Display SharePoint Online in an iframe on different domain

Question

We would like to display pages from SharePoint Online in an iframe of a Page hosted somewhere else, e.g. in an Azure Web App:

<iframe src="https://site.sharepoint.com/"></iframe>

When we do this (in Chrome for example), we get the following error:

Refused to display "https://site.sharepoint.com/_layouts/15/start.aspx#/SitePages/ ⏎ Home.aspx" in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.

A Page from SharePoint 2013 (on premise) can be displayed in an iframe from a Page hosted on another domain, if the following control is added to the head of the master page:

<WebPartPages:AllowFraming runat="server" />

However if this control is not added to the master-page, then we also get the above mentioned error.

As far as I know there is no possibility to adjust the master-page in a SharePoint Online Team Site. Is that correct?

In a Publishing Site you are allowed to adjust the master-page, or even add a new one. But I can't find anything similar in Team Sites.

Does anybody know if it is somehow possible to configure domains which do not fall under the "X-FRAME-OPTIONS: SAMEORIGIN"-policy in a SharePoint Online environment? Or if there is another possibility to display SharePoint Online content in an iframe on a different domain. I checked google, checked the Site settings and checked the Office 365 admin center, but didn't find anything.

Answer 1

You can not add Sharepoint online page in an iframe because of the same origin policy that most of the sites on the internet adopted these days. This is mainly for security reasons to avoid web attacks like Clickjacking and XSS.

If you want to display the content of the SharePoint online in a different domain, then try to use provider hosted app in windows azure or develop a Napa SharePoint hosted app that can make cross-domain requests in REST or ajax

Answer 2

If you are using SharePoint 2013, try to set HTML Field Security. You can add your external website there.

For some reason, SharePoint 2013 wouldn't allow untrusted website to insert into iframe.

Another solution is you can set trusted site if you are using IE.

Answer 3

Since its SP Online I believe your best option is to modify master page.

You can either turn on Publishing feature or directly open change master page url.

You can find your current master page by appending below link to your site url

/_Layouts/ChangeSiteMasterPage.aspx

Answer 4

I believe its not possible, sharepoint avoids cross domain requests for security purposes, disallowing another domain requests. Also you can not change that by simply updating masterpage. that's a configuration that can not be changed. better find something else.

Answer 5

Adding AllowFraming option in master page works for SharePoint Online. Turn on the publishing feature and edit the master page to add:

<WebPartPages:AllowFraming runat="server" />

Answer 6

You may probably edit the master page to add the AllowFraming control from SharePoint Designer 2013.
Or, you can go to the master page galery ("Site settings", "Master pages" under the "Galery" section), locate "seattle.master", download it, edit it in Notepad, re-upload it (and publish/approve if needed).

Answer 7

In case this helps someone, quoting from https://answers.microsoft.com/en-us/msoffice/forum/msoffice_sharepoint-mso_winother-mso_o365b/office-365-web-apps-in-iframe-inside-aspx-page/c9df69e7-304f-4c61-aded-d75e65019c69:

To insert a SharePoint document as an iframe, we recommend you get the embeddable link following the methods below: 1. Open the document in the Office online > File > Share > Embed.

2. Enable the guest link on your site > create the embeddable link based on the guest link following the link:

https://support.office.com/en-us/article/Embed-your-Excel-workbook-on-your-web-page-or-blog-from-SharePoint-or-OneDrive-for-Business-7af74ce6-e8a0-48ac-ba3b-a1dd627b7773?ui=en-US&rs=en-US&ad=US

Answer 8

Even it's Office 365, you can still add the domain to the HTML Field Security and allow user to insert iframes from any external domain into pages on this site.