BUG-000171016 for ArcGIS Online

Bug ID Number	BUG-000171016
Submitted	September 25, 2024
Last Modified	August 20, 2025
Applies to	ArcGIS Online
Version found	June 2024
Operating System	Windows OS
Operating System Version	10.0 64 Bit
Status	Will Not Be Addressed

Additional Information

Per investigation, this issue is from SharePoint (probably in their Nov 23 security update) and it is not from Experience Builder. - SharePoint has the Cross-origin resource sharing (CORS) policy and it does not support "'&'action=xxx" inside the URL anymore (it did before). If the same src is used inside a simple HTML iframe, and is put in a cross-domain server, the same behavior occurs. - YouTube does not have the Cross-origin resource sharing (CORS) policy and it still supports "'&'key=xxx" in a SRC. So their embed code works fine, e.g.:"". Thus, unfortunately, this is not a bug from Experience Builder, and cannot be fixed.

Workaround

Remove &amp from the embed code.

Example:

<iframe src="https://___-my.sharepoint.com/personal/<userID>/_layouts/15/Doc.aspx?sourcedoc=%7B____________%7D&~~amp;~~action=embedview&wdAr=1.7777777777777777" width="476px" height="288px">This is an embedded</iframe>

The altered code looks like the one below.

<iframe src="https://___-my.sharepoint.com/personal/<userID>/_layouts/15/Doc.aspx?sourcedoc=%7B__________%7D&action=embedview&wdAr=1.7777777777777777" width="476px" height="288px">This is an embedded</iframe>