How to Configure Access Control for Office Online Server Previews
Question details
A system administrator needs to enforce user permissions and restrict access for an on-premises Office Online Server preview solution connected to Azure Blob Storage and a public Web API.
- Product
- Office Online Server
- Device & OS
- not provided
- Scenario
- Configuring enterprise file preview access and securing web API requests to an intranet environment.
- Observed behavior
- Seeking methods to validate permissions and control access so unauthorized external users cannot view secure internal documents via the public Web API.
Verify that your Office Online Server architecture, including your public Web API and Azure Blob Storage integrations, is fully documented, and ensure you have administrative access to your network settings and Microsoft Entra ID.
Implement Custom WOPI Host Authentication
Enforce permissions programmatically by validating access tokens within your custom WOPI (Web Application Open Platform Interface) host.
Office Online Server does not manage user permissions directly. Instead, it relies on the WOPI host (your Web API) to dictate who can view or edit a file. By properly configuring your WOPI endpoints, you can ensure that only authorized intranet users receive valid file previews.
Ensure your public Web API endpoint (acting as the WOPI host) validates the user's access token before returning any document metadata to the Office Online Server.
When the Office Online Server requests the file preview, require a short-lived, cryptographically secure token generated by your enterprise authentication provider (e.g., Azure AD).
Keep your Azure Blob Storage containers completely private. Route all file streams strictly through your authenticated Web API endpoint rather than exposing direct public links to the blobs.
Enforce Network-Level Intranet Restrictions
Restrict the Office Online Server and API preview endpoints to be accessible only from within your corporate intranet using network security protocols.
Secure Collaboration and File Sharing with WPS Office
Managing on-premises servers like Office Online Server can be complex and expensive. WPS Office provides a lightweight, highly compatible, and secure alternative for enterprise document collaboration, complete with granular sharing permissions and robust cloud support without the need for extensive IT administration.
- 1. Download WPS Office: Install the free version of WPS Office from the official website on your desktop or mobile device.
- 2. Save to secure cloud: Open your document and save it to WPS Cloud to enable online collaboration features.
- 3. Configure sharing permissions: Click the 'Share' button in the top right corner and set specific view or edit permissions to ensure your document remains private and secure.
Frequently Asked Questions
Can I use Azure Blob Storage directly with Office Online Server without a WOPI host?
No, Office Online Server requires a WOPI (Web Application Open Platform Interface) host to handle the communication, authentication, and file streaming between the storage solution (Azure Blob) and the server itself.
How do I prevent external users from sharing my Office Online preview links?
You must implement strict token expiration in your custom WOPI host and configure your enterprise network firewall to block external requests to the preview server's URL, ensuring only authenticated users within the intranet can load the preview iframe.
Where can I get support for advanced Office Online Server configurations?
Advanced administration, network topology, and security integration questions should be directed to the Microsoft Q&A platform (https://learn.microsoft.com/en-us/answers/), where IT professionals and Microsoft engineers provide specialized architectural support.
