Note: This sample uses legacy Office single sign-on (SSO). For a modern authentication experience with support across a wider range of platforms, use the Microsoft Authentication Library (MSAL) with nested app authentication (NAA). For more information, see Enable single sign-on in an Office Add-in with nested app authentication.

This sample implements an Office Add-in that uses the legacy getAccessToken API in Office.js to give the add-in access to Microsoft Graph data. This sample is built on ASP.NET and Microsoft Authentication Library (MSAL) .NET.

Integrating data from online service providers increases the value and adoption of your add-ins. This code sample shows you how to connect your add-in to Microsoft Graph. Use this code sample to:

• See how to use the legacy Office Single Sign-on (SSO) API.
• Access Microsoft Graph on behalf of an Office Add-in.
• Build an add-in using ASP.NET Core, MSAL 4.x for .NET, and Office.js.
• Use the MSAL.NET Library to implement the OAuth 2.0 authorization framework in an add-in.
• Use the OneDrive REST APIs from Microsoft Graph.

• Any platform and Office host combination that supports the IdentityAPI 1.3 requirement set.

To run this code sample, the following are required:

• Visual Studio 2019 or later.
• Office Developer Tools.
• A build of Microsoft 365 that supports the IdentityAPI 1.3 requirement set. You might qualify for a Microsoft 365 E5 developer subscription, which includes a developer sandbox, through the Microsoft 365 Developer Program; for details, see the FAQ. The developer sandbox includes a Microsoft Azure subscription that you can use for app registrations in later steps in this article. If you prefer, you can use a separate Microsoft Azure subscription for app registrations. Get a trial subscription at Microsoft Azure.
• At least a few files and folders stored on OneDrive for Business in your Microsoft 365 subscription.

Follow the instructions at Register an Office Add-in that uses single sign-on (SSO) with the Microsoft identity platform. Use the following values to replace the placeholders in the app registration steps from that article.

1. In the root of this sample folder, open the solution (.sln) file in Visual Studio. Right-click (or select and hold) the top node in Solution Explorer (the Solution node, not either of the project nodes), and then select Set startup projects.

2. Under Common Properties, select Startup Project, and then Multiple startup projects. Ensure that the Action for both projects is set to Start, and that the Office-Add-in-ASPNETCoreWebAPI project is listed first. Close the dialog.

3. In Solution Explorer, choose the Office-Add-in-ASPNET-SSO-manifest project and open the add-in manifest file “Office-Add-in-ASPNET-SSO.xml” and then scroll to the bottom of the file. Just above the end </VersionOverrides> tag, you'll find the following markup.

   <WebApplicationInfo>
       <Id>Enter_client_ID_here</Id>
       <Resource>api://localhost:44355/Enter_client_ID_here</Resource>
       <Scopes>
           <Scope>Files.Read</Scope>
           <Scope>profile</Scope>
           <Scope>openid</Scope>
       </Scopes>
   </WebApplicationInfo>

4. Replace the placeholder "Enter_client_ID_here" in both places in the markup with the Application ID that you copied when you created the Office-Add-in-ASPNET-SSO app registration. This is the same ID you used for the application ID in the appsettings.json file.

   [!NOTE] The <Resource> value is the Application ID URI you set when you registered the add-in. The <Scopes> section is used only to generate a consent dialog box if the add-in is sold through Microsoft Marketplace.

5. Save and close the manifest file.

6. In Solution Explorer, choose the Office-Add-in-ASPNET-SSO-web project and open the appsettings.json file.

7. Replace the placeholder Enter_client_id_here with the Application (client) ID value you saved previously.

8. Replace the placeholder Enter_client_secret_here with the client secret value you saved previously.

   [!NOTE] You must also change the TenantId to support single-tenant if you configured your app registration for single-tenant. Replace the Common value with the Application (client) ID for single-tenant support.

9. Save and close the appsettings.json file.

1. In Visual Studio, on the Build menu, select Clean Solution. When it finishes, open the Build menu again and select Build Solution.

2. In Solution Explorer, select the Office-Add-in-ASPNET-SSO-manifest project node.

3. In the Properties pane, open the Start Document drop down and choose one of the three options (Excel, Word, or PowerPoint).

   :::image type="content" source="../images/select-host.png" alt-text="Choose the desired Office client application: Excel, PowerPoint, or Word.":::

4. Press F5. Or select Debug > Start Debugging.

5. In the Office application, select the Show Add-in in the SSO ASP.NET group to open the task pane add-in.

6. Select Get OneDrive File Names. If you're logged into Office with either a Microsoft 365 Education or work account, or a Microsoft account, and SSO is working as expected, the first 10 file and folder names in your OneDrive for Business are displayed on the task pane. If you are not logged in, or you are in a scenario that does not support SSO, or SSO is not working for any reason, you will be prompted to sign in. After you sign in, the file and folder names appear.

The sample sends a hardcoded query parameter on the URL for the Microsoft Graph REST API. If you modify this code in a production add-in and any part of query parameter comes from user input, be sure that it is sanitized so that it cannot be used in a Response header injection attack.

• Did you experience any problems with the sample? Create an issue and we'll help you out.
• We'd love to get your feedback about this sample. Go to our Office samples survey to give feedback and suggest improvements.
• For general questions about developing Office Add-ins, go to Microsoft Q&A using the office-js-dev tag.

Join the Microsoft 365 Developer Program to get resources and information to help you build solutions for the Microsoft 365 platform, including recommendations tailored to your areas of interest.

You might also qualify for a free developer subscription that's renewable for 90 days and comes configured with sample data; for details, see the FAQ.

• Microsoft Graph documentation
• Office Add-ins documentation

Copyright (c) 2019 - 2021 Microsoft Corporation. All rights reserved.

This project has adopted the Microsoft Open Source Code of Conduct. For more information, see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.

Note: The Index.cshtml file contains an image URL that tracks diagnostic data for this sample add-in. Please remove the image tag if you reuse this sample in your own code project.