# Setting up the Office Assistant What an IT administrator needs to deploy the Office Assistant in Microsoft 365: what it can touch, what it needs, how to upload it and assign it, how staff sign in, where data goes, and how to remove it. ## What it is - **A task pane add-in for Excel and Word**, and for PowerPoint and Outlook where your organisation turns them on. It acts only on a request a user types or picks in the pane. - **Named for your organisation.** It appears under your organisation's name for it, for example "Your Organisation Office Assistant", with a shorter name on the ribbon and the right-click menu. - **Served by your organisation's platform.** The pane loads from your chat platform's own address. There's nothing to install on devices. - **Turned on app by app.** In an app that isn't turned on for your organisation, it shows a short message saying so and does nothing else. - **Help for staff** is in [the user guide](../guide/), which **Help** in the pane opens. ## What it can access The add-in asks Office for one permission, quoted from its manifest. | App | Permission | What that allows | |---|---|---| | Excel, Word, PowerPoint | `ReadWriteDocument` | Reading and changing the open document. No access to other files. | | Outlook, only if your organisation uses it there | `ReadWriteItem` | The open email or meeting, including in a shared mailbox. Not the rest of the mailbox. | It asks for nothing in Microsoft Entra: **no app registration, no admin consent and no Microsoft Graph permission**. It can't: - **send email**, share files or post anything. In Outlook it writes drafts only. - **open other files, folders or mailboxes**, beyond files a user attaches in the pane and knowledge bases they can already read on your platform. - **browse the web or run code.** It has no web search, code execution or macros. ## Requirements - **Microsoft 365 Apps for business or enterprise**, kept up to date on a current update channel. The add-in needs Office that can run a shared runtime (Microsoft's SharedRuntime 1.1 requirement set). - **Office bought outright (such as Office 2019) and the LTSC editions don't show the add-in at all.** Staff on them see nothing, rather than something that half works. - **Not on iPad or iPhone.** | Platform | Needs | |---|---| | Windows | Excel 2002, PowerPoint 2102 and Word 2205 or later | | Mac | Excel 16.35, PowerPoint 16.46 and Word 16.61 or later | | Office on the web | A current version of Edge, Chrome, Firefox or Safari | A user can see their version in **File > Account** on Windows, or **Excel > About Excel** (or Word) on a Mac. The keyboard shortcuts need later versions again (for example Word 2408 or later on Windows); without them, everything else still works. ### Network Allow these from users' devices. | Address | Why | |---|---| | `https://` | The pane, sign-in and the platform | | `https://login.microsoftonline.com` | Microsoft sign-in | | `https://appsforoffice.microsoft.com` | Microsoft's Office JavaScript library, which every add-in loads | | `https://.cloudflareaccess.com` | Cloudflare Access sign-in, if your platform sits behind it | If your platform sits behind Cloudflare Access, Office on the web needs third-party cookies allowed for your chat platform's address. Edge and Chrome allow them by default; Safari blocks them, so Safari users should use the desktop apps. Desktop Office is unaffected. ## Deploy the add-in Your platform contact sends you the add-in as a file: `manifest.xml`, for Excel, Word and PowerPoint. If your organisation will use it in Outlook too, a second file, `manifest-outlook.xml`, is uploaded the same way. > **Upload the file, not a link.** The admin centre can also add an add-in from a URL. Don't use that: Microsoft's servers can't reach your chat platform's address, which sits behind your organisation's sign-in. It takes a Global Administrator, or an Exchange Administrator who also holds the Application Administrator role. 1. Sign in to the [Microsoft 365 admin centre](https://admin.microsoft.com) and go to **Settings > Integrated apps**. 2. Select **Upload custom apps**. 3. For the app type choose **Office Add-in**, then **Upload manifest file (.xml) from device**, and choose `manifest.xml`. 4. Choose who gets it: particular users or groups (nested groups aren't supported), or everyone. Then finish and deploy. 5. If you're using it in Outlook, do the same with `manifest-outlook.xml`. 6. **Allow 24 to 72 hours.** That's how long Microsoft takes to get a new add-in to everyone's Office. Users may need to close and reopen Office. It then appears on the **Home** tab. Microsoft's own guides: [deploy add-ins in the admin centre](https://learn.microsoft.com/microsoft-365/admin/manage/manage-deployment-of-add-ins) and [requirements for centralised deployment](https://learn.microsoft.com/microsoft-365/admin/manage/centralized-deployment-of-add-ins). > **Who can use it is also set on your platform.** Assigning the add-in in Microsoft 365 puts the button in someone's Office; your platform decides whether they can use the assistant. Someone who has the button but isn't approved on the platform sees a message asking them to request access. ## Sign-in - **The user's own work account**, through the sign-in your organisation's chat platform already uses. The first time, the pane shows **Sign in with Microsoft** and opens Microsoft's sign-in in a small window. - **Nothing changes in Microsoft Entra.** There's no new app registration, consent or Graph permission. Your existing policies, such as multi-factor authentication and Conditional Access, apply as they do to the chat platform. - **The sign-in window is a pop-up.** Office mustn't block it. ![The sign-in pane: the add-in's name, a line asking the user to sign in with their work account, and a Sign in with Microsoft button.](img/signin.png "The first time: Sign in with Microsoft") ![The pane in an app that isn't turned on: "Office Assistant isn't enabled for PowerPoint in your organisation yet", with a line to ask the administrator and a Help link.](img/not-enabled.png "An app your organisation hasn't turned on") ## How changes are controlled - **Every change is shown first.** By default each edit waits in a panel in the pane until the user allows it. A user can switch asking off for themselves; the changes can still be undone. - **Undo.** **Revert this turn's changes** undoes everything the assistant changed for one request. - **Tracked changes in Word.** Users can have the assistant's Word edits made as tracked changes. Your organisation can require that for everyone: the setting is then locked on, and an edit Word can't track is refused rather than made untracked. ## Where data goes 1. **The pane is served by your platform,** at `https:///office/`. There's no installer and no separate service. 2. **What the assistant reads goes to your platform,** which runs the AI model. It reads the open file, and anything the user attaches, only to answer a request. The model provider is as set out in your organisation's agreement for the platform. 3. **Each chat is saved in the user's history on your platform,** in a folder called "Office Assistant": every message, each step the assistant took, and a log of approvals, undos, sign-in and errors. The log never holds sign-in tokens. In the web chat these chats are read-only; they continue only in Office. There are no third-party analytics or tracking. The only thing loaded from outside your platform is Microsoft's Office JavaScript library. | Stored in | What | |---|---| | The add-in's browser storage | The sign-in session (`oa.token`), removed on **Sign out**, and one Word preference (`oa.trackEdits`). | | Cookies for your chat platform | The platform's own sign-in cookie, and `oa_dialog`, for 10 minutes during sign-in. | | Excel, Word and PowerPoint files | A random identifier in the add-in's own document settings, so the user can pick up the chat about that file later. Nothing about the content. | | Outlook messages | Nothing. | ## Updates - **Automatic.** Improvements come from your platform, and users get them the next time Office starts the add-in. There's nothing for you to do. - **A new manifest file is rare.** It's needed only for a new chat platform address, a new Office app, a renamed add-in, broader permissions, or new right-click items or shortcut keys. Your platform contact sends the new file, with a higher version number; in **Integrated apps**, select the add-in and update it with the file. ## Remove it - **In the admin centre:** **Settings > Integrated apps**, select the add-in and remove it, and the Outlook add-in too if you uploaded it. Only the admin who deployed it, or a Global Administrator, can remove it. It leaves users' Office over the same 24 to 72 hours. - **On the platform, straight away:** your platform contact can switch the assistant off, after which the pane shows the "isn't enabled" message. - **What stays:** chats stay in users' history on your platform, under its normal retention. Files keep only the random identifier, which does nothing without the add-in. ## Troubleshooting | If | Check | |---|---| | A user doesn't see the button | Has it been 72 hours? Are they assigned, directly or through a group that isn't nested? Is their Office Microsoft 365 Apps at a supported version? Then have them close and reopen Office. | | No one on a device sees it | The device probably runs Office bought outright or an LTSC edition, which can't run the add-in. | | The sign-in window doesn't open | Office or the browser is blocking pop-up windows. | | Sign-in fails in Office on the web in Safari | Safari blocks the third-party cookie that Cloudflare Access needs. Use Edge, Chrome or the desktop apps. | | "Your account isn't set up" | The user isn't approved on your platform yet. Ask your platform contact. | | "Isn't enabled for this app" | That app isn't turned on for your organisation. Ask your platform contact. | ## Contact Your platform contact, or [office@prestage.com.au](mailto:office@prestage.com.au). Last updated 8 November 2026, describing add-in release 0.4.0 (manifest 2.1).