tokens via PowerShell. Admins can request an exception through Microsoft Support at [https://aka.ms/LegacyTokensByOctober](https://aka.ms/LegacyTokensByOctober) (this link requires you to sign in to your tenant). |
 | Oct 2025 | Legacy tokens turned off for all tenants. Exceptions are no longer allowed. |
 
 ### When is NAA generally available for my channel?
@@ -419,6 +419,15 @@ Be sure to handle admin consent properly. See [Publish an add-in that requires a
 
 For additional deployment details, see [Make your solutions available in Microsoft AppSource and within Office](/partner-center/marketplace-offers/submit-to-appsource-via-partner-center). If you update your add-in (change the manifest) you need to go through the [certification process again](../publish/publish-nested-app-auth-add-in.md). You can update your web server code any time without a need for review.
 
+### Users get an unexplained error when signing in
+
+When your add-in requests a token, users may see a sign-in popup dialog showing one of the following errors.
+
+- **Something went wrong.** [*error code*]
+- **You can't get there from here**
+
+Check to see if the admin has any conditional access policies applied that enforce specific client restrictions, such as mobile location, or platform type. Also the **approved client app Conditional Access grant** is deprecated and will cause these errors with NAA token requests. An admin must completely remove this policy and switch over to the newer **application protection policy grant** for NAA to work. For more information, see [Migrate approved client app to application protection policy in Conditional Access](/entra/identity/conditional-access/migrate-approved-client-app).
+
 ## Related content
 
 - [Enable SSO in an Office Add-in using nested app authentication](../develop/enable-nested-app-authentication-in-your-add-in.md).

docs/outlook/faq-nested-app-auth-outlook-legacy-tokens.md

@@ -2,7 +2,7 @@
 title: Publish your Office Add-in to Microsoft AppSource
 description: Learn how to publish your Office Add-in to Microsoft AppSource and install the add-in with a Windows app or COM/VSTO add-in.
 ms.topic: concept-article
-ms.date: 02/24/2025
+ms.date: 06/06/2025
 CustomerIntent: As a developer, I want to publish my Office Add-in to Microsoft AppSource so that customers can deploy and use my new add-in.
 ---
 
@@ -128,6 +128,15 @@ We recommend that your installation check whether the user has the Office applic
 
 The exact code needed depends on the installation framework and the programming language that you are using. The following is an example of how to check using C#. 
 
+> [!NOTE]
+> The installation can be designed to install the add-in for all users of the computer, if an administrator of the computer is running the installation program. To implement that design, update the code to do the following.
+>
+> - Check if the user is an administrator of the computer.
+> - If the user is an administrator, the code should do one of the following.
+>
+>     - If you want to force the add-in to be installed for all users, the code should set the `supportLocalComputer` variable to `true`.
+>     - If you want to give the administrator a choice between installing the add-in only for themself or for all users on the computer, the code should present a dialog to the administrator, return the administrator's choice, and set the `supportLocalComputer` variable accordingly.
+
 ```csharp
 using Microsoft.Win32;
 using System;
@@ -146,10 +155,15 @@ namespace SampleProject
             string basePath = @"Software\Microsoft\Office";
             RegistryKey baseKey = Registry.CurrentUser.OpenSubKey(basePath);
             string wxpName = "Word"; // Can be one of "Word", "Powerpoint", or "Excel".
+            bool supportLocalComputer = false; // True means LOCAL_MACHINE support, false means CURRENT_USER support.
 
 
             const string buildNumberStr = "BuildNumber"; 
             const int smallBuildNumber = 18227; // This is the minimum build that supports installation of a web add-in in the installation of a Windows app.
+            if (supportLocalComputer)
+            {
+              smallBuildNumber = 18730; // This is the minimum build that supports installation of a web add-in, for all users of the computer, in the installation of a Windows app.
+            }
             const int supportedBuildMajorNumber = 16; // 16 is the lowest major build of Office applications that supports web add-ins.
 
             if (baseKey != null)
@@ -295,11 +309,16 @@ namespace SampleProject
 
 ##### Create a registry key for the add-in (required)
 
-Include in the installation program a function to add an entry like the following example to the Windows Registry.
+Include in the installation program a function to add *one* of the following keys and values to the Windows Registry, depending on whether the add-in is being installed for all users of the computer or only for the user that is running the installation program.
 
 ```
+// Only the current user.
 [HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Wef\AutoInstallAddins\{{OfficeApplication}}\{{add-inName}}] 
 "AssetIds"="{{assetId}}"
+
+// All users of the computer.
+[HKEY_LOCAL_MACHINE\Software\Microsoft\Office\16.0\AutoInstallAddins\{{OfficeApplication}}\{{add-inName}}] 
+"AssetIds"="{{assetId}}"
 ```
 
 Replace the placeholders as follows:
@@ -315,37 +334,53 @@ Replace the placeholders as follows:
 The following is an example.
 
 ```
+// Only the current user.
 [HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Wef\AutoInstallAddins\Word\ContosoAdd-in] 
 "AssetIds"="WA999999999"
+
+// All users of the computer.
+[HKEY_LOCAL_MACHINE\Software\Microsoft\Office\16.0\AutoInstallAddins\Word\ContosoAdd-in] 
+"AssetIds"="WA999999999"
 ```
 
- The exact code will depend on your installation framework and programming language. The following is an example in C#.
+The exact code depends on your installation framework and programming language. The following is an example in C#.
 
- ```csharp
+> [!NOTE]
+> To install the add-in for all users, change this code so that `WriteRegisterKeys` takes a `bool` parameter. The method should set the `supportLocalMachine` variable to the value that is passed: `true` to install for all users, `false` to install for only the current user.
+
+```csharp
 using Microsoft.Win32;
 using System;
 
 namespace SampleProject
 {
-    internal class WriteRegisterKeysSample
-    {
+   internal class WriteRegisterKeysSample
+   {
         /// <summary>
         /// This function writes information to the registry that will tell Office applications to install the web add-in.
         /// </summary>
+
         private void WriteRegisterKeys()
         {
-            RegistryKey hklm = Registry.CurrentUser;
-            string basePath = @"Software\Microsoft\Office";
-            RegistryKey baseKey = Registry.CurrentUser.OpenSubKey(basePath);
-            string wxpName = "Word";  // Can be one of "Word", "Powerpoint", or "Excel".
-            string assetID = "WA999999999"; // Use the AppSource asset ID of your web add-in.
-            string appName = "ContosoAddin"; // Pass your own web add-in name.
-            const int supportedBuildMajorNumber = 16; // Major Office build numbers before 16 do not support web add-ins.
-            const string assetIdStr = "AssetIDs"; // A registry key to indicate that there is a web add-in to install along with the main app.
+            bool supportLocalMachine = false; // false = CurrentUser, true = LocalMachine
+            RegistryKey targetRootKey = supportLocalMachine ? Registry.LocalMachine : Registry.CurrentUser;
 
-            if (baseKey != null)
+            string basePath = @"Software\Microsoft\Office";
+            using (RegistryKey baseKey = targetRootKey.OpenSubKey(basePath))
             {
-                Version maxVersion = new Version(supportedBuildMajorNumber, 0); // Initial value for the max supported build version.
+                if (baseKey == null)
+                {
+                    Console.WriteLine("Base registry path not found.");
+                    return;
+                }
+
+                string wxpName = "Word";  // Can be "Word", "Powerpoint", or "Excel".
+                string assetID = "WA999999999"; // AppSource asset ID of your web add-in.
+                string appName = "ContosoAddin"; // Your web add-in name.
+                const int supportedBuildMajorNumber = 16;
+                const string assetIdStr = "AssetIDs";
+
+                Version maxVersion = new Version(supportedBuildMajorNumber, 0);
                 foreach (string subKeyName in baseKey.GetSubKeyNames())
                 {
                     if (Version.TryParse(subKeyName, out Version version))
@@ -358,15 +393,24 @@ namespace SampleProject
                 }
 
                 string maxVersionString = maxVersion.ToString();
+                string subKeyPath = supportLocalMachine
+                ? $@"Software\Microsoft\Office\{maxVersionString}\AutoInstallAddins\{wxpName}\{appName}"
+                : $@"Software\Microsoft\Office\{maxVersionString}\Wef\AutoInstallAddins\{wxpName}\{appName}";
 
-                // Create the path under AutoInstalledAddins to write the AssetIDs value.
-                RegistryKey AddInNameKey = hklm.CreateSubKey(String.Format(@"Software\Microsoft\Office\{0}\Wef\AutoInstallAddins\{1}\{2}", maxVersionString, wxpName, appName));
-                if (AddInNameKey != null)
+                using (RegistryKey addInKey = targetRootKey.CreateSubKey(subKeyPath))
                 {
-                    AddInNameKey.SetValue(assetIdStr, assetID);
+                    if (addInKey != null)
+                    {
+                        addInKey.SetValue(assetIdStr, assetID);
+                    }
+                    else
+                    {
+                        Console.WriteLine("Failed to create or open the registry subkey.");
+                    }
                 }
             }
         }
+
     }
 }
 ```
@@ -375,18 +419,28 @@ namespace SampleProject
 
 Skip this section if you aren't a member of the certification program, but *it is required if you are*.
 
-Include in the installation program code to add an entry like the following example to the Windows Registry.
+Include in the installation program code to add *one* of the following keys and values to the Windows Registry, depending on whether the add-in is being installed for all users of the computer or only for the user that is running the installation program.
 
 ```
+// Only the current user.
 [HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Wef\AutoInstallAddins\{{OfficeApplication}}\{{add-inName}}] 
 "HasPrivacyLink"="1"
+
+// All users of the computer.
+[HKEY_LOCAL_MACHINE\Software\Microsoft\Office\16.0\AutoInstallAddins\{{OfficeApplication}}\{{add-inName}}] 
+"HasPrivacyLink"="1"
 ```
 
 Replace the `{{OfficeApplication}}` and `{{add-inName}}` placeholders exactly as in the preceding section. The following is an example.
 
 ```
+// Only the current user.
 [HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Wef\AutoInstallAddins\Word\ContosoAdd-in] 
 "HasPrivacyLink"="1"
+
+// All users of the computer.
+[HKEY_LOCAL_MACHINE\Software\Microsoft\Office\16.0\AutoInstallAddins\Word\ContosoAdd-in] 
+"HasPrivacyLink"="1"
 ```
 
 To implement this, just make two small changes in the code sample in the previous section. 

docs/publish/publish-office-add-ins-to-appsource.md

@@ -56,7 +56,6 @@ The following table summarizes publication methods that are available *only when
 
 |Method|Use|Support limitations|
 |:---------|:------------|:------------|
-|[Sideloading](../testing/test-debug-office-add-ins.md#sideload-an-office-add-in-for-testing)|As part of your development process, to test your add-in running on Windows, iPad, Mac, or in a browser.| Not supported for production add-ins. |
 |[Network share](../testing/create-a-network-shared-folder-catalog-for-task-pane-and-content-add-ins.md)|As part of your development process, to test your add-in running on Windows computers other than your development computer after you have published the add-in to a server other than localhost.|<ul><li>Not supported for production add-ins.</li><li>Not supported for Outlook add-ins.</li><li>Not supported for testing on iPad, Mac, or the web.</li></ul>|
 |[SharePoint catalog](#sharepoint-app-catalog-deployment)|In an on-premises environment, to distribute your add-in to users in your organization.|<ul><li>Not supported for Outlook add-ins.</li><li>Not supported for Office on Mac.</li><li>Not supported for add-ins with any feature that requires a **\<VersionOverrides\>** element in the add-in only manifest.</li></ul>|
 |[Exchange server](#outlook-add-in-exchange-server-deployment)|In an on-premises or online environment, to distribute Outlook add-ins to users.|Only supported for Outlook add-ins.|

docs/publish/publish.md

@@ -1,7 +1,7 @@
 ---
 title: Build your first PowerPoint task pane add-in with Visual Studio
 description: Learn how to build a simple PowerPoint task pane add-in by using the Office JS API and a Visual Studio template.
-ms.date: 08/20/2024
+ms.date: 06/20/2025
 ms.service: powerpoint
 ms.localizationpriority: high
 ---