Microsoft now requires Office Add-in developers to prompt users for permission to access their device capabilities. This applies to add-ins that run on the following Office applications.

• Web versions of Microsoft Word, Excel, Outlook, and PowerPoint running in Chromium-based browsers (such as Microsoft Edge or Google Chrome)
• New Outlook for Windows

A user’s device capabilities include their camera, geolocation, and microphone. To prompt your users for permissions, you can now implement the Device Permission API in your add-in.  This change doesn’t impact add-ins that run in Office on Windows, on Mac, or other browsers like Safari.

If your organization has an existing add-in or is building one that requires access to a user’s device capabilities and will run in Office on the web on Chromium-based browsers, your developers must implement the Device Permission API. This API shows a dialog to the user that contains the following: 

• The name of the add-in requesting permission. 

• The device capabilities the add-in needs to use. 

• The options for the user to Allow, Allow once, or Deny permission to the add-in. 

When a user selects Allow or Deny, their permission is stored in the cache. This prevents the same add-in from prompting the user for the same permission. To change an add-in’s permission to a user’s device capabilities, the user must uninstall, then reinstall the add-in. Alternatively, they can also clear their browser cache. 

In Outlook add-ins that implement event-based activation, browser permissions aren’t inherited. Additionally, the Device Permission API isn’t supported or recommended in these add-ins. 

To learn more about how the user is prompted for permission to their device capabilities, see View, manage, and install add-ins for Excel, PowerPoint, and Word. 

Thank you for your continued support of Office Add-ins on all platforms. 

Additional resources

Office Dev Center 

Privacy and security in Office Add-ins