►
From YouTube: Office Add-ins community call – July 2022
Description
This month's community call topics include Updates on Word (JavaScript API online-only GA features, Fields API preview, and 6-month roadmap), updates on Outlook Add-ins (REST decommission, Shared Folders support, and pre-beta look at Item Multi-Select capability), updates on SSO sample (SSO NodeJS sample token handling has been updated – learn what and why). As well our Community Spotlight – shines on Maarten van Stam - MVP Office Add-ins, Community Panels – product focused Add-ins discussion and feedback and Q&A – at end of call and in chat throughout call. The call was hosted by David Chesnut (Microsoft) | @davidchesnut. Recorded July 13, 2022.
Stay connected
• See the full blog post for this call in the Microsoft 365 platform community blog - https://aka.ms/m365pnp/blog
• Twitter - https://twitter.com/microsoft365dev
• Microsoft 365 Platform Community in YouTube - https://aka.ms/m365/videos
• Link to all Microsoft Developer Community calls - https://aka.ms/M365DevCalls
• Submit questions for next community call - https://aka.ms/officeaddinsform
• Next community call – August 10th at 08:00am PT - https://aka.ms/officeaddinscommunitycall
A
B
And
welcome
to
the
Microsoft
Office
add-ins
Community
call.
My
name
is
David
Chestnut
and
I'll.
Be
your
host
for
this
call.
Let's
take
a
look
at
the
agenda
for
today.
I've
got
a
lot
to
get
through
joining
us
today
are
Yoon.
Wang
is
joining
to
share
some
updates
around
the
word
apis
and
Juan
balmari
and
Victoria
iannari
are
joining
and
they'll
be
talking
about
some
Outlook
add-ins
updates
around
the
rest,
API
decommission,
shared
folder
support
and
item
multi-select
and
finally,
I'll
be
sharing
some
updates
that
we're
doing
to
the
SSO
samples.
B
So
as
we
go
along,
if
you
have
any
questions,
just
type
them
into
the
chat
and
we'll
answer
those
as
we
go
along.
If
there's
any
questions
we're
unable
to
get
to
today,
we
post
a
blog
summary
of
the
call
about
a
week
out
from
today,
and
we
post
all
the
questions
and
answers
in
that
blog.
Also,
this
call
is
being
recorded.
It
will
be
available
on
the
YouTube
Microsoft
365
Community
Channel
about
24
hours.
B
C
C
The
apis
in
this
set
are
production
apis,
so
that
you're
released
add-in
can
directly
take
advantage
of
them,
even
though
your
add-ins
users
may
be
mostly
desktop
users,
you
still
can
take
this
chance
to
release
a
version
or
take
advantage
of
some
of
the
web
capabilities
for
your
released
addings.
This
is
not
saying
that
all
the
future
features
or
functions
will
go
into
this
set.
First,
we
just
selectively
choose
which
apis
will
go
into
the
set
and
finally,
in
the
end,
sometimes
in
the
future.
All
the
apis
will
go
to
the
multi-platform.
C
We
have
footnote
and
no
support.
We
have
comments.
We
have
track
changes
in
back
to
February.
We
had
a
introduction
for
the
comments
and
track
changes
as
preview
version,
but
in
the
ga
version
in
this
only
set
we
added
more
capabilities
for
comments
and
also
we
add
the
support
for
footnote
and
and
notes
for
support.
C
C
C
I
can
tell
you
that
we
will
have
more
frequent
Cadence
of
delivery
word
apis
in
the
coming
months
or
years,
and
the
most
recent
one
or
the
next
one
will
probably
come
in
six
months
by
the
end
of
this
year
or
earlier
next
year.
So
in
that
set,
we
will
have
like
track
changes.
Comments
Etc
on
those
features
to
be
included,
but
these
are
just
the
candidates
right,
so
we
always
can.
B
D
Yeah
I
am
sharing
my
screen
now
so
hello,
everyone.
This
is
Juan
balmori
here
I
am
with
Victoria
yanori
and
we
are
actually
going
to
talk
about
three
topics
today.
I
will
talk
a
little
bit
about
the
rest.
Commission
update
I
also
want
to
talk
about
support
for
shared
folders
in
exchange,
on-prem
and
then
finally,
we're
going
to
share
some
new
feature
that
we
are
about
to
ship
to
Beta
item
multi-selects.
D
So
let's
get
started
so
I
want
to
talk
first
about
the
rest
commission,
where
we
are,
as
you
know,
just
to
set
up
some
context.
Hopefully,
if
you're
an
auto
Garden
developer
back
in
February
or
and
even
earlier,
we've
been
sharing
that
you
know
the
the
Outlook
rest
V2
endpoint,
it's
going
to
get
decommissioned
in
November
30th
this
year.
D
Basically,
these
are
this:
is
the
inventory
of
apis
impacted
and
the
potential
input.
You
know
what
what's
going
to
happen
at
some
point
when
it
slows
down
right
what
I
shared.
Basically,
these
are
basically
all
the
apis
that
are
related
to
rest
operations.
What
I
shared
last
time
is
that
you
know
that
we
we
were
able
to
Grant
exceptions,
so
the
idea
here
is
that
we
don't
have
a
good
replacement
story
for
rest
using
the
idea.
D
However,
it
does
not
until
we
shipped
our
single
sign-on
capability,
that
you
know
this
is
kind
of
a
suitable
replacement
in
terms
of
the
experience
that
you
can
have,
because
you
don't
have
to
put
any
dialogues
to
the
user
and
so
on
and
so
forth.
So,
basically,
the
idea
here
is
that
all
add-ins
that
are
using
rest
apis
before
that
the
commission
dates
are
going
to
be
granted
an
exception.
You
know
to
keep
using
the
rest
API
until
2019
goes
out
of
Mainline
support
of
extended
support,
which
is
October
14
2025..
D
So
that's
the
deal
that
we
are
working
on
and
that
we
are
executing
on
on
there's
a
plan
of
record
right
now.
So
our
idea,
then
the
second
idea
is
that
add-ins
that
were
created
after
that
the
commission
date
will
not
be
able
to
use
the
rest
service
after
November,
2022
and
I'm
here
having
a
star
and
a
story
study
saying
that
this
might
change.
No,
so
we
are
we're
having
a
few
discussions
with
some
of
you
actually
about.
You
know
some
challenges
that
you
guys
are
facing
around
moving
to
graph.
D
So
there's
I
don't
want
to
over
promise
here,
but
there
are
a
few
discussions
that
maybe
we
will
allow
all
add-ins,
even
after
the
commission
date,
but
with
that,
but
that,
what's
still
going
to
be
true,
is
that
after
2019,
you
know
it's
going
to
go
out.
Evidently
what
I
want
to
do
is
to
buy
some
more
time
for
you
guys
so
that
you
can
actually
have.
You
know,
move
you
around
into
to
to
use
the
graph
API,
but
you
do
it
in
a
way
that
you
don't
lose.
D
You
know
you
don't
pay
in
the
experience.
No,
basically,
what
we
are
doing
right
now
is
that
we
are
collected
the
way
that
we
are
gonna
do
this.
However,
we
are
planning
to
to
identify
those
islands
is
by
getting
the
IDS,
so
we
basically
are
working
on
trying
to
get
the
traffic
and
try
to
identify.
You
know
that
you
know
arrest
call
is
coming
from
an
add-in.
You
know
to
enforce
this
potential
policy.
D
You
know
and
that's
why,
a
few
months
ago,
I
actually
shared
a
link
here,
nkms.rescheck
that
you
can
actually
submit
your
add-in,
your
add-in
IDs.
You
know
the
ID
that
I'm
talking
about
here
is
the
adding
ID
that
is
in
the
Manifest
and
I
have
seen
a
few
of
you
sending
it
to
be
honest.
I
was
expecting
more
volume
here,
but
I
haven't
received
that
much
requests.
D
I
have
approached
some
of
some
of
you
regarding
this
evidently
I'm
planning
to
send
an
email
to
everybody,
not
just
to
make
sure
that
you
are
aware
that
we
received
your
your
ID,
but
if
you
have
an
add-in
that
is
using
the
rest,
API
and
Outlook
and
industries
in
the
rest,
API,
please
go
here
and
and
set
it
up
that
we
are
aware
of
it.
So
that's
where
we
are
right
now.
I
also
want
to
share
a
few
issues
that
I
have
seen
from
some
of
you
have
been
reporting.
D
You
know
a
few
situations
that
are
not
ideal
like,
for
example,
in
some
cases,
the
rest
API
is
faster
than
the
graph
API,
specifically
on
loading
attachments.
I.
Think
some
of
you
found
that
you
know
the
graph
API
is
very,
very
slow
compared
to
the
rest,
API
now
graph
API
is
aware
of
all
these
potential
issues
and
they're
working
to
to
make
it
better
they're
they're
solving
these
problems
as
a
P1.
D
My
goal
about
sharing
these
issues
with
you
is
that,
if
you're
experiencing
similar
conditions
or
if
you're,
seeing
that
the
performance
is
not
the
same
anything
that
it's
kind
of
you
know
impacting
the
experience
of
your
audience,
please
please,
please
make
sure
to
approach
you.
My
email
is
here.
Send
me
an
email,
I
want
to
hear
about
it
and,
and
they
want
to
work
with
the
graph
team
in
order
to
solve
those
issues
right.
D
So
if
you
have
any
issues
with
a
graph,
please
let
me
know
the
other
thing
here
is
that
in
terms
of
capability,
so
in
terms
of
the
API
I
haven't
heard
so
far
so
far,
any
rest
API
that
doesn't
have
an
equivalent
in
the
graph,
so
functional
wise
I
think
we
should
be.
You
know
we
should
be.
We
are
actually
so
far.
I
haven't
heard
anything
against
that.
D
So
I
think
that
functionality,
wise
I,
think
we
should
be
okay,
but
we
could
have
performance
issues
and
obviously
that's
also
an
issue
because
that
impacted
the
experience
of
the
add-ins,
so
network
is
authentication.
You
know,
authentication
and
David
is
going
to
talk
a
little
bit
about
this
more
later,
but
we
have
found
that
our
the
pattern
that
we
are
you
know
suggesting
you
guys
to
to
be
following
for
authentication-
is
to
have
like
a
middle
kind
of
a
middle
tier
to
be
routing.
D
The
graph
calls
you
know,
and
this
evidently
is
also
doing
some
performance
issues
this
you
need
to
do
if
you're
authenticating
with
SSO,
as
you
will
see
later,
that
the
performance
Is
Not
Great.
The
team
is
also
working
in
in
improving
this
significantly,
but
we're
expecting
this
to
be
available
later
in
the
year.
So
that
is
another
factor
that
that
is
causing
us
to
to
think
and
about.
You
know:
expanding
a
little
bit
the
exceptions
that
we
are
going
to
Grant.
You
know
I
think
we
need.
We
need
a
bit
more
time.
D
I
haven't
had
the
last
word
again
here,
but
this
is
I
mean.
Do
you
have
problems
like,
for
example,
mobile?
You
have
another
new
mobile,
that's
not
supporting
single
Mobile
today
doesn't
support
single
sign-on,
so
you
will
require
to
do
a
m
cell
or
an
auth.
Redirect
float
support,
graph
calls,
which
is
not
not
an
ideal
experience
right
compared
to
what
you
can
do
with
rest,
so
bottom
line.
So
this
is
in
track.
We
are
getting
requests
we're
getting
issues
from
from
some
of
you.
D
The
call
to
action
here
is,
if
you
are
experiencing
anything
that
is
preventing
your
great
experience.
Please,
please
contact
us
we're
here
to
help
I
will
pause
a
little
bit
because
I
I
see
a
few
interesting
about
at
least
one
interesting
question
about
the
JavaScript
API
method
of
generating
a
graph
API
token
by
Ryan
Ryan,
yes,
I
I
have
been.
This
is
not
that
simple
to
do.
D
It
was
our
original
goal
to
have
an
API
like
this
I
think
the
health
Team,
our
authentication
PM,
is
working
very
closely
with
the
identity
team
and
we're
gonna
have
they're
working
on
a
on
a
new
new
way
of
authenticating
and
and
doing
the
authentication
on
the
single
sign-on.
In
a
way
that
it's
more
similar
to
what
we
have
today,
but
we
you
will
still
require
to
do
that.
D
D
Second,
topic
is
sharefolder,
so
many
of
you
have
been
asking
me
about.
You
know:
shareholder
support
shareholders
by
the
way
something
sharefolder
support
is
something
that
we
shipped
a
couple
of
years
ago,
actually
or
three
years
ago,
but
the
problem
is
that
it
was
only
working
in
exchange
online.
It
was
not
working
in
exchange
on-prem.
D
So
just
for
context,
your
folders
is
this
ability
that
you
can
actually
in
the
Manifest.
As
you
can
see
in
this
picture,
you
can
add
support
your
folder
flag
to
your
to
your
audience
and
basically,
what
this
means
is
that
anyone
who
has
another
installed
and
has
access
to
either
a
shared
folder
it
meaning
that
it's
a
delegate
or
someone
delegated
access
access
to
to
my
calendar
or
to
my
inbox.
You
know
the
add-in
is
going
to
be
available.
It's
going
to
be
kind
of
visible
for
that
user.
D
It
is
also
true
in
preview
right
now
for
shared
mailbox
scenario,
so
this
flag
only
enables
the
evidence
again
in
exchange
online,
but
we
have
received
a
lot
of
feedback
from
you
that
it
will
be
very
good
to
have
it
also
in
on-prem.
So
basically,
that's
what
we're
doing
so.
This
isn't
better
right
now,
if
you
install
the
latest
beta-
and
that
is
available,
which
is
the
build
that
you
see
in
the
screen
right,
there
you'll
be
able
to
enable
shared
folders
in
exchange
on
brand
right.
D
So
the
call
to
action
here
is:
please
go
ahead
and
install
it.
Try
it
in
exchange
2016-2019
should
work,
and
if
you
have
any
issue,
you
see
that
this
is
not
working.
As
you
expect.
Please
go
and
open
an
issue
here
in
our
issues
here
now.
Obviously
you
know
in
100,
on-prem
environments
we'll
have
the
rest
apis
available,
so
shared
folders
has
the
share.
Folder
feature
has
some
rest
API
support
for
getting.
You
know
the
information
about
the
owner
of
that
folder
and
making
making
calls
on
behalf
of
that
user.
D
So
evidently
that's
not
going
to
work
because
100
on-prem
doesn't
have
rest
apis,
but
if
you're
in
a
hybrid
environment,
meaning
you
have
kind
of
a
mixture
of
on-prem
and
cloud,
and
that
should
work.
So,
let's
check
it
out-
and
this
is
your
feedback-
help
us
ship,
something
that
is
going
to
be
useful
for
you
right,
okay,
graph
compatible
term,
but
there
are
a
bunch
of
questions
here
for
events
and
stuff
graph
compatible
tokens.
I'm
gonna
find
passing
a
little
bit
to
see
if
there
are
any
relevant
questions
here.
D
Public
folders
are
basically
shared,
mailboxes
folders
Gary
is
asking
about
share
mailboxes
share.
Mailboxes
is
supported
right
now
in
beta
as
well.
In
win32
that
we
are
working
also
to
support
it
in
web
access
and
in
yeah
I'll,
look
for
the
Mac
right
now,
it's
in
preview,
so
this
this
beta
program
should
also
have
support
for
shared
mailboxes
right.
Okay.
D
Moving
on
my
last
object
here
is
around
I
did
multi-select.
So,
basically,
today,
if
you're
having
Outlook
addings,
have
you
know
Affinity
with
just
one
item
they're
providing
you
know
they
can
activate
and
have
associated
with
a
single
item.
If
you
are
selecting
multiple
items
in
the
Explorer
view,
you
know,
add-ins
are
suddenly
disabled
right.
D
For
instance,
you're
going
to
be
able
to
say,
hey
this,
this
command
supports
item
multi-select
and
in
order
to
explain
you
more
detail
how
this
is
going
to
work,
I
invited
Victoria,
you
know
Rick
who's,
who
is
actually
the
developer
of
this
feature
and
she's
doing
her
internship
here
at
Microsoft
with
us
and
she's
working
on
this
so
Victoria.
If
you
want,
you
can
actually
share
your
screen
and
show
us
how
this
will
work.
A
I
think
you
should
be
able
to
see
so
I
just
want
to
start
off
by
demonstrating
the
current
behavior
that
we
have.
This
is
just
a
dummy
mailbox
that
I
have
open
up
and
just
populated
with
some
emails
So.
Currently,
if
I
select
one
email
we
can
see
on
my
upper
ribbon,
everything
is
enabled
and
I
can
perform
all
actions
if
I
go
ahead
and
select
two
emails.
The
current
behavior
is
what
you
just
saw
here
with
Viva
insights,
so
one
email,
it's
enabled
two
or
more,
is
disabled.
A
However,
this
test
add-in
that
I've
implemented
here
has
this
multi-select
feature
enabled
so
in
the
manifest
like
Juan
just
showed.
At
the
Action
level,
there
is
the
element
for
multi-select
and
what
we
can
do
with
this
I'm
just
going
to
show
there's
two
main
parts:
one
is
the
API
and
the
second
is
the
event.
So
right
now,
I
have
this
add-in
opened
and
I'm
going
to
go
ahead
and
select
multiple
emails,
so
I'll
select
three
and
I
can
actually
retrieve
their
information.
So
what's
coming
back
here
is
a
collection
of
item
id
the
subject.
A
The
item
type
so
item
type
is
here,
is
a
message
and
there's
also
item
mode,
because
we
are
in
read
mode.
So
these
are
the
four
pieces
of
information
that
are
being
returned
now
and
later
on.
This
will
be
extended
to
offer
even
more
functionality
and
what
we
can
also
do
is
register
for
an
event.
There's
a
new
event:
that's
created
selection
changed
and
what
this
does?
Let
me
just
clear
screen,
I'll
register.
For
this
event,
whenever
my
multi-selection
changes,
I
get
a
selection
changed
event.
A
D
Oh
I
think
thank
you
very
much.
Victoria
I
think
it's
very
straightforward,
I
think
in
general,
it's
a
very
simple
concept.
You
know,
I
I,
do
something
really
I'm
sad
that
we
were
unable
to
do
it
before
for
you
guys,
but
now
it's
on
the
works
it's
coming,
and
you
know
one
of
the
things
that
we're
gonna
be
doing
in
the
future.
Around
ultimately
select
is
that
we
are
so
right
now
what
we're
we
did
with
an
API
that
Victoria
showed
you.
D
It's
only
giving
you
the
ID
of
the
items
that
are
selected.
So
basically
the
idea
is
that,
once
you
have
access
to
the
ideas,
then
you
can
call
services
a
graph,
for
instance,
and
actually
do
additional
operations
on
those
items
like,
for
example,
getting
the
attachments,
and
you
know
whatever
operations
you
need
to
do.
What
we're
planning
to
do
in
subsequent
releases,
so
I
think
we're
right
now
we're
doing
that
kind
of
the
bare
minimum
that
you
guys
need
to
enable
multi-select,
but
in
the
future
we're
going
to
provide
richer
API.
D
D
So
thank
you
very
much
Victoria
for
sharing
sharing
that
demo,
and
hopefully
people
like
it
here
and
again
eventually
in
one
of
these
calls
I
will
I
will
let
you
know
that
this
is
in
beta,
we're
we're
shooting
for
end
of
summer
around
September
this
year
later.
You
know
to
have
a
better
program
for
this,
and
then
you
can
actually
play
with
it
and
give
us
your
feedback
as
always
all
right
and
with
that
I
think
that's
what
I
wanted
to
cover
for
Outlook
today
David.
Thank
you
very
much.
B
Thank
you,
Juan.
Thank
you,
Victoria.
That
was
great
to
see
all
the
new
functionality
and
development
and
stuff
coming
out
for
folks.
It's
very
cool
to
see
all
right
so
moving
along
to
the
next
demo,
which
is
me
so
I'm
going
to
talk
about
some
SSO
sample
updates
that
are
in
progress.
There's
been
some
information.
That's
that's
come
to
our
attention
recently.
B
We
discovered
that
the
node.js
sample
in
particular,
which
I'll
be
talking
about
here,
was
returning
a
middle
tier
token
and
out
of
some
graphics
to
kind
of
explain,
split
more,
but
it
was
returning
a
military
token
back
to
the
client,
which
is
not
something
you
should
do.
It's
risky
and
I'll
show
some
more
information
about
that
as
we
go
along.
B
It's
kind
of
explained
more
about
this,
so
we
have
on
the
office
add-ins
repo,
there's
a
few
SSO
samples,
there's
one
for
Outlook,
there's
one
for
office
with
asp.net,
there's
one
for
node.js,
and
it
was
the
one
for
node.js
in
particular.
That
was
doing
this,
the
other
two
weren't
returning
the
token
in
that
way,
although
they
do
treat,
if
they
go
to
their
fallback
off,
they
do
treat
the
fallback
off
that
same
way,
so
they
are
being
updated
in
the
process
of
that.
B
So
let
me
walk
through
how
things
should
work
and
how
it
does
work
now
with
node.js,
so
when
you're
doing
SSO
with
the
on
behalf
of
flow,
because
your
goal
is
to
call
Microsoft
graph
services,
there's
several
different
players
in
this
flow.
The
black
boxes
on
this
slide
are
showing
the
parts
that
you
would
code.
So
the
task
pane
add-in
is,
you
know
your
JavaScript
and
the
task
and
it
gets
displayed.
B
Then
you
have
a
middle
tier
server,
which
has
rest
apis
that
your
add-in
is
going
to
call
in
the
military
server
will
through
delegated
access
from
the
user.
That
signs
in
is
going
to
call
Microsoft
graph
and
to
make
this
work.
The
office
host
that
you're
in
be
that
Excel,
word,
PowerPoint
or
Outlook
is
involved
as
well,
and
the
Microsoft
identity
platform.
Is
there
because
that's
the
platform,
that's
going
to
create
the
tokens
and
also
handle
authorization
requests,
so
the
way
it
works
is
your
ad
is
going
to
call
get
access.
Token!
B
That's
an
officejs
API
that
the
office
host
exposes
and
then
the
office
host
will
return
to
you
for
the
currently
signed
in
user.
An
access
token-
and
you
know
anytime,
you
get
an
access
token
I.
Think
a
good
question
is
access
to
what
and
in
this
case
it's
an
access
token
to
your
own
middle
tier
server.
So
the
add-in
is
going
to
use
that
to
call
the
military
server
a
rest
API
and
then
the
military
server
is
going
to
call
Microsoft
graph.
B
So
now
it
has
to
do
this
on
behalf
of
flow,
because
that
access
token
only
has
like
user
identity
and
an
access
as
user
scope.
It
has
no
scopes
Microsoft
graph
in
it,
so
it
can't
be
used
to
call
Microsoft
graph,
so
it'll
call
out
to
Microsoft
identity
platform,
your
middle
tier
server.
Does
this
and
say
Hey
I
want
to
exchange
this
for
a
graph
token,
can
you
give
me
the
scopes
for
that
and
you'd
pass
along?
B
Whatever
it
is,
you
need
like
files.read,
for
example,
so
Microsoft
edit
platform
will
do
all
the
proper
checks
make
sure
the
user
is
consented
and
it
creates
a
new
graph
token
that
it
returns
to
your
middle
tier
server.
So
that's
this
token,
that's
sort
of
a
greenish
color,
it's
a
new
one
and
now
I.
Can
the
military
server
can
call
graph,
for
example,
getting
a
list
of
file
names.
B
Microsoft
graph
will
check
that
token
and
then
return.
The
data
I
should
also
point
out
like
every
step,
along
the
way
where
these
tokens
are
passed,
they're
being
validated.
So
your
military
server
so
he's
validating
Microsoft
graph.
It
also
validate
any
token
pass
to
it,
so
it
Returns
the
data
and
your
middleware
server
may
do
some
additional
processing
on
that,
and
then
it
also
returns
data
back
to
the
admin.
B
B
So,
in
this
case
the
add-ins
can
say:
okay,
we're
gonna
have
to
do
fall
back
authentication
because
SSO
isn't
working
so
we'll
open
up
a
dialog
box,
we'll
use
M
cell
Microsoft
authentication
library
to
sign
in
using
the
oauth2
flow,
so
we're
going
to
use
Microsoft
identity
platform
pop
up
a
dialog
box,
get
them
to
sign
in
and
consent,
so
we're
going
to
get
back
an
access
token-
and
this
is
just
like
before
this
is
an
access
token.
That
again
is
for
your
middle
tier
server.
B
It
doesn't
have
any
graph
access
in
it,
so
you're
going
to
call
your
rest
API
and
at
this
point
it's
the
same
flow
as
before
so
middle
to
your
server
is
going
to
do
OBO
flow.
Get
the
graph
token
call
graph
data
comes
back.
Maybe
you
do
some
additional
processing
on
that
data
before
you
return,
whatever
the
Ada
needs,
and
then
one
more
scenario
that
needs
to
be
handled
by
this
or
it
is
handled
in
the
sample
is,
if
your
token
expired.
B
Now
this
could
happen
like
you
get
your
access
token
from
the
office
host
and
it
Returns
the
token
and
say
the
token
was
really
close
to
expiring.
So
this
doesn't
happen
very
often,
but
it
can
so
you
call
the
rest
API
you
pass
that
token
in
military
server
it
goes
to
do
the
OBO
flow,
and
at
this
point
the
token
has
expired
and
so
identity
platforms
is
not
going
to
allow
that.
So
you
get
an
error
back
and
the
way
we
handle
this
flows.
B
We
have
the
military
server
return
that
error
back
to
the
client
so
that
the
client
can
say.
Oh
I
need
a
new
token,
so
you
call
get
access
token
again
at
this
point.
Office
will
see
that
it's
expired.
It's
not
going
to
return
an
expired
token,
so
it'll
it'll
refresh
it
behind
the
scenes.
It'll
actually
request
this
from
the
identity
platform.
It
gets
the
updated
token
which
is
sort
of
this
bluish
color,
and
it
returns
that
token
and
again
it's
just
an
access
token
to
your
middle
tier
server
and
you
call
the
rest.
B
Api
and
the
whole
OBO
flow
continues
again.
So
so
that's
what
the
sample
needs
to
handle
and
the
thing
that
we
changed
is
in
this
OBO
flow.
This
sample
was
returning
that
token
to
the
client
at
least
on
node.js,
and
which
is
not
something
you
want
to
do
so.
Let
me
share
my
desktop
and
just
kind
of
walk
through
some
of
the
code.
B
Let's
see,
let's
go
to
so
there's
a
variety
of
links
that
I'm
gonna
I'll
put
these
into
the
chat.
Well,
probably
right
after
the
presentation
to
see
how
them
so
I
want
to
point
out
the
identity.
Docs
are
your
friend
whenever
you're
doing
working
with
this
stuff,
and
so
there
is
this
link
to
the
Microsoft
identity
platform
on
behalf
of
flow,
and
it
shows
pretty
much
that
same
diagram.
I
was
showing
office
has
an
additional
wrinkle.
B
You
know
that
you
have
a
task
pane
in
the
middle
tier,
but
it's
pretty
much
the
same
flow
and
down
here.
There's
a
warnings
that
talks
about-
and
this
is
I
just
want
to
point
this
out
like
it
says,
don't
send
access
tokens
that
you
get
in
your
middle
tier
anywhere
else
and
there's
a
list
of
things
that
can
go
wrong.
If
you
start
doing
that
and
then
in
the
sample
itself.
B
Let
me
code
here
we
go
all
right,
so
this
is
the
office,
a
node.js
SSO
sample
and
in
the
folder
structure
it's
been
reorganized
a
little
bit.
So
you
have
your
middle
tier
code
down
here
in
the
routes,
so
there's
a
get
files
route
and
your
server
helpers,
which
are
all
to
help
call
Microsoft
graph
apis
and
then
the
client
side
is
here
under
the
javascripts.
B
So
everything
that
works
with
SSO
is
in
these
three
files
from
those
part,
especially
SSO
auth
es6,
there's
also
a
fallback
msel
folder
that
has
whatever
you
have
to
do
fall
back.
This
has
all
the
code
for
doing
msel,
because
it's
sort
of
like
you're
implementing
two
auth
systems,
so
there's
a
full
amcell
implementation
here
and
then
you
also
have
your
SSO
implementation
down
here
and
see
this
in
action.
B
I've
loaded
this
up
here
in
Excel,
and
so
this
office
I
didn't
know
gsso,
you
click
get
OneDrive
file
names
and
what
it
does
it
goes.
It
gets
an
access.
Token
does
the
whole
middle
tier
OBO
flow,
and
then
you
get
back
your
file
names
here
and
they're
printed
into
the
document.
One
thing,
I
think
is
interesting.
That
I
wanted
to
show
is
when
you
get,
that
token
want
to
show
here
like
here's,
where
we're
going
to
call
get
access
token
and
I'm
going
to
step
over
that,
and
then
this
is
the
actual
access
token.
B
B
So
there's
interesting
things
in
here
like
there's
this
audience
value.
This
audience
value
is
set
to
the
ID
of
the
app
registration
I
created
for
my
middle
tier.
So
this
is
how
I
know
this
is
going
to
access
the
middle
tier
and
so
I
go
over.
Sorry
jump
around
a
bit,
but
this
is
my
Azure
app
registration.
If
I
go
up
to
the
overview,
you'll
see
I
have
that
same
ID
here.
B
So
you
can
look
at
any
of
the
claims
in
here
and
you'll.
See
like
this
is
pretty
much
just
a
user
identity
token.
So
it's
got
my
name
for
my
test
tenant
that
I
have
preferred
username,
so
it's
kind
of
like
open,
ID
values.
It
also
has
the
Scopes
which
in
this
case
is
only
xss
users,
so
you
won't
see
anything
you're
having
to
do
with
Microsoft
graph,
which
is
why
you
know
the
token
on
the
middle
tiers
could
be
the
one
that's
going
to
have
an
audience
set
to
a
Microsoft
graph
location.
B
B
One
thing
I
want
to
point
out:
I,
don't
think
in
the
original
sample.
It's
very
easy
to
extend
like.
If
you
want
to
add
more
functions,
it
was
a
little
tricky.
So
the
way
this
works
is
in
the
on
ready.
You
know
we're
going
to
wire
up
the
click
event,
so
somebody
says:
get
10
a
list
of
10
files
for
my
OneDrive.
Then
it's
going
to
call
get
file
name
list,
and
this
is
your
basic
pattern
for
calling
any
rest
API
in
your
middle
two
server
you're
going
to
have
one
function.
B
That
makes
the
call
and
then
another
function
that
handles
the
response
and
the
way
this
is
working.
This
clear
message
is
just
clearing
the
task
pane.
So
it's
not
an
important
part
of
this,
but
you
want
to
create
a
request.
So
in
the
request,
you're
going
to
say,
I
need
to
call
this
particular
API
on
my
server.
This
one
called
get
user
file
names
I'm,
going
to
have
the
name
of
my
response,
Handler,
which
is
this
function
down
here.
B
So
you
want
to
pass
that
for
a
callback
function
and
then
another
callback
function
so
that
when
the
request
is
created,
it'll
pass
it
back
to
you.
You'll
get
this
client
request.
Once
you
have
it,
you
can
go
call
the
web
server.
This
seems
a
little
complicated.
The
main
thing
I
just
want
to
show
here
is
like
say
you
wanted
to
get
calendar
items
from
graph
right.
You
could
create
another
function,
get
calendar
items
and
you
just
do
the
same
pattern,
create
requests
but
just
plug
in
the
rest,
API
in
your
middle
to
server.
B
B
So
that's
how
you
would
extend
this
sample
now
to
show
how
it
works.
Let's
take
a
look
at
the
create
request
and
what
create
request
is
doing
is
basically
creating
this
little
structure.
It's
a
client
request
because
of
all
those
flows,
I
was
just
showing
there's
various
points
at
which
we
might
need
to
pop
up
a
dialogue.
If
we're
doing
fallback,
we
might
need
to
request
a
new
token.
So
we
end
up
looping
around
sometimes
and
I
found.
It
was
just
easier
just
to
create
this
request
to
kind
of
track.
B
What
was
the
original
thing
we're
trying
to
do,
because
there's
there's
like
a
lot
of
sequencing
going
on,
so
this
will
track
our
off
options
for
SSO,
which
we
just
defaulted
true
for
all
these
there's
a
global
variable
for
auth
SSO,
that's
defaults
to
true,
but
it'll
flip
defaults.
If
we
have
to
do
a
fallback
because
we
have
to
track
whether
or
not
which
type
of
authentication
are
we
trying
to
do
with
this
request,
we
track
the
access
token.
B
That's
in
use
the
URL
that
we're
going
to
call
on
our
middle
tier
and
then
the
two
callback
functions,
one
for
when
the
rest
API
is
completed
and
then
the
other
one
which
we'll
call
right
after
we
create
this
request.
So
to
create
the
request
we
check
if
we're
using
auth
SSO.
If
we
are,
then
we're
going
to
go,
get
our
token
and
then
we're
going
to
call
our
callback
function
and
we've
completed.
A
B
This
is
where
it's
going
to
do.
The
actual
get
access,
token
call
to
office,
and
then
it
returns
that
access
token.
If
there's
any
error,
then
we
go,
we
have
a
Handler
for
that.
This
is
actually
was
in
the
sample
from
the
beginning
to
look
at
various
SSO
errors
and
we'll
throw
an
error
back
to
the
collar,
which
indicates
that
they're
gonna
have
to
do
fall
back
and
then
what
was
the
other
piece
of
this?
So.
B
There
is
a
part
in
the
flow
later
where
we
need
to
handle
web
server
errors.
So
this
is,
we
called
our
military
rest
API.
Let
it
returned
an
error
and
I
mentioned:
there's
a
possibility.
It's
like
there's
several.
We
track
this
type.
The
sample
just
does
this
like.
It
creates
a
type,
and
it
says:
okay,
it
could
be
Microsoft
graph
failed.
If
that
happened,
we're
just
going
to
show
the
error
for
Microsoft
graph
there's
a
possibility.
We
didn't
have
access
as
user
for
some
reason
there's
also.
B
Possibly
this
is
the
error
we
get
from
the
identity
platform
if
the
token
expired-
and
in
this
case
we're
going
to
say-
oh
I-
need
to
retry.
This
call
so
we're
tracking
this,
and
we
return
that
back
to
caller
to
go.
Do
a
retry,
Loop
fallouts
fails.
There's
this
Switchback
switch
to
fallback
off,
which
will
set
our
Global
defaults
and
then
create
a
new
request.
That's
using
fallback
instead
of
off
SSO,
so
it
gets
sort
of
I
wish.
It
wasn't
quite
as
complicated
as
this
I've
been
trying
to
simplify
this
and
simplify
it.
B
But
you
know
it's
open
source.
If
folks
have
ideas
and
how
to
simplify
this
further,
please
feel
free
to
contribute
on
the
server
side.
I
want
to
point
out
an
important
thing:
I,
don't
think
this
was
here
originally,
but
so
when
our
military
server
is
called,
you
always
want
to
validate
that
token.
You
don't
want
to
just
accept
any
token
that
gets
passed
to
your
server,
because
it's
a
public
API
endpoint.
B
Then
you
would
do
the
on
behalf
of
flow
and
we
set
up.
You
know
our
graph
URL
that
we're
going
to
call
the
parameters
to
you,
know,
select
the
name
and
just
the
top
10.,
and
then
we
use
our
helper
methods
to
go
get
to
that
graph
data.
And
then
we
check
to
see
what
happened
if
graph
returned
an
error.
This
is
where
we
set
our
our
error
type
to
Microsoft
graph.
B
We
turn
that
back
to
the
client
if
it
worked
we'll
Return
To
Success,
along
with
an
array,
that's
a
list
of
the
file
names
and
we
also
checked
for
the
expired
token
scenario.
So
this
is
where
we
would
set
that
if
all
else
fails
we'll
just
say
it
was
a
known
error.
We
just
pass
along
the
details
and
they
get
surfaced
on
the
task.
Pane.
B
Let
me
go
back
to
the
slides
here
for
just
a
second
okay.
So
a
couple
of
important
security
notes:
I'll
pass
along
one
is
never
cache
tokens
yourself.
It
can
be
risky
to
do
that.
Especially
if
you
have
a
bug,
you
can
inadvertently
end
up
exposing
user
data
or
leaking
a
token,
and
that
could
be
bad.
So
what
you
do
is
you
always
call
get
access.
Token
office
caches
this
for
you
so
anytime.
You
need
to
just
call
get
access
token.
B
You
don't
need
to
try
to
go,
create
your
own
caching
mechanism
and,
if
you're,
using
like
the
on
behalf
of
flow
M
cell,
does
the
same
thing
like
when
you
call
that
on
behalf
of
flow,
if
the
token
was
already
acquired,
mselves
cached
it
for
you,
so
you
don't
have
to
think.
Oh
I
got
my
opio
token
back.
I
need
to
store
that
somewhere
and
save
it.
There's
no
need
to
do
that.
B
You
don't
need
to
well
obviously
never
return
dogs
from
the
middle
tier
back
to
the
client,
so
I
think
we
covered
that
pretty
well,
there's
that
late
to
the
docs
that
explains
more
about
what
the
risk
is
for
that
make
sure
you
always
validate
the
access.
Token.
That's
past
your
list,
apis,
you
might
consider
a
well-known
Client
List
like
if
you
know
there
are
specific
tenants
you
work
with.
You
can
configure
that
in
your
Azure
app
registration.
B
So
that's
something
to
think
about.
Also
the
client
secret,
oh
I,
didn't
show
the
client's
secret.
Your
middle
tier
will
use
a
client
secret
to
call
and
that
should
be
stored
securely,
like
maybe
Azure
key
vault.
If
I
switch
back
yeah.
Let
me
switch
back
real,
quick
I.
Just
want
to
show
where
that
secret
is
there.
Is
this
EnV
file,
that's
in
the
sample
here?
It
is
this
one
and
this
tracks
this
is
for
the
middle
tier.
So
it
has
this
client
secret
and
you
know
for
testing
development
purposes.
This
is
fine.
B
We're
just
saying
like
when
you
deploy,
you
don't
want
to
just
have
it
in
a
file
or
something
you'd
want
to
actually
go
with
the
second
Azure
keyboard,
so
that
was
that
last
slide
see
if
we
have
any
questions,
but
I
am
going
to
kind
of
go
backwards
here.
My
SSO
access
token,
the
audience
is
in
Outlook
includes
the
server
name.
B
Is
that
something
that
Outlook
does
differently
from
other
Office
Products,
as
your
one
had
just
the
ID
yeah
I
think
you
might
see
differences
depending
on
which
office
host
you're
in
behind
the
scenes
office
goes
and
requests
the
token
from
Microsoft
identity
platform
and
I
didn't
show
that
flow,
because
it's
it's
not
something
you
have
to
worry
about
so
office,
never
creates
these
tokens.
They
always
come
from
Microsoft
identity
platform,
so
there
could
be
subtle
differences.
B
I'm,
not
sure
what
you're
saying
there,
because
that
looks
like
the
the
reply,
not
the
reply:
the
there's
a
URI
resource
URI
that
you
have
to
use
which
isn't
the
same
as
the
audience,
so
the
audience
should
always
be
set
to
the
ID
of
your
app
registration.
If
it's
not
the
token
validation
will
fail,
I'm
just
looking
through.
Is
there
other
questions?
B
Okay,
so
I'm
Gonna,
Move
Along
to
the
community
Spotlight
slide
and
once
again
say
thank
you
to
Martin
Von
stone
for
presenting,
on
the
last
call
showing
blazer
with
Excel,
which
is
really
cool.
That's
a
cool
sample
to
have,
and
if
you're
interested
in
also
contributing
and
helping
feel
free
to
do
so.
We
have
there's
a
link
to
the
office
ad
in
samples
repo
there,
as
well
as
there's
a
recognition
program
on
PNP.
We
can
get
your
own
patch
for
helping
contribute
so
feel
free
to
do
that.
B
We
appreciate
all
the
help
we
get
I
want
to
mention
also
that
we
now
have
these
Community
panels
where
you
can
join
and
from
time
to
time
you
might
reach
out
to
folks
who
are
interested
to
do
various
surveys
or
Research
into
specific
areas
about
the
products
and
future
development.
So
if
that's
something
you're
interested
in
in
any
of
these
areas,
please
feel
free
to
go
click
on
a
link
and
sign
up
and
speaking
of
community
panels.
There
is
a
panel
coming
up
now.
B
This
was
a
panel
that
we,
it
was
supposed
to
happen
in
June
and
I,
inadvertently,
sent
out
the
wrong
links,
and
so
the
links
didn't
work
and
so
I
apologize.
If
anyone
tried
to
join
that
call
and
wasn't
able
to
that's
my
bad,
so
I
moved
this
out.
It's
now
two
weeks
from
today
on
July
27th
at
8
A.M
Pacific
time.
What
this
panel
is
is
just
a
discussion
about
the
samples
that
we
have.
B
Those
are
samples
in
the
repo
samples
and
script,
Labs
samples
and
docs,
and
just
doing
some
exploration
into
you
know
what
use
do
you
get
from
them?
Have
you
do
you
have
any
friction
with
trying
to
use
them?
Are
there
areas
we
should
have
samples
for
that?
We
haven't
considered
so
it's
kind
of
a
discussion
in
that
space
to
help
us
plan
for
what
we
want
to
do
the
samples
over
the
next
year.
So
please
feel
free
to
to
join
and
give
us
any
feedback.
B
If
that's
the
case,
then
yes,
but
this
is
only
available
in
Excel
today,
you
can
find
more
information
at
the
there's,
a
link
here
to
our
keyboard,
shortcuts
article.
If
you're
looking
for
keyboard
shortcut
sport
in
word,
then
let
us
know
more
about
that
and
a
feature
request
at
again
same
link,
M365
Dev,
Dash
suggestions,
and
then
this
is
a
question
that
came
in
one
or
two
calls
ago.
It
somehow
slipped
through
the
crack,
so
I
wanted
to
make
sure
I
addressed
it.
B
It
was
a
question
about
get
access
token
for
SSO,
and
it
was
there's
two
parts
to
this.
One
is
clarifying
like
which
name
space
that
folks
would
be
using.
What
do
you
call
get
access
token?
Is
it
office
runtime.authentic,
access,
token
or
office.auth.getaxis
token?
So
the
answer
for
part
one
is:
you
can
use
either
one
behind
the
scenes.
They
end
up
calling
the
same
code.
There
was
just
a
refactoring
that
happened
at
some
point
in
time.
B
I
I
guess
you
could
say,
like
the
official
one
is
office.auth
dot,
get
access
tokens
so
like
we're
going
to
the
docs
and
and
finding
these
and
making
sure
they
all
say:
office.auth
dot
get
access
token,
but
that
doesn't
mean
you
have
to
go
change
your
code.
It
will
work.
Fine.
There
is
a
possibility,
maybe
in
the
future.
If
there's
some
change
made,
it'll
probably
only
happen
on
the
new
namespace,
the
ops.off
namespace,
but
nothing
breaking
is
going
to
happen
and
part.
Two
of
that
was.
B
B
So
next
question
is
there
a
way
for
an
admin
to
install
Excel
add-in
for
the
user
or
group
that
will
show
only
for
some
Excel
files
generated
by
your
application
and
not
when
the
user
creates
new
Excel
files
or
some
other
Excel
files
open
by
the
user?
So
there
isn't
any
way
to
install
an
add-in
based
on
conditions.
I
mean
it's
either
installed
or
it's
not
installed.
There
are
some
things
you
can't
do,
though,
and
this
might
help
as
a
workaround
like
you
can
enable
functionality
in
your
added
based
on
various
conditions.
B
B
You
can
also
show
the
task
pane
or
hide
the
task
pane
based
on
conditions
and
there's
a
link
to
the
article
on
how
to
do
that.
You
can
also
embed
your
edit
into
the
spreadsheet
if
you're,
opening
the
file
from
your
service,
they
open
an
Excel
pattern
and
there's
a
link
there
for
more
information
on
that.
So,
but,
if
you're
looking
for
more
than
that,
go
create
an
idea
request
and,
let's
know
more
about
it.
It
sounds
very
interesting
at
the
M365
Dev
Dash
suggestions
link.
B
D
D
D
B
We
currently
see
this
warning
only
when
we
open
a
task
pane
I
would
have
to
ask
the
the
team
on
that
one
I'm,
not
sure,
and
then
Dane
asked
did
I
read
correctly
on
the
previous
chart,
that
you
can
embed
add-ins
and
Excel
workbook,
which
charts
I'm,
not
sure
which
chart
Dave.
If
you
could,
just
let
me
know
which
chart
you
refer
to
is
that
something
in
the
slide
deck
anyway,
I'm
Gonna,
Move
Along,
since
we're
reaching
oh
the
Q
a
chart
q
a
chart.
B
This
is
back
here
that
you
can
embed
add-ins
and
Excel
workbook.
Oh,
maybe,
is
that
the
opening
Excel
pattern.
Yes,
you
can
embed
add-ins,
there's
so
there's
an
article
here
on
the
open,
Excel
pattern:
I'll
throw
that
link
in
there
that
talks
about
how
you
can
through
open
XML,
basically
there's
a
way
you
can
actually
embed
your
add-in
there's
also
an
open-end
teams.
Example
that
shows
a
different
way
to
do
it,
so
you
might
be
interested
in
that
as
well.
B
Okay,
so
you're
top
of
the
hours
I
just
want
to
get
through
the
in
matter,
slides
here.
So
for
folks,
if
you're
new
to
office
add-ins
there's
a
lot
of
resources
here,
you
can
go
check
out
for
documentation.
Quick
starts,
I,
definitely
recommend
the
AKA
dot,
Ms,
slash
M365
Dev
program,
which
gives
you
a
free
office
tenant
that
you
can
use
for
developing
and
testing.
It's
very
useful.
B
If
you
want
to
engage
with
the
team,
there's
some
links
and
resources
here
for
if
you
have
technical
questions
about
office
add-ins,
you
can
go
to
stackoverflow.com
or
this
AKA
link
to
office.
Dash,
add-ins,
Dev,
Dash
questions
for
product
bugs,
let
us
know
on
our
office.js
repo
and
future
requests
and
ideas,
go
to
aka.ms
M365
devdas
suggestions,
there's
also
additional
Community
calls
besides
this
one.
So
there's
links
here
for
all
these
calls.
B
If
you're
interested
in
any
of
these
areas
go
check,
those
out
you
can
get
all
the
calls
and
assets
at
AKA,
dot,
NS,
slash,
n365pnp
and
finally,
just
a
quick
thanks
to
everybody.
Thanks
for
attending
the
call
the
recording
will
be
available.
24
hours
from
now
on,
the
Microsoft
365
Community
YouTube
channel,
you
can
follow
us
on
Twitter
at
microsoftex
Drive
Dev
at
enthus25.
Pnp
next
call
will
be
August
10th
at
8,
A.M
Pacific
time.
There's
a
few.
You
want
to
see
the
agenda,
there's
a
link
for
the
agenda
at
the
bottom
there.
B
You
can
also
submit
questions
in
advance
at
aka.mslash
office.
Add-Ins
form
so
feel
free
to
use
that
Forum.
If
you
have
any
questions
that
you'd
like
to
see
answered
on
the
next
call
and
with
that
said,
I'll
check,
there's
a
few
more
of
these
on
the
chat
after
the
call
here,
but
thanks
everyone
for
joining,
and
we
will
see
you
on
the
next
column.