SharePoint shows a blank frame or a warning when you paste a flipbook embed code. This article explains the real causes, the exact admin settings that allow trusted domains, a step by step fix, and what to do when your tenant policy cannot change.
You paste the embed code, hit republish, and SharePoint answers with a grey box or a message saying embedding isn't allowed. It is a frustrating moment, especially when the interactive brochure you built in Flipbooks AI looks perfect everywhere else. The good news: this is almost never a bug. It is a security setting, and it can be changed by the right person in about five minutes.
This article walks through why SharePoint blocks the embed, who can fix it, the exact steps, and what to do if your IT team says no.
SharePoint Online treats every external iframe as a possible risk. An iframe loads a page from another domain inside your page, so Microsoft lets site owners decide which domains are trusted. If the domain of your flipbook is not on that list, the Embed web part refuses to render it.
The result is one of three symptoms:
💡 Pro tip: If the frame is blank only for some visitors, suspect a browser extension or a firewall rule. If it is blank for everyone, suspect the SharePoint domain list.
The control behind this behavior is called HTML Field Security. It lives in the site collection settings and lets administrators choose between blocking all external iframes, allowing only listed domains, or allowing any domain.
Some organizations also apply restrictions at the tenant level. In that case, a site owner cannot override the policy from their own site, and a SharePoint administrator has to make the change.
Occasionally the problem is not SharePoint at all. The page you embed can send headers that forbid being framed. A reliable flipbook host allows embedding by design, which is the whole point of the format.
Not everyone can change the setting. Here is the quick map of who does what.
| Role | Can add an Embed web part | Can change allowed domains | Can change tenant policy |
|---|---|---|---|
| Site visitor | No | No | No |
| Site member | Yes, if allowed | No | No |
| Site owner | Yes | Sometimes | No |
| Site collection admin | Yes | Yes | No |
| SharePoint admin | Yes | Yes | Yes |
If you are a site member and the option is greyed out, send the steps below to your site collection administrator. It saves a day of back and forth.
These steps apply to modern SharePoint Online sites. Menu labels shift slightly between releases, so use them as a map rather than a script.
If you do not see that link, you are not a site collection administrator. Ask one to follow these steps.
You will see a list of choices. The usual ones are:
Choose the second option. It keeps the policy tight while letting your flipbook through.
Paste the domain that hosts your flipbook into the list, without the https:// prefix or any path. Save the page. Use the domain exactly as it appears in the iframe src attribute of your embed code.
⚠️ Warning: Never choose "any domain" just to make the error vanish. It opens the site to every third party iframe a contributor might paste.
Changes can take a few minutes to apply, so give it time before assuming it failed.
The fix only matters if you have a flipbook to show. Here is how to create one in a few minutes.
Every flipbook is mobile responsive and has no watermarks, which matters on an intranet where a polished look builds trust.
| Option | Best for | Works in SharePoint |
|---|---|---|
| Iframe embed code | Intranet pages, news posts | Yes, after the domain is allowed |
| Direct link | Quick sharing in Teams or email | Yes, always |
| Link in a Quick Links web part | Locked down tenants | Yes, always |
| Downloadable PDF | Offline reading | Yes, as a file |
Before you escalate, run through this list. Half of all embed tickets come from one of these.
The Embed web part expects either a full iframe tag or a plain URL from a supported provider. Pasting a script tag will fail because scripts are filtered. Always use the iframe version.
SharePoint is served over https, and browsers block mixed content. If your embed points to an http address, it will not load.
The allowed list wants a domain, not a full address. Entering https://example.com/book/123 will not match. Enter example.com only.
A domain such as view.example.com is not covered by example.com unless your policy allows suffixes. Add the exact host you see in the iframe.
An old cached session can keep serving the previous policy. Try a private window before you change anything else.
✅ Best practice: Keep a short document listing every approved embed domain, who approved it, and the date. Audits become painless.
Some security teams refuse to allow external domains, and that is a valid decision. You still have working options.
A clear button or Quick Links tile that opens the flipbook in a new tab gives readers the same page turning experience. It also avoids the iframe rules completely. Readers on phones often prefer it because the flipbook fills the full screen.
Adding the flipbook link as a website tab inside Microsoft Teams is often allowed even where SharePoint iframes are not, because it follows a different policy path. Check with your administrator first.
Security teams respond well to specific requests. Bring them a short case:
A narrow request is far easier to approve than a general one.
| Approach | Setup time | Policy change needed | Reader experience |
|---|---|---|---|
| Embed with allowed domain | 10 minutes | Yes, one domain | Flipbook sits inside the page |
| Quick Links tile | 2 minutes | No | Opens in a new tab |
| Teams website tab | 5 minutes | Sometimes | Opens inside Teams |
| Attach PDF only | 1 minute | No | Static file, no page turning |
A few scenarios show how teams apply this.
An HR team keeps its handbook as a PDF that nobody opens. They turn it into a flipbook with the Training Manual Flipbook tool, embed it on the onboarding page, and new hires can flip through it on any device. When policies change, they update the source and the embedded link stays the same.
A sales director wants reps to browse the latest line during calls. The Digital Catalog Maker produces a flipbook, and the team pins it on the sales hub in SharePoint. Reps present it live on screen.
Finance publishes results to leadership only. They use a Corporate Report Maker flipbook with a password, and share the embed with a protected site so only the right people see it.
Allowing a domain does not mean opening the content to everyone. Layer your protection.
This mix gives security teams what they want and gives readers a smooth experience.
Run this list top to bottom. It resolves most cases.
If every answer is yes and the frame is still blank, ask your SharePoint administrator to check tenant settings and the browser console for a blocked frame message. That message usually names the exact rule that stopped the embed.
SharePoint blocks embeds on purpose, and with one approved domain you can show a polished flipbook right on your intranet page. Until then, a simple link works just as well.
Ready to create your first flipbook? Get started for free on Flipbooks AI. Browse all flipbook tools to find the right template for handbooks, catalogs, and reports, or compare pricing plans to pick the one that suits your team.
