Using WordPress? Every integration here is also available as a plugin. Browse the plugin store →

Articles

The technical questions, answered where you can check them.

Working notes on the parts of Microsoft 365 that are hard to put on a website: how Microsoft Graph access is granted, what an administrator is agreeing to at the consent screen, and where the usual approaches quietly go wrong. Every article answers one question, and answers it in the first paragraph.

There are no product announcements here. When something ships, it is on the changelog — this section is for how the technology underneath actually behaves.

Every article, and the question it answers

Embedding 9 min read

Iframe or custom element: how a third-party widget should arrive on your page

Should an embedded third-party widget be an iframe, or a script that defines a custom element?

Choose an iframe when isolation matters more than integration — untrusted content, a separate origin, a hard security boundary. Choose a custom element when the widget has to behave like part of the page: inherit the layout, size to its content, participate in one focus order, and be readable by a screen reader as a single document.

Read the article

Microsoft Graph 7 min read

Managed or proxy: two ways to let a website read Microsoft 365

How does a public website read Microsoft 365 data without the vendor holding your Azure credentials?

There are two workable arrangements, and the difference is who holds the Microsoft Graph credential. In managed mode the vendor registers the Entra application and your administrator grants it consent once. In proxy mode you run a gateway inside your own perimeter, the vendor calls that gateway instead of Graph, and no Microsoft token is ever issued to the vendor at all.

Read the article

Scheduling 8 min read

Microsoft Bookings or a plain Outlook calendar: which should take your appointments?

Should appointments from your website go through Microsoft Bookings, or straight onto an Outlook calendar?

Use Microsoft Bookings when you are selling defined services with staff, durations and prices, and you want Microsoft to send the confirmations. Book against Outlook calendars directly when what you are scheduling is people's time, a meeting room or a piece of equipment — that needs no Bookings licence and no Bookings business to maintain.

Read the article

SharePoint 8 min read

Publishing a SharePoint document library on a website without copying the files

How do you put a SharePoint document library on a public website so the newest version is always the one visitors see?

Read the library through Microsoft Graph at request time and render it as part of the page, rather than exporting files and re-uploading them. The library stays the single copy, the website shows whatever is in it now, and the publishing workflow becomes "save the file where it belongs".

Read the article

Embedding 7 min read

Showing Microsoft 365 data to visitors who have no Microsoft account

Can a public website display SharePoint, Outlook or directory data to anonymous visitors?

Yes, and the mechanism is that the server does the reading. The organisation's identity authorises the Microsoft Graph call server-side, the visitor never authenticates to Microsoft, and what reaches the browser is ordinary page data with no token attached.

Read the article

Microsoft Graph 8 min read

What a Microsoft 365 administrator is actually agreeing to at the consent screen

What does granting admin consent to a Microsoft Graph application really give it access to?

Admin consent grants an application the listed permissions across your whole tenant, on behalf of every user in it, without any further prompt to anyone. The permission names are literal: a permission ending in `.All` means all of that resource type in the tenant, not the subset the person granting it had in mind.

Read the article

Something here not covered? Ask, and it may become the next one.

These are written from the questions people actually send us about Microsoft Graph, SharePoint and embedding. A question that is missing is a gap rather than a boundary.

Ask us directly Read the FAQ