Note: This sample uses legacy Office single sign-on (SSO). For a modern authentication experience with support across a wider range of platforms, use the Microsoft Authentication Library (MSAL) with nested app authentication (NAA). For more information, see Enable single sign-on in an Office Add-in with nested app authentication.

The getAccessToken API in Office.js enables users who are signed into Office to get access to an AAD-protected add-in and to Microsoft Graph without needing to sign-in again.

This sample is built on Node.JS, Express, and Microsoft Authentication Library for Node (msal-node).

Integrating data from online service providers increases the value and adoption of your add-ins. This code sample shows you how to connect your add-in to Microsoft Graph. Use this code sample to:

• Build an add-in using Node.js, Express, msal-node, and Office.js
• Connect to Microsoft Graph from an Office Add-in
• Use the OneDrive REST APIs from Microsoft Graph
• Use the Express routes and middleware to implement the OAuth 2.0 authorization framework in an add-in
• See how to use the Single Sign-on (SSO) API
• See how an add-in can fall back to an interactive sign-in in scenarios where SSO is not available
• Use the msal.js library to implement a fallback authentication/authorization system that is invoked when Office SSO is not available
• Show a dialog using the Office UI namespace when Office SSO is not available
• Use add-in commands in an add-in

• Excel on Windows (subscription)
• PowerPoint on Windows (subscription)
• Word on Windows (subscription)

To run this code sample, the following are required:

• Node.js (the latest LTS version)
• Git Bash (or another git client)
• A code editor - we recommend Visual Studio Code
• At least a few files and folders stored on OneDrive for Business in your Microsoft 365 subscription
• A build of Microsoft 365 that supports the IdentityAPI 1.3 requirement set. You might qualify for a Microsoft 365 E5 developer subscription, which includes a developer sandbox, through the Microsoft 365 Developer Program; for details, see the FAQ. The developer sandbox includes a Microsoft Azure subscription that you can use for app registrations in later steps in this article. If you prefer, you can use a separate Microsoft Azure subscription for app registrations. Get a trial subscription at Microsoft Azure.

Follow the instructions at Register an Office Add-in that uses single sign-on (SSO) with the Microsoft identity platform. Use the following values for placeholders in the app registration steps from the previous article.

1. Open a command prompt in the root folder of this project.

2. Enter npm install in the console to install all of the dependencies itemized in the package.json file.

3. Run the command npm run install-dev-certs. You may receive a prompt asking if you want to delete a certificate and/or a prompt to install a certificate. Select Yes to both.

4. Open the project in a code editor.

5. Open the .ENV file and use the values that you copied earlier from the Office-Add-in-NodeJS-SSO app registration. Set the values as follows:

   Name	Value
   CLIENT_ID	Application (client) ID from app registration overview page.
   CLIENT_SECRET	Client secret saved from Certificates & Secrets page.

   The values should not be in quotation marks.

6. Open the add-in manifest file "manifest\manifest_local.xml" and then scroll to the bottom of the file. Just above the </VersionOverrides> end tag, you'll find the following markup.

   <WebApplicationInfo>
     <Id>$app-id-guid$</Id>
     <Resource>api://localhost:3000/$app-id-guid$</Resource>
     <Scopes>
         <Scope>Files.Read</Scope>
         <Scope>profile</Scope>
         <Scope>openid</Scope>
     </Scopes>
   </WebApplicationInfo>

7. Replace the placeholder "$app-id-guid$" in both places in the markup with the Application ID that you copied when you created the Office-Add-in-NodeJS-SSO app registration. The "$" symbols are not part of the ID, so don't include them. This is the same ID you used for the CLIENT_ID in the .ENV file.

   Note: The <Resource> value is the Application ID URI you set when you registered the add-in. The <Scopes> section is used only to generate a consent dialog box if the add-in is sold through Microsoft Marketplace.

8. Open the \public\javascripts\fallback-msal\authConfig.js file. Replace the placeholder "$app-id-guid$" with the application ID that you saved from the Office-Add-in-NodeJS-SSO app registration you created previously.

9. Save the changes to the file.

1. Ensure that you have some files in your OneDrive so that you can verify the results.

2. Open a command prompt in the root of this project.

3. Run the command npm start to start the middle-tier server.

4. You need to sideload the add-in into an Office application (Excel, Word, or PowerPoint) to test it. The instructions depend on your platform. There are links to instructions at Sideload an Office Add-in for Testing.

5. In the Office application, on the Home ribbon, select the Show Add-in button in the SSO Node.js group to open the task pane add-in.

6. Click the Get OneDrive File Names button. If you're logged into Office with either a Microsoft 365 Education or work account, or a Microsoft account, and SSO is working as expected the first 10 file and folder names in your OneDrive for Business are inserted into the document. (It may take as much as 15 seconds the first time.) If you're not logged in, or you're in a scenario that doesn't support SSO, or SSO isn't working for any reason, you'll be prompted to sign in. After you sign in, the file and folder names appear.

Note: If you were previously signed into Office with a different ID, and some Office applications that were open at the time are still open, Office may not reliably change your ID even if it appears to have done so. If this happens, the call to Microsoft Graph may fail or data from the previous ID may be returned. To prevent this, be sure to close all other Office applications before you press Get OneDrive File Names.

When you're ready to stop the middle-tier server and uninstall the add-in, follow these instructions:

• To uninstall or remove the add-in, see the specific sideload article you used for details.

• The /getuserfilenames route in getFilesroute.js uses a literal string to compose the call for Microsoft Graph. If you change the call so that any part of the string comes from user input, sanitize the input so that it cannot be used in a Response header injection attack.

• In app.js the following content security policy is in place for scripts. You may want to specify additional restrictions depending on your add-in security needs.

  "Content-Security-Policy": "script-src https://appsforoffice.microsoft.com https://ajax.aspnetcdn.com https://alcdn.msauth.net " + process.env.SERVER_SOURCE,

Always follow security best practices in the Microsoft identity platform documentation.

• Did you experience any problems with the sample? Create an issue and we'll help you out.
• We'd love to get your feedback about this sample. Go to our Office samples survey to give feedback and suggest improvements.
• For general questions about developing Office Add-ins, go to Microsoft Q&A using the office-js-dev tag.

Join the Microsoft 365 Developer Program to get resources and information to help you build solutions for the Microsoft 365 platform, including recommendations tailored to your areas of interest.

You might also qualify for a free developer subscription that's renewable for 90 days and comes configured with sample data; for details, see the FAQ.

• Microsoft Graph documentation
• Office Add-ins documentation

Copyright (c) 2021 Microsoft Corporation. All rights reserved.

This project has adopted the Microsoft Open Source Code of Conduct. For more information, see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.

Note: The index.pug file contains an image URL that tracks diagnostic data for this sample add-in. Please remove the image tag if you reuse this sample in your own code project.