CSPP WOPI Login Update

Last year, Microsoft announced that they were removing the login box from the “business flow” for Cloud Storage Partner Program (CSPP) WOPI. Over the course of a few weeks, the login box slowly disappeared from all the test and production WOPI nodes, and now it is nowhere to be seen!

What Was The Login Box For?

The login box existed to confirm that business users of the WOPI editor had a valid Microsoft 365 business license when editing Microsoft Office documents. This is a requirement of the CSPP. Users would typically only see the login box once as long as you implemented the UserInfo mechanism in your WOPI API.

Why Did Microsoft Remove The Login Box?

It’s a bit of a mystery! No specific explanation was given. It’s just gone!

Does This Mean That We Don’t Need To Implement The Business Flow Anymore?

No, Microsoft were clear that you MUST still implement the business flow. As far as we can tell, they are no longer independently verifying the existence of a Microsoft365 account, but your business users are still required to have such an account.

Strangely, the documentation still refers to a “subscription check”, although this could be out of date documentation rather than a statement of what is currently happening. However, you should still implement the business flow, as Microsoft may decide to reinstate the login box in future.

UserInfo

The lack of a login box also calls into question the use of the UserInfo feature of WOPI. This feature specifically exists to reduce the number of times that a user is asked to login. As the user is never asked to login, does it still server a useful purpose?

As far as we can tell, no, it is now redundant. However, we still recommend implementing it as it is still part of the WOPI specification (albeit optional) and it is very simple and quick to implement. This also protects you should Microsoft decide to reinstate the login box.

The Homepage Setting

The final consideration here is the “homepage” setting. The homepage documentation outlines only one scenario where this setting is used: when redirecting a user back to your application after a failed Microsoft 365 subscription check. As it does not appear that this check is being carried out, we don’t believe that your users will ever have a way to see this page.

However, this homepage setting is still a requirement for CSPP WOPI and so you must still provide this homepage URL when going through CSPP verification.

Remember: Microsoft may reinstate the login box at any time! As we do not know why they removed it, there is no guarantee that they won’t bring it back. If you would like to learn more about the CSPP, such as how it can help you troubleshoot WOPI API, please check out our blog or contact us today.