For Microsoft 365 and IT administrators
Setting up the Office Assistant
What an IT administrator needs to deploy the Office Assistant in Microsoft 365: what it can touch, what it needs, how to upload it and assign it, how staff sign in, where data goes, and how to remove it.
On this page
What it is
- A task pane add-in for Excel and Word, and for PowerPoint and Outlook where your organisation turns them on. It acts only on a request a user types or picks in the pane.
- Named for your organisation. It appears under your organisation's name for it, for example "Your Organisation Office Assistant", with a shorter name on the ribbon and the right-click menu.
- Served by your organisation's platform. The pane loads from your chat platform's own address. There's nothing to install on devices.
- Turned on app by app. In an app that isn't turned on for your organisation, it shows a short message saying so and does nothing else.
- Help for staff is in the user guide, which Help in the pane opens.
What it can access
The add-in asks Office for one permission, quoted from its manifest.
| App | Permission | What that allows |
|---|---|---|
| Excel, Word, PowerPoint | ReadWriteDocument | Reading and changing the open document. No access to other files. |
| Outlook, only if your organisation uses it there | ReadWriteItem | The open email or meeting, including in a shared mailbox. Not the rest of the mailbox. |
It asks for nothing in Microsoft Entra: no app registration, no admin consent and no Microsoft Graph permission.
It can't:
- send email, share files or post anything. In Outlook it writes drafts only.
- open other files, folders or mailboxes, beyond files a user attaches in the pane and knowledge bases they can already read on your platform.
- browse the web or run code. It has no web search, code execution or macros.
Requirements
- Microsoft 365 Apps for business or enterprise, kept up to date on a current update channel. The add-in needs Office that can run a shared runtime (Microsoft's SharedRuntime 1.1 requirement set).
- Office bought outright (such as Office 2019) and the LTSC editions don't show the add-in at all. Staff on them see nothing, rather than something that half works.
- Not on iPad or iPhone.
| Platform | Needs |
|---|---|
| Windows | Excel 2002, PowerPoint 2102 and Word 2205 or later |
| Mac | Excel 16.35, PowerPoint 16.46 and Word 16.61 or later |
| Office on the web | A current version of Edge, Chrome, Firefox or Safari |
A user can see their version in File > Account on Windows, or Excel > About Excel (or Word) on a Mac. The keyboard shortcuts need later versions again (for example Word 2408 or later on Windows); without them, everything else still works.
Network
Allow these from users' devices.
| Address | Why |
|---|---|
https://<your chat platform address> | The pane, sign-in and the platform |
https://login.microsoftonline.com | Microsoft sign-in |
https://appsforoffice.microsoft.com | Microsoft's Office JavaScript library, which every add-in loads |
https://<team>.cloudflareaccess.com | Cloudflare Access sign-in, if your platform sits behind it |
If your platform sits behind Cloudflare Access, Office on the web needs third-party cookies allowed for your chat platform's address. Edge and Chrome allow them by default; Safari blocks them, so Safari users should use the desktop apps. Desktop Office is unaffected.
Deploy the add-in
Your platform contact sends you the add-in as a file: manifest.xml, for Excel, Word and PowerPoint. If your organisation will use it in Outlook too, a second file, manifest-outlook.xml, is uploaded the same way.
It takes a Global Administrator, or an Exchange Administrator who also holds the Application Administrator role.
- Sign in to the Microsoft 365 admin centre and go to Settings > Integrated apps.
- Select Upload custom apps.
- For the app type choose Office Add-in, then Upload manifest file (.xml) from device, and choose
manifest.xml. - Choose who gets it: particular users or groups (nested groups aren't supported), or everyone. Then finish and deploy.
- If you're using it in Outlook, do the same with
manifest-outlook.xml. - Allow 24 to 72 hours. That's how long Microsoft takes to get a new add-in to everyone's Office. Users may need to close and reopen Office. It then appears on the Home tab.
Microsoft's own guides: deploy add-ins in the admin centre and requirements for centralised deployment.
Sign-in
- The user's own work account, through the sign-in your organisation's chat platform already uses. The first time, the pane shows Sign in with Microsoft and opens Microsoft's sign-in in a small window.
- Nothing changes in Microsoft Entra. There's no new app registration, consent or Graph permission. Your existing policies, such as multi-factor authentication and Conditional Access, apply as they do to the chat platform.
- The sign-in window is a pop-up. Office mustn't block it.
How changes are controlled
- Every change is shown first. By default each edit waits in a panel in the pane until the user allows it. A user can switch asking off for themselves; the changes can still be undone.
- Undo. Revert this turn's changes undoes everything the assistant changed for one request.
- Tracked changes in Word. Users can have the assistant's Word edits made as tracked changes. Your organisation can require that for everyone: the setting is then locked on, and an edit Word can't track is refused rather than made untracked.
Where data goes
- The pane is served by your platform, at
https://<your chat platform address>/office/. There's no installer and no separate service. - What the assistant reads goes to your platform, which runs the AI model. It reads the open file, and anything the user attaches, only to answer a request. The model provider is as set out in your organisation's agreement for the platform.
- Each chat is saved in the user's history on your platform, in a folder called "Office Assistant": every message, each step the assistant took, and a log of approvals, undos, sign-in and errors. The log never holds sign-in tokens. In the web chat these chats are read-only; they continue only in Office.
There are no third-party analytics or tracking. The only thing loaded from outside your platform is Microsoft's Office JavaScript library.
| Stored in | What |
|---|---|
| The add-in's browser storage | The sign-in session (oa.token), removed on Sign out, and one Word preference (oa.trackEdits). |
| Cookies for your chat platform | The platform's own sign-in cookie, and oa_dialog, for 10 minutes during sign-in. |
| Excel, Word and PowerPoint files | A random identifier in the add-in's own document settings, so the user can pick up the chat about that file later. Nothing about the content. |
| Outlook messages | Nothing. |
Updates
- Automatic. Improvements come from your platform, and users get them the next time Office starts the add-in. There's nothing for you to do.
- A new manifest file is rare. It's needed only for a new chat platform address, a new Office app, a renamed add-in, broader permissions, or new right-click items or shortcut keys. Your platform contact sends the new file, with a higher version number; in Integrated apps, select the add-in and update it with the file.
Remove it
- In the admin centre: Settings > Integrated apps, select the add-in and remove it, and the Outlook add-in too if you uploaded it. Only the admin who deployed it, or a Global Administrator, can remove it. It leaves users' Office over the same 24 to 72 hours.
- On the platform, straight away: your platform contact can switch the assistant off, after which the pane shows the "isn't enabled" message.
- What stays: chats stay in users' history on your platform, under its normal retention. Files keep only the random identifier, which does nothing without the add-in.
Troubleshooting
| If | Check |
|---|---|
| A user doesn't see the button | Has it been 72 hours? Are they assigned, directly or through a group that isn't nested? Is their Office Microsoft 365 Apps at a supported version? Then have them close and reopen Office. |
| No one on a device sees it | The device probably runs Office bought outright or an LTSC edition, which can't run the add-in. |
| The sign-in window doesn't open | Office or the browser is blocking pop-up windows. |
| Sign-in fails in Office on the web in Safari | Safari blocks the third-party cookie that Cloudflare Access needs. Use Edge, Chrome or the desktop apps. |
| "Your account isn't set up" | The user isn't approved on your platform yet. Ask your platform contact. |
| "Isn't enabled for this app" | That app isn't turned on for your organisation. Ask your platform contact. |
Contact
Your platform contact, or office@prestage.com.au.