提交Office Store的Outlook Add-in：O365认证下登出账号的审核困惑

Hey Darren, sorry to hear your Outlook Add-in is stuck in this frustrating Office Store review loop—both staying logged into O365 and logging out are causing failures. Let’s break down what might be going on and actionable steps to fix this.

First, let’s align on what the Office Store review team typically looks for with O365-authenticated add-ins: compliance with Microsoft’s authentication standards, consistent user experience, and robust handling of edge cases. Both failure scenarios point to gaps in how your add-in interacts with the O365 auth state:

• Auth flow compliance issues: The review team enforces strict adherence to Microsoft’s official Office Add-in authentication guidelines. If you’re using a custom login/logout flow instead of Office.js APIs like getAccessTokenAsync or logoutAsync, that’s likely a red flag. For example, failing to properly revoke tokens when a user logs out, or not handling silent token refresh when already logged in, can trigger failures.
• User experience inconsistencies: The team tests for intuitive, expected behavior. If your add-in crashes, shows blank screens, or throws errors when the user is logged in or out, it violates the expected UX. For instance, if a logged-in user sees an unnecessary login prompt, or a logged-out user can’t trigger the O365 login flow, that’s a problem.
• Uncovered edge cases: Reviewers often test with multi-tenant accounts, MFA-enabled accounts, or different Outlook clients (desktop, web, mobile). Your add-in might work fine in your test environment but break in these less common scenarios.

Let’s start with the most impactful checks:

• Validate your auth implementation against Microsoft’s standards

  • Replace any custom login/logout logic with Office.js official APIs. These are pre-vetted for Office Store compliance and handle edge cases like token expiration, MFA prompts, and tenant switching automatically.
  • For logout specifically: Ensure calling logoutAsync (if applicable) clears both your add-in’s local session data and revokes the O365 token associated with your app. Don’t leave orphaned sessions that could cause auth conflicts.

• Replicate review scenarios in your testing

  • Test both core scenarios rigorously:
    1. Logged-in state: Launch the add-in while already signed into Outlook/O365. Verify it silently fetches a token, loads your service without errors, and doesn’t prompt for redundant login.
    2. Logged-out state: Sign out of O365 entirely, then launch the add-in. Confirm it triggers the official Microsoft login flow, completes auth seamlessly, and loads your service post-login.
  • Add edge case testing: Try multi-tenant accounts, MFA-enabled accounts, and different Outlook clients to catch hidden bugs.

• Dig into the review feedback details

  • Office Store reviews usually include specific failure notes (even if they’re buried). Look for phrases like “add-in fails to initialize when user is logged out” or “token retrieval fails in authenticated state.” If the feedback is vague, request more specific details from the review team—they can often point to the exact step or scenario causing the issue.

• Add dynamic state checking

  • Ensure your add-in starts by checking the current O365 auth state (don’t hardcode assumptions about login status). Use Office.context.auth.getAccessTokenAsync with a fallback to trigger login if the token can’t be retrieved silently. This ensures your add-in adapts to whatever state the user is in.

• Cross-reference your code with Microsoft’s official Office Add-in auth examples to spot deviations from best practices.
• Have colleagues or beta testers run through the login/logout flows to catch UX issues you might have missed.

内容的提问来源于stack exchange，提问作者Darren