DEV Community

Roman
Roman

Posted on Originally published at silentship.dev

What the new Office.js CDN endpoint actually changes

#office #javascript #security #webdev

I run silentship, an independent monitor for changes on the Office.js CDN. This is a copy of the original note.

Since late September, Microsoft's docs list appsforoffice.microsoft.com as a legacy endpoint and recommend a new one:

Legacy New
Release appsforoffice.microsoft.com/lib/1/hosted/office.js officeapis.public.onecdn.static.microsoft/1/office.js
Preview appsforoffice.microsoft.com/lib/beta/hosted/office.js officeapis.public.onecdn.static.microsoft/beta/office.js

The docs say the new endpoint "serves the same current Office.js release, but it enables additional secure defaults", without saying which defaults. So we compared the two directly.

Short answer

  • Same build. Both endpoints serve 16.0.20606.15070.
  • Host files are byte-identical. excel-win32-16.01.js, word-win32-16.01.js, outlook-win32-16.02.js, powerpoint-web-16.00.js and the rest have the same SHA-256 on both. Every Office API your add-in calls comes from the same code.
  • Only office.js (the loader) differs, and only by two lines at the top: 
isOsfSecurityDefaultsEnabled = true;
osfLoadMsAjax = false;
Enter fullscreen mode Exit fullscreen mode

Everything else in the loader is identical. Both endpoints also sit behind the same Akamai + Azure Front Door setup, with the same caching headers.

What the two flags do

Reading the loader, the logic is:

  1. If the <script> tag that loads office.js has a data-enable-trusted-types attribute, that attribute decides.
  2. Otherwise, isOsfSecurityDefaultsEnabled decides.
  3. If the result is "on", the loader does not load MicrosoftAjax and creates a Trusted Types policy named officejs.

On the legacy endpoint neither flag is set, so neither happens unless you opt in. On the new endpoint both happen by default.

Another detail: the loader decides where to fetch host files from based on its own src. An add-in that loads office.js from the new endpoint gets all of its Office.js files from there, not a mix.

Who can break when switching

Add-ins that use MicrosoftAjax without knowing it. The legacy loader quietly pulls in MicrosoftAjax.js, so its globals have always been there. Code (yours or a dependency's) that touches Sys.*, Type.registerNamespace, Function.createDelegate or $create works today and throws ReferenceError on the new endpoint. Search your bundle, not just your source:

grep -rnE "\bSys\.|Type\.registerNamespace|Function\.createDelegate|\$create\(" dist/
Enter fullscreen mode Exit fullscreen mode

Pages with a strict CSP or Trusted Types. With require-trusted-types-for 'script', the officejs policy has to be allowed (trusted-types officejs …), and *.static.microsoft has to be allowed in script-src and in any corporate network allow list.

Microsoft's migration checklist also asks you to register every ExecuteFunction command handler with Office.actions.associate(...). The loader diff contains nothing beyond the two flags, so that requirement comes from code paths that behave differently once the flags are on, not from a separate switch.

Trying the new defaults without changing the URL

Because the decision starts with the data-enable-trusted-types attribute, you should be able to get the new endpoint's behaviour on the legacy URL:

<script src="https://appsforoffice.microsoft.com/lib/1/hosted/office.js"
        data-enable-trusted-types="true"></script>
Enter fullscreen mode Exit fullscreen mode

We read this from the loader and haven't tested it in every host. Treat it as a quick way to find MicrosoftAjax dependencies in a test build, not as a production setting.

The risk worth watching

Today the only difference between the endpoints is two flags in one file. Nothing stops the same two lines from appearing in the legacy loader one day. Microsoft ships loader updates the way it ships everything else on this CDN: without a changelog, edge by edge. If that happens, add-ins that still depend on MicrosoftAjax will start failing on a growing share of loads over a day or so, without a single line of their own code changing.

silentship now watches both endpoints. A change to either flag on any endpoint is treated as High, and subscribers are alerted as soon as it's confirmed on two runs. You can see both endpoints side by side on every rollout page.

Alerts: silentship.dev

Checked on 19 Oct 2026 against build 16.0.20606.15070. Microsoft's page: Referencing the Office JavaScript API library from its CDN. Thanks to the commenter on office-js#6513 who pointed out the new endpoint.

Top comments (0)