SharePoint Server 2019 July 2026 CU: Provider-Hosted Add-ins Blocked by Content Security Policy (CSP) – May Also Affect SharePoint Server Subscription Edition

Summary

After installing the SharePoint Server 2019 July 2026 Cumulative Update (KB5002883), customers using provider-hosted SharePoint Add-ins (remote web applications) may experience issues where the add-in no longer opens or completes the authentication process.

The issue occurs because SharePoint introduces a Content Security Policy (CSP) that prevents the SharePoint redirect page from being loaded by the remote application unless the application's URL is explicitly allowed.

This issue has been reproduced on SharePoint Server 2019. SharePoint Server Subscription Edition contains similar security hardening and may also be affected, although this has not yet been reproduced or documented by Microsoft.

This article explains the symptoms, the cause, and the recommended workaround using the IIS URL Rewrite Module.

Symptoms

After installing the SharePoint Server 2019 July 2026 Cumulative Update (KB5002883), provider-hosted SharePoint Add-ins (remote web applications) may stop working correctly.

Customers may experience one or more of the following symptoms:

• The provider-hosted add-in does not open.
• The add-in displays a blank page.
• The add-in stops during the authentication or redirect process.
• Configuration pages or other pages hosted by the remote web application fail to load.
• SharePoint redirects to /_layouts/15/appredirect.aspx, but the add-in never completes the redirect to the remote web application.
• Browser Developer Tools display an error indicating that the SharePoint page was blocked by the browser because of a Content Security Policy (CSP) violation.
• In some environments, the browser may instead report that the page was blocked because of the X-Frame-Options: SAMEORIGIN header.

The browser console typically contains an error similar to:

Refused to frame 'https://<sharepoint-site>' because an ancestor violates the following Content Security Policy directive: frame-ancestors ...

or

Refused to display 'https://<sharepoint-site>' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.

Cause

The July 2026 SharePoint Server 2019 Cumulative Update introduces a Content Security Policy (CSP) response header that restricts which websites are allowed to embed SharePoint pages.

The CSP contains a frame-ancestors directive that specifies the trusted parent sites.

A typical SharePoint response looks like this:

Content-Security-Policy:
frame-ancestors 'self'
teams.microsoft.com
*.teams.microsoft.com
*.skype.com
*.teams.microsoft.us
local.teams.office.com
*.powerapps.com
*.yammer.com
*.officeapps.live.com
*.office.com
*.stream.azure-test.net
*.microsoftstream.com
*.dynamics.com
*.microsoft.com
onedrive.live.com
*.onedrive.live.com;

During the launch of a provider-hosted SharePoint Add-in, SharePoint redirects the user. If the remote application is not included in the frame-ancestors list, the browser blocks the redirect page and the add-in cannot complete its startup process.

Solution

The recommended solution is to extend the existing frame-ancestors directive so that it also includes the URL of the provider-hosted application.

For example, if the provider-hosted application is hosted on: "https://wizdomintranet.global.com" the resulting CSP should become: 

frame-ancestors 'self'
teams.microsoft.com
*.teams.microsoft.com
*.skype.com
*.teams.microsoft.us
local.teams.office.com
*.powerapps.com
*.yammer.com
*.officeapps.live.com
*.office.com
*.stream.azure-test.net
*.microsoftstream.com
*.dynamics.com
*.microsoft.com
onedrive.live.com
*.onedrive.live.com
https://wizdomintranet.global.com;

This preserves SharePoint's security settings while allowing the provider-hosted application to complete the authentication and redirect process.

IIS URL Rewrite Workaround

Since SharePoint generates the CSP header dynamically, the recommended workaround is to use the IIS URL Rewrite Module to append the provider-hosted application's URL to the existing frame-ancestors directive.

Prerequisites

Install IIS URL Rewrite Module 2.1 on every SharePoint Web Front End server.

Microsoft Download: https://www.iis.net/downloads/microsoft/url-rewrite

Allow the response server variable

1. Open IIS Manager.
2. Select the SharePoint web application.
3. Open URL Rewrite.
4. Select View Server Variables.
5. Add the following server variable: "RESPONSE_Content_Security_Policy"

Add the outbound rule

Open the SharePoint web application's web.config file and add the following configuration under the existing system.webServer section. Replace: "https://wizdomintranet.global.com" with the URL of your own provider-hosted application.

<rewrite>
 <outboundRules>

   <rule name="Allow Provider Hosted Add-ins"
         preCondition="HtmlResponses"
         stopProcessing="true">

     <match
       serverVariable="RESPONSE_Content_Security_Policy"
       pattern="^(.*frame-ancestors\s+)([^;]*)(;?.*)$"
       ignoreCase="true" />

     <conditions>

       <add
         input="{RESPONSE_Content_Security_Policy}"
         pattern="https://wizdomintranet\.global\.com"
         negate="true" />

     </conditions>

     <action
       type="Rewrite"
       value="{R:1}{R:2} https://wizdomintranet.global.com{R:3}" />

   </rule>

   <preConditions>

     <preCondition name="HtmlResponses">

       <add
         input="{RESPONSE_CONTENT_TYPE}"
         pattern="^text/html"
         ignoreCase="true" />

     </preCondition>

   </preConditions>

 </outboundRules>
</rewrite>
 

Verify the Configuration

After applying the configuration:

1. Recycle the SharePoint application pool or restart IIS.
2. Open the SharePoint site.
3. Open the browser's Developer Tools (F12).
4. Select the Network tab.
5. Reload the page.
6. Inspect the response headers returned by the SharePoint site.

The Content-Security-Policy header should now include your provider-hosted application's URL.

For example:
Content-Security-Policy:
frame-ancestors 'self'
...
https://wizdomintranet.global.com;

The browser should no longer display the error:

Refused to frame 'https://<sharepoint-site>' because an ancestor violates the following Content Security Policy directive: frame-ancestors ...

and the provider-hosted add-in should open successfully.

Additional Information

• This workaround preserves SharePoint's existing Content Security Policy while allowing the trusted provider-hosted application.
• Only add trusted application URLs to the frame-ancestors directive.
• Apply the same configuration to every SharePoint Web Front End server in the farm.
• Future SharePoint updates may overwrite custom IIS configuration. Verify the rule after applying future cumulative updates.