Skip to main content
Version: 4.1 (2026-H2)

Office Web Add-In

The Office Web Add-In makes primedocs available in Word, Excel and PowerPoint in the browser (Microsoft 365 / office.com). It offers the same task pane as the Office Desktop Add-In.

note

The Web and Desktop Add-In are technically identical: they use the same manifest and the same generation endpoint. An Office.js add-in runs with the same manifest both in the Office desktop applications (Windows, macOS) and in Office in the browser.

Installation​

Installation is identical to the Desktop Add-In – configuration in the primedocs.config, generation of the manifest and distribution via the Microsoft 365 Admin Center. You can find the full instructions here:

➜ Office Desktop Add-In — Installation

After distribution via the Microsoft 365 Admin Center, the add-in is automatically also available in Office in the browser; a separate step is not required.

Prerequisites​

  • Microsoft 365 with Office in the browser (office.com).
  • Reachability of the primedocs web application via HTTPS.
  • Distribution of the add-in via the Microsoft 365 Admin Center.
note

For the new Outlook in the browser, there is a separate add-in with its own manifest: Outlook (New).

Single sign-on (Nested App Authentication)​

The web add-ins support single sign-on via Nested App Authentication (NAA). If an Office 365 auth provider with a ClientId is configured in the primedocs authentication provider, the add-in signs the user in automatically through their Microsoft 365 account — without a separate login. No dedicated feature flag is needed; the feature is active as soon as the ClientId is configured.

Prerequisites:

  • The Office host must support the NestedAppAuth 1.1 requirement set (current Office versions). If it is not supported, the add-in falls back to the regular sign-in.
  • An Entra ID (Azure AD) app registration whose client id is configured as the ClientId of the Office 365 auth provider.
  • The app registration's required API permissions must be admin-consented, because NAA relies on the statically configured, consented permissions (.default).