3751855 - SAC excel add-in connection fails with content security policy violation when loading appsforoffice.microsoft.com script

• Connection from the excel add-in to the SAC tenant fails due to a Content Security Policy (CSP) violation.
• Error example: "Loading the script https://appsforoffice.microsoft.com/lib/1/hosted/excel-web-16.00.is violates the following Content Security Policy directive: 'script-src ...'. Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback. The action has been blocked."

Product: SAP Analytics Cloud, add-in for Microsoft Office

1. Open Excel and start the SAC add-in.
2. Attempt to connect to the SAC tenant from the add-in.
3. Check the console (for example, browser or WebView developer tools) and observe the CSP violation stating that the script from appsforoffice.microsoft.com is blocked.

Content Security Policy (CSP) on the SAC tenant is enabled and does not include appsforoffice.microsoft.com in the trusted allow list, which blocks the add-in’s required script loading.

1. In the SAC tenant, go to Administration > Security and locate the Content Security Policy settings.
2. If CSP is enabled, add appsforoffice.microsoft.com to the trusted domains/allowed sources (for example, allow it for script loading).
3. Save the configuration.
4. Retry connecting from the Excel add-in.
5. If required for validation, temporarily disable CSP to confirm the root cause. If the add-in then connects, re-enable CSP and ensure appsforoffice.microsoft.com is included in the allow list.

• Refer to: Troubleshooting guide for the SAP Analytics Cloud, add-in for Microsoft Office
• Refer to: SAC Add-in gives a blank page when it's configured with several tenants - SAC
• Refer to: Error: "Refused to frame ... because an ancestor violates the following Content Security Policy directive: 'frame-ancestors *'." occurs when logging on SAC
• Refer to: SAP Analytics Cloud, add-in for Microsoft Excel – Login leads to blank screen

sac add-in, excel add-in, content security policy, csp, script-src, appsforoffice.microsoft.com, connection fails, blocked script, office.js, excel web add-in, trusted domains, allow list, script blocked, console error, sac tenant configuration , KBA , LOD-ANA-OF-XLA , SAP Analytics Cloud, add-in for Microsoft Office , Problem