# SharePoint and OneDrive Won't Open Your HTML File

Canonical: https://commareports.com/sharepoint-html-preview
Published: 2026-08-29

> Modern SharePoint blocks custom script, so .html in a document library downloads instead of rendering. Why NoScript is on by default, why turning it off is the wrong fix, and what to do instead.

# SharePoint and OneDrive won't open your HTML file

You put the report in a document library, sent the link, and your
colleague got a download prompt. Or a preview pane that shows the file
name and nothing else.

It isn't a permission you forgot to grant.

## What's blocking it

Modern SharePoint sites and OneDrive ship with **custom script disabled**
— the setting usually referred to as NoScript. With it off, an `.html`
file in a document library is served as a file to download, not as a page
to visit. Microsoft made this the default deliberately, and applies it to
newly created sites on an ongoing basis.

The reason is worth understanding, because it also explains why the
obvious fix is a bad one. A rendered HTML file in a SharePoint library
runs **in your tenant's origin**, with the signed-in user's session
attached. Anything in that file can read what that user can read. That is
a very large amount of trust to extend to a coverage report someone
generated on a laptop.

So: yes, a tenant admin can enable custom scripting on a site collection
and the file will render. And no, you almost certainly should not ask them
to, for a report.

## The other half of the problem

Even with rendering enabled, most tools that produce "an HTML report"
produce a **folder** — `index.html` plus a sibling directory of CSS,
JavaScript and JSON. Playwright, Allure, `nbconvert`, `genhtml`, Sphinx
and Storybook all do. Upload the single file and every reference in it
resolves to nothing. See
[why the report lost its CSS](/html-report-broken-css).

## The fix: publish it somewhere isolated

Drag the file — or the whole output folder, or a zip — into
[Comma](https://commareports.com/):

- `index.html` becomes the report body.
- Sibling assets upload with it, and relative `src`/`href` references are
  rewritten to the uploaded copies.
- Scripts run inside a **sandboxed iframe** (`allow-scripts`, no
  `allow-same-origin`). The report gets to be interactive; it does not get
  access to anyone's session, cookies or storage. That is the containment
  boundary SharePoint's NoScript default is trying to preserve, applied
  per-report instead of per-tenant. See the
  [security model](https://commareports.com/security).

## Keeping it internal

Access is set per report: private to you, your team, anyone signed in at
your domain, or anyone with the link — with view, comment or edit rights
for link holders. Domain-gated is usually the right setting for the report
that would otherwise have lived in a document library. Full model in
[sharing & access control](/docs/sharing).

## From a pipeline, if it regenerates

```bash
curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html report.html '{html: $html}')"
```

One saved report id, a revision per run, one permanent URL — including
from Azure DevOps, which is likely where the pipeline already lives. See
[Azure DevOps HTML reports](/ci/azure-devops-html-report) and
[API tokens](/docs/api-tokens).

## Then: comment instead of forwarding

Once it has an address, review happens on the report. Select the figure,
leave a thread, and it stays anchored there across revisions — instead of
a fork of the file per reviewer and a chain of replies in Outlook. See
[commenting on HTML](/comment-on-html), and
[share an HTML report in Teams](/share-html-report-in-teams) for the
unfurled-link version.

## Limits

- **Entry HTML: 5 MB.** Assets: 25 MB per file, 250 MB and 500 files total.
- **Scripts run, sandboxed** — no same-origin access to your session.
- **60 requests/minute per token.**

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited
revision history.

**[Publish your HTML report →](https://commareports.com/)**

### Related

- [Google Drive won't render HTML](/share-html-file-google-drive) · [Dropbox stopped rendering HTML](/dropbox-html-preview)
- [Share an HTML report in Teams](/share-html-report-in-teams)
- [Embed a report in Confluence](/embed-html-report-in-confluence)
- [Host an HTML file](/host-html-file)