Does Your Product Qualify for the Cloud Storage Partner Program? CSPP Eligibility, Licensing and Support Explained

The Microsoft 365 Cloud Storage Partner Program (CSPP) is how a software vendor puts the real Word, Excel and PowerPoint for the web inside its own product, editing files held in its own storage, through the WOPI protocol. For the right product it is the best integration Microsoft offers. For the wrong product it is a long application that ends in a refusal, or an approval whose terms the business cannot live with.

The questions that decide a CSPP project are not about WOPI endpoints. They come before any code is written. Do we qualify? Who needs a licence? What support do we get? Can we promise our customers data residency? This article answers them from Microsoft’s current CSPP programme pages, all checked on 9 October 2026 and listed at the end. Where we offer our own reading of what the rules mean in practice, we say so.

It is written for product owners, CTOs and architects at software vendors who are deciding whether to apply, and it sets out the Cloud Storage Partner Program requirements as a checklist you can work through before you contact Microsoft.

The Qualification Checklist

If you can answer “yes” to all eight questions, CSPP is worth pursuing. A single “no” usually means you should look at the alternatives at the end of this article.

The rest of this article explains each question, what Microsoft actually says, and what it means for your architecture and your commercial model.

1. CSPP Is for Storage Vendors, Not Customers

Microsoft’s overview is direct: “The Microsoft 365 - Cloud Storage Partner Program is for independent software vendors whose business is cloud storage. It’s not open to Microsoft 365 customers directly.”

It is easy for an enterprise that wants Office for the web inside an internal line-of-business application to assume CSPP is the way to get it. It is not. CSPP is a partner programme for software vendors whose product includes cloud file storage. An organisation building something for its own people should be looking at Microsoft 365 itself or at SharePoint Embedded, both covered below.

2. SaaS, Your Domains, Your Identity

The overview describes an eligible cloud storage provider as one that “Makes their solution available as a Software as a Service (SaaS)”, “Owns the WOPI host domain URLs” and “Manages identity controls for access to the solution.”

The domain criterion has a practical consequence. Your WOPI host domains form part of the configuration Microsoft holds for your integration. Our reading is that a product that serves each customer from that customer’s own domain will struggle to meet it.

3. Storage You Own or Lease

This is the criterion that rules out the most products. The overview requires a partner that:

“stores all end users’ files at rest in a cloud location entirely owned or leased by the partner (including under a subscription or similar arrangement with a third-party cloud infrastructure provider) and not in any location owned, leased, or subscribed to by the partner’s customers.”

The parenthesis matters: running your storage in your own subscription with a public cloud provider counts as leasing. Two architectural patterns are worth testing against that sentence.

Partner-hosted multi-tenant SaaS. Your service writes every customer’s files into storage accounts in your own cloud subscription. This is the pattern the criterion describes.

Customer-supplied storage. Each customer connects your product to its own storage: its own cloud storage account, its own bucket, its own document repository. Our reading is that this does not meet the criterion as written, because the files sit “in a location… subscribed to by the partner’s customers”. If your product supports both models, expect the question of which deployments would be covered to be part of Microsoft’s review.

If your architecture is moving towards customer-supplied storage, perhaps because enterprise buyers increasingly ask for it, factor that into the decision. A CSPP integration is tied to a storage model.

4. More Than One External Customer

The overview requires that the partner “Serves more than one external customer.” A product built for a single client, or a platform used only inside one corporate group, does not qualify, however good the WOPI host is.

5. Individual Review, and Weeks Per Change

Microsoft describes its criteria as “a baseline for participation” and states that “Every application is individually reviewed for suitability by the CSPP team.” Meeting the written criteria is necessary, but it does not guarantee acceptance.

The scope of the integration is not yours to choose either. Participants “must support upload, download, viewing, and editing in Microsoft Word, Excel and PowerPoint for the web even if the published partner solution will only show a subset of these applications and/or functions to the end-user.” A product that only needs Word still has to build and test the full set.

The programme is still open: Microsoft’s application page describes how to “start the CSPP application process”. It sets out the route from application to production:

1. Apply; “CSPP program managers review your CSPP application for program eligibility”.
2. If approved, agree to the Program Terms.
3. Receive a welcome email asking for your test environment configuration, after which the CSPP team provisions your test environment.
4. Develop against the test environment.
5. Submit your solution for validation by the CSPP team, including against Microsoft’s branding guidelines.
6. Provide your production environment configuration, and be added to the Microsoft 365 for the web production domain allow-list.
7. Go live.

The figure that most affects your project plan is on the same page. The environment configuration changes, for the test environment and for the production allow-list, “typically take 4-5 weeks each and is not something that can be expedited.” In our view, every environment change in your rollout plan, such as a new domain or a move from test to production, should be treated as a dependency with a lead time measured in weeks, not days. Plan the sequence of changes early. Batch them where you can. Do not put a customer launch date immediately after a configuration request.

6. Who Needs a Licence

CSPP gives your users Microsoft’s editors, and Microsoft licenses the people who edit. The overview states:

“Any user who will edit files using a Microsoft 365 app must have a valid Microsoft 365 license.”

The business scenario page adds two important details:

• “Licenses are not required for read-only file operations.” Viewing does not need a licence.
• “Required service plans for CSPP are SHAREPOINTWAC… or equivalent.” This is the service plan to check for in your business users’ Microsoft 365 subscriptions.

The checking is your job. The overview states that “CSPP partners are responsible for ensuring all of their users have the appropriate license and that business users in particular are programatically checked”. For business users, the business scenario page requires you to “implement the Business User Flow”, which includes passing BUSINESS_USER in the action URL and setting LicenseCheckForEditIsEnabled to true. A licence check is therefore a feature of your product, not something Microsoft does for you, and it belongs in your design from the start.

Our reading of what this means commercially:

• The licence requirement attaches to the people who edit. Editing works only for users who hold a qualifying Microsoft 365 licence. For a product sold to Microsoft 365 organisations, that is rarely a problem. For a product with external collaborators, clients or the public among its users, it shapes the experience: some users will be able to edit and others only view.
• Design the unlicensed path deliberately. Read-only viewing plus a clear “download to edit” route is better than an error at the moment someone clicks Edit.
• Licensing is part of your sales conversation. Your customers’ IT teams will ask. Have the answer ready.

7. Best-Effort Support, No SLA

Microsoft’s CSPP support page sets clear expectations:

“CSPP support is provided at no additional cost to CSPP partners. CSPP Support operates on a best-effort basis. It’s important to know that there are no Service Level Agreements (SLA) for CSPP support.”

It also explains why: “CSPP is a partner program rather than a Microsoft product or service. It is not covered by standard Microsoft support offerings such as Microsoft Unified or Premier support.” An enterprise Microsoft support contract does not change the position for your CSPP integration.

This is not a reason to avoid CSPP, but it is a reason to design for it. Our recommendations for a CSPP operating model:

• Own your observability. Instrument every WOPI operation your host serves: CheckFileInfo, GetFile, PutFile, Lock and the rest. Measure latency and error rates per operation, so that when something goes wrong you can tell immediately whether the fault is on your side.
• Fail gracefully. If the Office for the web session cannot load, users should still be able to view or download the file. A document product should not become unusable because one integration is degraded.
• Write the customer-facing support boundary down. Your customers’ contracts are with you. Decide in advance what you commit to for the editing experience when the remedy depends on a vendor with no SLA.

8. Data Residency and Government Cloud

Two lines in the CSPP Program Terms matter for regulated and public-sector customers.

First, the terms state that, “unless stated otherwise in the Program Documentation”, the Microsoft 365 Technology “is not intended to support or maintain limits in the presence or storage of End User data files to only servers located in particular geographic locations or to sovereign cloud facilities” when it is “used to view and edit documents stored in a storage solution that is not provided by Microsoft”. The terms add that a storage solution “is not ‘provided by Microsoft’ merely because it runs on Microsoft Azure.” You control where files are stored at rest, because the storage is yours. Our reading of that line is that Microsoft makes no commitment about where files are processed during an editing session when they come from partner storage. If your customers’ contracts contain strict data-location clauses, have your legal team read that line before you sign anything.

Second, the terms state that CSPP “does not support Microsoft’s Government Community Cloud (GCC) environment, and is not intended to be used by end customers who need to comply with FedRAMP, export control, IRS 1075 or CJIS obligations”. If your target market includes US public-sector customers on GCC, or customers with those compliance obligations, the standard CSPP integration will not serve them. Microsoft lists “Access to Microsoft FedRAMP environments from similarly compliant partner’s environments” as a benefit of CSPP Plus, which it describes as “a paid-program tier”; it also states that “entry to this program tier is extremely selective”. If FedRAMP matters to your market, raise it with Microsoft before you apply.

The Engineering Obligations Behind the Programme

Qualifying is the business half. The engineering half is building a WOPI host that passes Microsoft’s validation and behaves correctly in production. We have covered the protocol in depth elsewhere, including proof key validation and zero-trust design, real-time co-authoring and troubleshooting the WOPI API.

One requirement in Microsoft’s current host page documentation is worth calling out because it affects hosts that already work. The documentation states that “you must explicitly grant clipboard permissions (clipboard-read and clipboard-write) to the iframe” that hosts Office for the web:

<iframe ... allow="clipboard-read 'src'; clipboard-write 'src'"></iframe>

Microsoft warns that “If you omit these permissions, rich paste scenarios may silently fall back to html or plain text or fail.” If your host page predates that guidance, check the iframe’s permissions before your users notice.

If You Qualify: What CSPP Gives You

For an eligible storage vendor, CSPP delivers something no alternative does. Users get the real Office for the web, embedded in your product, editing files that never leave your storage at rest, with co-authoring and the fidelity your customers expect from Word, Excel and PowerPoint.

We have built WOPI integrations of this kind for clients including Corcentric, whose contract lifecycle platform runs a Laravel PHP WOPI implementation in a clustered cloud environment, and Workiro, whose users open, edit and save Office documents without leaving the platform. For Kendox, we delivered the WOPI architecture and integration aligned with CSPP’s technical and security requirements. For CappKind, we co-sourced the WOPI implementation with the in-house team, and Microsoft approved it on the first submission.

If You Do Not Qualify: SharePoint Embedded and Other Routes

Failing the checklist does not mean giving up on Office editing in your product. It usually means a different architecture.

A note on framing first. Microsoft does not describe SharePoint Embedded as CSPP’s successor, and CSPP still accepts applications. The comparison below is ours. Our reading of the market is that SharePoint Embedded has become the more natural starting point for vendors whose product is not a storage business. That is our view, not Microsoft’s positioning.

Microsoft also presents SharePoint Embedded as a way out of running a WOPI host at all: “If you already integrate Office through a… (WOPI) host, you can keep files in SharePoint Embedded and move to the built-in Office launch patterns instead of maintaining your own host.” For a vendor whose storage model is changing, that may be the more strategic move. We have written a decision framework for SharePoint Embedded versus WOPI and a playbook for migrating from a custom WOPI host to SharePoint Embedded.

A third route suits products that need Word editing with documents kept entirely in their own infrastructure, and that do not need Excel or PowerPoint: a self-hosted DOCX editor such as SuperDoc. It is not Microsoft’s editor, so the trade-offs are different. We compared it with CSPP in How Does SuperDoc v2 Compare to CSPP WOPI?

Our View: When to Choose Which

This is our recommendation, based on the criteria above.

• Choose CSPP if you are a storage business, you meet the storage-ownership criterion, your users are mostly in Microsoft 365 organisations, and the in-product embedded experience matters to you.
• Choose SharePoint Embedded if documents are a feature of your product rather than your business, if your customers want files kept in their own Microsoft 365 tenant, if your users lack Microsoft 365 licences, if you are building for your own organisation, or if you would rather not run a WOPI host.
• Look at a self-hosted editor if documents must never leave your infrastructure, you only need Word documents, and you are prepared to run the editing and collaboration stack yourself.

How McKenna Consultants Can Help

McKenna Consultants is a UK WOPI integration consultancy that has implemented WOPI hosts across several technology stacks, including PHP for Corcentric, and has supported clients through Microsoft’s verification process. We also build on SharePoint Embedded, so our advice is not tied to one architecture.

We can run a qualification review of your product against the CSPP criteria before you apply, plan the configuration lead times into your delivery schedule, build or harden your WOPI host, or design the SharePoint Embedded alternative if CSPP is not the right fit. Read more about our CSPP and WOPI services or contact us to talk it through.

Sources

All sources checked on 9 October 2026.

• Microsoft Learn — CSPP integration overview: not open to Microsoft 365 customers directly; storage owned or leased by the partner; more than one external customer; individual review; editors need a Microsoft 365 licence; multiuser authoring in Office for the web.
• Microsoft Learn — Apply for the CSPP program: the application process; configuration changes “typically take 4-5 weeks each”.
• Microsoft Learn — CSPP support: no additional cost; best-effort support, no SLA; not covered by Unified or Premier support.
• Microsoft Learn — CSPP business user scenario: no licence for read-only operations; SHAREPOINTWAC service plan or equivalent.
• Microsoft Learn — CSPP Program Terms: data-location commitments for third-party storage; GCC not supported.
• Microsoft Learn — CSPP Plus overview: paid, “extremely selective” tier; access to FedRAMP environments; co-authoring in Office for the web, desktop and mobile.
• Microsoft Learn — Building a host page: clipboard permissions for the Office iframe.
• Microsoft Learn — SharePoint Embedded overview: API-only; Azure pay-as-you-go billing; available in GCC; not yet available in GCC High or DoD.
• Microsoft Learn — Choose a billing model: standard billing to the tenant that owns or develops the application; pass-through billing to the customer’s tenant.
• Microsoft Learn — When to choose SharePoint Embedded: no per-seat licence for end users; files kept in the customer’s own Microsoft 365 tenant.
• Microsoft Learn — Use Office collaboration instead of building it: co-authoring; Office for the web not iframeable; moving from a WOPI host.