CSPP WOPI Login Update

Last year, Microsoft announced that they were removing the login box from the “business flow” for Cloud Storage Partner Program (CSPP) WOPI. Over the course of a few weeks, the login box slowly disappeared from all the test and production WOPI nodes, and now it is nowhere to be seen!

What Was The Login Box For?

The login box existed to confirm that business users of the WOPI editor had a valid Microsoft 365 business license when editing Microsoft Office documents. This is a requirement of the CSPP. Users would typically only see the login box once as long as you implemented the UserInfo mechanism in your WOPI API.

Why Did Microsoft Remove The Login Box?

It’s a bit of a mystery! No specific explanation was given. It’s just gone!

Does This Mean That We Don’t Need To Implement The Business Flow Anymore?

No, Microsoft were clear that you MUST still implement the business flow. As far as we can tell, they are no longer independently verifying the existence of a Microsoft365 account, but your business users are still required to have such an account.

Strangely, the documentation still refers to a “subscription check”, although this could be out of date documentation rather than a statement of what is currently happening. However, you should still implement the business flow, as Microsoft may decide to reinstate the login box in future.

UserInfo

The lack of a login box also calls into question the use of the UserInfo feature of WOPI. This feature specifically exists to reduce the number of times that a user is asked to login. As the user is never asked to login, does it still server a useful purpose?

As far as we can tell, no, it is now redundant. However, we still recommend implementing it as it is still part of the WOPI specification (albeit optional) and it is very simple and quick to implement. This also protects you should Microsoft decide to reinstate the login box.

The Homepage Setting

The final consideration here is the “homepage” setting. The homepage documentation outlines only one scenario where this setting is used: when redirecting a user back to your application after a failed Microsoft 365 subscription check. As it does not appear that this check is being carried out, we don’t believe that your users will ever have a way to see this page.

However, this homepage setting is still a requirement for CSPP WOPI and so you must still provide this homepage URL when going through CSPP verification.

Remember: Microsoft may reinstate the login box at any time! As we do not know why they removed it, there is no guarantee that they won’t bring it back. If you would like to learn more about the CSPP, such as how it can help you troubleshoot WOPI API, please check out our blog or contact us today.

Nick McKenna
Since 2004, Nick McKenna, BSc, MBCS Biography has been the CEO of McKenna Consultants. McKenna Consultants is a bespoke software development based in North Yorkshire, specialising in Cloud development, mobile App development, progressive web App development, systems integration and the Internet of Things development. Nick also holds a First Class Degree in Computer Science (BSc) and wrote his first computer program at the age of nine, on a BBC Micro Model B computer. For the last 21 years, Nick has been a professional computer programmer and software architecture. Nick’s technical expertise includes; Net Core, C#, Microsoft Azure, Asp.Net, RESTful web services, eProcurement, Swift, iOS mobile development, Java, Android mobile development, C++, Internet Of Things and more. In addition, Nick is experienced in Agile coaching, training and consultancy, applying modern Agile management techniques to marketing and running McKenna Consultants, as well as the development of software for clients. Nick is a Certified Enterprise Coach (Scrum Alliance), SAFe Program Consultant (SAI), Certified LeSS Practitioner (LeSS) and Certified Scrum@Scale Practitioner. Outside the office, Nick is a professional scuba diver and he holds the rank of Black Belt 5th Dan in Karate.