Guide
Host an HTML file on SharePoint, Teams, OneDrive or Confluence
Updated 30 October 2026
SharePoint Online does not run an .html file in the browser: it downloads it or shows its raw content. Microsoft’s workaround is to rename the file to .aspx, which works only when a site owner renames it on a site where a SharePoint admin has allowed custom script, and that permission resets within 24 hours. Teams and OneDrive keep their files in SharePoint, so the same applies there. If all you need is “everyone at the company can open this page”, publish it on ashare.net for your company’s email domain, with no SharePoint admin involved.
Why SharePoint downloads your HTML file
SharePoint Online opens files in what Microsoft calls the strict model. A file that may carry script, like an HTML page, is not executed in the browser. It is downloaded, or the modern document library shows its raw content as a preview. The permissive model, which ran HTML from a library, is gone: Microsoft moved every tenant to strict on December 31, 2018, and there is no setting to switch back.
So when you upload report.html to a library and send the link, readers get a download or a page of markup, not the report.
The .aspx rename and what it needs
Microsoft’s documented fix is to rename .html or .htm to .aspx. The renamed file opens as a page again, if all of this holds:
- The right person renames it. The rename takes the Add and Customize Pages permission, which site owners and site collection admins have by default. If a member with Edit permission renames the file, the .aspx is not marked for execution and still downloads.
- Custom script is allowed on the site. Modern team sites and communication sites have the “noscript” feature on, so nobody there has that permission. While custom script is blocked, .aspx files can’t even be uploaded, copied, moved or opened in a library.
- A SharePoint Administrator allows it, briefly. They change Custom scripts for the site in the SharePoint admin center, or run the command below. Microsoft sets it back to “Not allowed” within 24 hours.
- Nobody edits the file later. Each change marks it as non-executable again, so a new version of the report means another round with the admin.
Connect-SPOService -Url https://contoso-admin.sharepoint.com
Set-SPOSite https://contoso.sharepoint.com/sites/reports -DenyAddAndCustomizePages 0Microsoft also notes that in the modern library a renamed file may open wrongly the first time and work on the second. The rename fixes most relative links between renamed files, but not links built by JavaScript or links to another site collection.
For a page that has to live inside Microsoft 365 and rarely changes, this route works. For a report your agent regenerates every week, it is a standing request to IT.
Teams and OneDrive
Teams has no file storage of its own. Files on a channel’s Files tab are stored in the team’s SharePoint site; files you send in a chat are stored in your OneDrive for Business and shared with the people in that chat. An HTML file in Teams therefore behaves as it does in SharePoint: readers download it.
OneDrive is stricter still. Microsoft says custom script can’t be allowed on an individual user’s OneDrive, so the .aspx route is closed there.
Confluence
Confluence Data Center has an HTML macro, but it is disabled by default. A Confluence Administrator or System Administrator has to enable it, and Atlassian warns that this can open the site to cross-site scripting.
Confluence Cloud doesn’t let you create user macros, because they allow HTML and JavaScript to run; Atlassian points to Marketplace apps for custom macros. What Cloud has built in is the iFrame macro. It embeds a webpage by URL, so the HTML has to be hosted somewhere first, and a site that forbids framing shows up blank.
The options side by side
| Where | Does the page run | What it takes |
|---|---|---|
| SharePoint library | No, it downloads or shows raw content | Nothing; readers open the file from their disk |
| SharePoint, renamed to .aspx | Yes | A site owner, custom script allowed by an admin for up to 24 hours, again after each edit |
| Teams channel or chat | No, same as SharePoint or OneDrive | Nothing |
| OneDrive | No | Custom script can’t be allowed there |
| Confluence Data Center | Yes, in the HTML macro | An admin enables the macro |
| Confluence Cloud | Only from a URL, in the iFrame macro | The HTML hosted elsewhere, or a Marketplace app |
| ashare.net | Yes, in a sandbox on its own host | Your work email; access set per document |
A link for your company, without a SharePoint admin
On ashare.net the file runs as a page, and you choose who opens each document. Sign in with your work email. If nobody on your domain has an organization yet, you get one named after the domain, with a 30-day trial and no card.
- Upload the HTML file, or a ZIP of a small site with
index.html, on My documents. An agent can publish it for you instead: connect it once. - Under Access, pick Company. Everyone who signs in with an email on your company’s domain opens it. You can add up to 100 people from outside by email.
- Paste the link in Teams, Outlook or Confluence. Readers type their work email and a 6-digit code from the letter, or sign in with Microsoft. Nobody creates an account or a password.
Someone off the list sees “You don’t have access” and can ask you in. For company documents you also see who opened it and when. Readers can select text and comment, and each fix goes up as a new version at the same link, so the message in Teams never points to an old copy. See Organizations and Sharing and access.
To show the page inside a Confluence Cloud page with the iFrame macro, the document has to be public: readers can’t sign in inside someone else’s site. Then allow your Confluence site, or any site, under Embedding on the document page. For a company-only page, put the link in Confluence instead.
When SharePoint is the better choice: if your policy says files stay inside your Microsoft 365 tenant, use the .aspx route with your admin. ashare.net stores documents on its own servers, which may be outside the EU; see Privacy.
ashare.net: your agent publishes HTML or Markdown and you choose who opens it: your company, specific emails or a password. Readers comment, the agent fixes the document.
Connect your agent