Restricting a component to your own domains

A component embed is a public URL with a public key in it. The thing that stops somebody pasting your key onto their own site and serving your Microsoft 365 data from it is the instance’s allowed domains list.

The rule, exactly

The API compares the browser’s origin against the list on every configuration request, before it does anything else that costs you anything.

• An empty list denies every request. This is deliberate and it is the default for a new instance. You must name the sites you intend to embed on. The alternative default — “anybody, anywhere” — is the same security posture as an unauthenticated public token.
• An entry matches an exact hostname, or any subdomain of it. Listing example.com admits example.com and shop.example.com. It does not admit example.com.attacker.net, and it does not admit example.org.
• localhost and IP addresses must be listed as exact strings. They are not implied by anything, and they are not admitted just because a request looks local — Origin is a header the client controls, so it cannot be trusted to mean “this really is a developer’s machine”.
• The dashboard’s own origin is always allowed. The builder’s live preview would otherwise force every customer to allowlist our host on every instance.

A request that fails this check gets HTTP 403 and the component renders nothing.

The wildcard

A single * entry allows any origin. It exists because instances created before this check was introduced were migrated to it, so that embeds already live on customer sites did not break the day the rule shipped. The dashboard flags an instance in that state.

Treat * as a temporary position. While it is set, anyone who reads your page source can render your component — and every view they serve counts against your allowance.

Setting it up

List every hostname that will render the component, including the www form if your site serves both, plus any staging host. Do not list the path — this is a hostname list, not a URL list. Do not list our host; it is already implied.

If you use a preview deployment host that generates a new subdomain per build, list the parent domain so the subdomain rule covers them.

Checking it

Load the page and look at the network request the component makes to /api/config/<embed key>. A 403 there is this check. Anything else is a different problem — see Component error codes.

Related

• How the embed key works, and why it is not a secret
• Component error codes