Office Add-in Manifest Validator

Paste your manifest.xml and get the errors back with line numbers in about a second. This Office add-in manifest validator checks the things that stop an add-in loading: root element and namespace, required elements, GUID and version format, https on every URL, permission values, duplicate ids, and every resource id your ribbon buttons point at.

When the local checks are clean, one optional button runs the same validation Microsoft applies to an AppSource submission.

Validation runs entirely in your browser. The file is never uploaded, never logged, and never leaves your machine.

or drop a file here

Results appear here with a line number for each finding. Nothing is uploaded, so you can check a manifest for an unreleased add-in.

How do you validate an Office add-in manifest?

Three steps, no install and no account. The validator reads the file in the browser, so it works offline once the page has loaded.

Step 1
Paste or drop your manifest.xml
Open the manifest file from your add-in project and paste it into the box, or drag the file onto the panel. The file stays in your browser.
Step 2
Read the errors by line number
Every finding names the element it came from and the line it sits on. Select a finding to jump to that line in the editor. Fix errors first, since those are what stop Office loading the add-in.
Step 3
Run the Microsoft check before you submit
When the local checks are clean, run the optional store validation with production-level checks turned on. That step fetches your icon and task pane URLs the way Microsoft does at submission time.

Why does an Office add-in manifest fail validation?

Six failures account for most rejected manifests. Each one below was reproduced against Microsoft's live validation service while building this tool, so the symptom text matches what you will see in your own report.

An http URL anywhere in the file

Symptom. Office silently refuses to load the add-in, or the task pane opens blank. Microsoft's report calls this out as "Urls should be secured, non-localhost and valid".

Fix. Every SourceLocation, IconUrl, HighResolutionIconUrl, AppDomain and resource URL has to start with https. There is no exception for internal networks.

A resid with no matching resource

Symptom. The add-in installs but the ribbon button is missing, or the whole custom group fails to appear.

Fix. Each resid on a Label, Title, Icon or Action must match an id declared under Resources in bt:Images, bt:Urls, bt:ShortStrings or bt:LongStrings. A single typo removes the control.

Elements in the wrong order inside Group

Symptom. "XML Schema Validation Error" with a message naming an invalid child element, and a line number.

Fix. The schema fixes the order. Inside Group it is Label, then Icon, then Control. Inside OfficeApp, SupportUrl comes after HighResolutionIconUrl and before AppDomains. Moving one element down a line clears it.

An Id that is not a plain GUID

Symptom. "The manifest product ID could not be parsed. The ID must be a plain GUID."

Fix. Use the 8-4-4-4-12 hexadecimal form and nothing else. A name, a shortened id, or a GUID with stray characters all fail.

Icon URLs that are not reachable

Symptom. "Icon URL Unreachable". This one only appears under production-level checks, so it passes locally and then blocks the submission.

Fix. Publish the icons to the live https host before submitting, and confirm each one loads in a private browser window with no session cookie.

Localhost left in the file

Symptom. Fine while you develop, rejected at submission with "The manifest source location URLs should not be localhost".

Fix. Swap every localhost address for the production host. The validator flags these as warnings so they are visible before you submit rather than after.

Two of these behave differently by host. Mail manifests declare their pages in FormSettings rather than DefaultSettings, covered on the Outlook add-in development page, and single sign-on adds WebApplicationInfo plus extra AppDomains entries, covered under Microsoft SSO.

What does this Office add-in manifest validator check?

Nine rule groups, run in order. Anything marked as an error will stop Office from loading the add-in or stop AppSource from accepting it. Warnings load fine but need a decision before you publish.

Root element and add-in type

Confirms the root is OfficeApp, the namespace is the 1.1 schema, and xsi:type is TaskPaneApp, MailApp or ContentApp. A typo here is why Office rejects a manifest before reading anything else.

Required elements

Id, Version, ProviderName, DefaultLocale, DisplayName, Description, Hosts, Permissions, and the SourceLocation for your add-in type. Mail add-ins are checked against FormSettings instead of DefaultSettings.

GUID and version format

Id has to be a real GUID in 8-4-4-4-12 form. Version has to be two to four dot-separated integers, so 1.0.0.0 passes and 1 does not.

https on every URL

Office refuses to load an add-in served over http. Every SourceLocation, IconUrl, HighResolutionIconUrl, AppDomain and resource URL is checked. A localhost address returns a warning, since it works while you develop but blocks AppSource submission.

Permission values

Mail add-ins accept Restricted, ReadItem, ReadWriteItem and ReadWriteMailbox. Task pane and content add-ins accept ReadDocument, WriteDocument, ReadWriteDocument and ReadAllDocument. Mixing the two sets is a common copy-paste error.

Resource ids and duplicates

Every resid on a Label, Icon, Title or Action is matched against the ids declared in Resources, and duplicate control or resource ids are reported with a line number. These two account for most sideload failures with add-in commands.

Next steps

A clean manifest is one step. These pages cover what comes next.

AppSource publishingWhat Microsoft checks after the manifest passes, and how long each review round takes.Office add-in developmentExcel, Outlook, Word, PowerPoint and Teams builds on Office.js.Outlook add-in developmentMail manifests use FormSettings and Rule elements that the other hosts do not.Excel add-in developmentCustom functions and task panes, including the manifest entries they need.Microsoft SSO and Azure ADSingle sign-on adds WebApplicationInfo and AppDomains entries to the manifest.Office add-ins developer guideStart here if the manifest is the first Office.js file you have opened.

Frequently asked questions

See more FAQs

What is an Office add-in manifest?

The manifest is an XML file that tells Office what your add-in is called, which applications it runs in, which permissions it needs, and which https URL to load. Office reads it before any of your JavaScript runs, so a manifest error stops the add-in from appearing at all.

Why does my add-in fail to sideload?

In most cases the manifest points at an http URL instead of https, uses an Id that is not a valid GUID, or references a resid that was never declared under Resources. All three are reported by this validator with the exact line number.

Does this replace the official Microsoft validator?

No. This tool checks the structure and rules of the XML in your browser and catches the errors that break sideloading. Microsoft's validator additionally fetches your URLs and applies AppSource store policy. Run this one while you edit, and the official one before you submit.

Is my manifest uploaded anywhere?

No. The validation engine runs in your browser as JavaScript. Nothing is sent to a server, so you can safely check a manifest for an unreleased internal add-in.

Does it validate the JSON manifest for Teams and Microsoft 365?

Not yet. This validator covers the XML manifest used by Office add-ins today. The unified JSON manifest for Microsoft 365 is a separate format, and support for it is planned.

What is the difference between an error and a warning?

An error means Office or AppSource will reject the manifest, so the file is marked invalid. A warning means the manifest still loads but something needs attention before you publish, such as a localhost URL or a missing VersionOverrides section.

Manifest passes but the add-in still will not load?

We debug sideload failures, fix AppSource submission rejections, and build Office add-ins end to end.

Talk to a developer