'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Fix Excel Iframe Prompting Microsoft 365 Sign-In in Private Browsing
Question details
The user needs to prevent an embedded Excel workbook from asking website visitors for a Microsoft 365 sign-in when they view the page in a private or incognito browsing window.
- Product
- Microsoft Excel (Microsoft 365 Business Standard)
- Device & OS
- not provided
- Scenario
- Embedding an Excel workbook with an 'Anyone' sharing link into a website using an HTML iframe.
- Observed behavior
- The embedded spreadsheet displays perfectly in normal browsing but prompts the user to sign into a Microsoft 365 account when viewed in Chrome's private browsing (Incognito) mode.
Verify that your Microsoft 365 Excel workbook is saved to OneDrive or SharePoint and that you have successfully generated an 'Anyone with the link can view' URL before embedding.
Adjust Browser Third-Party Cookie Settings
Allows the iframe to authenticate the public link by permitting essential Microsoft tracking cookies blocked by private browsing.
Private browsing modes, particularly Chrome Incognito, block third-party cookies by default. Because the embedded Excel iframe relies on Microsoft domains to verify the anonymous public access token, blocking these cookies causes the system to fallback to a sign-in prompt.
In Google Chrome, click the three-dot menu in the top right corner and select 'Settings'. Navigate to the 'Privacy and security' tab on the left sidebar.
Click on 'Third-party cookies'. Change the setting from 'Block third-party cookies' to 'Allow third-party cookies'.
Alternatively, scroll down to 'Allowed to use third-party cookies', click 'Add', and enter '[*.]microsoft.com' and '[*.]office.com' to allow embeddings without compromising global privacy.
Verify 'Anyone' Permissions and Use the Official Embed Code
Ensures the underlying file permissions are correctly configured for anonymous public viewing.
Switch to WPS Office for Easier File Sharing
If Microsoft 365's strict authentication and cookie rules are causing display issues for your website visitors, WPS Office offers a free, lightweight alternative. It provides straightforward file sharing and high compatibility with standard Office formats without the complex sign-in loops.
Frequently Asked Questions
Why does Microsoft 365 prompt for a sign-in on an 'Anyone' public link?
This usually occurs because the web browser (especially in Incognito or Private mode) is blocking third-party cookies. Microsoft 365 needs these cookies to communicate between the webpage and its servers to verify the anonymous 'Anyone' access token.
Does this embedded Excel sign-in error happen on all browsers?
No. The behavior is largely dependent on the browser's default tracking protection. Google Chrome blocks third-party cookies in Incognito mode by default, triggering the error. Firefox and Microsoft Edge may handle these cookies differently, allowing the file to load normally.
How can I share an Excel file so it doesn't require a login?
You must select the 'Anyone with the link' option in the Share settings. However, if sharing via an embedded iframe on a website, the visitor's browser must also permit third-party tracking cookies for the embedding domains (microsoft.com and office.com) to bypass the login requirement.
