Office Web Apps Server uses the same minimum hardware requirements as SharePoint Server 2013. You can find the full set of SharePoint 2013 requirements in Hardware requirements—web servers, application servers, and single server installations. Additional scalability guidance will be provided in future updates to this article.

You can run Office Web Apps Server on the following operating systems:

• The 64-bit edition of Windows Server 2008 R2 Service Pack 1 (SP1) Standard, Enterprise, or Datacenter with KB2592525 installed

• The 64-bit edition of Windows Server 2012 Standard or Datacenter

Important:
We recommend that you install Windows Server service packs and cumulative updates as they become available. However, at this point, the only required update is KB2592525 for servers that run Windows Server 2008 R2 SP1.

All servers in the Office Web Apps Server farm must be part of a domain. They can be in the same domain (best practice) or in domains that are in the same forest.

Caution:
Do not install Office Web Apps Server on a domain controller.

Before we describe what to install on your servers, we have to tell you what not to install. Review these guidelines carefully:

• Servers that run Office Web Apps Server must not run any other server application . This includes Exchange Server, SharePoint Server, Lync Server, and SQL Server. If you have hardware constraints, you can run Office Web Apps Server in a virtual machine instance on one of these servers.

• Do not install any services or roles that depend on the Web Server (IIS) role on port 80, 443, or 809 because Office Web Apps Server periodically removes web applications on these ports.

• Do not install any version of Office . You must uninstall Office before you install Office Web Apps Server.

• Do not install Office Web Apps Server on a domain controller . Do not install Office Web Apps Server on a Windows Server that is running Active Directory Domain Services (AD DS).

Now we'll cover what you must install. The details are described in the following table.

Downloads, server roles, and features that are required for Office Web Apps Server

Download, Server Role, or Feature	Windows Server 2008 R2	Windows Server 2012
Download : Office Web Apps Server	Microsoft Download Center	Microsoft Download Center
Download : .NET Framework 4.5	.NET Framework 4.5	Already installed
Download : KB2592525	KB2592525	Already installed
Download : Windows PowerShell 3.0	Windows PowerShell 3.0	Already installed
Server role : Web Server (IIS)	The following list describes the minimum role services that are required for the Web Server (IIS) server role. Common HTTP Features Static Content Default Document Application Development ASP.NET .NET Extensibility ISAPI Extensions ISAPI Filters Server Side Includes Security Windows Authentication Request Filtering Management Tools IIS Management Console The following options are recommended but not required: Performance Static Content Compression Dynamic Content Compression	The following list describes the minimum role services that are required for the Web Server (IIS) server role. Management Tools IIS Management Console Web Server Common HTTP Features Default Document Static Content Security Request Filtering Windows Authentication Application Development .NET Extensibility 4.5 ASP.NET 4.5 ISAPI Extensions ISAPI Filters Server Side Includes The following services are recommended but not required: Performance Static Content Compression Dynamic Content Compression
Feature : Ink and Handwriting Services	Ink and Handwriting Services Ink Support	Ink and Handwriting Services Note: You don’t have to install Ink Support. You can just install Ink and Handwriting Services

Microsoft IT uses the following topology, which can support up to 200,000 users, based on our testing. In this topology, Office Web Apps Server functionality is deployed by using the following components and services:

• 10 datacenter class servers that are running Office Web Apps Server.

  • Supported operating systems: Windows Server 2008 R2 and Windows Server 2012.

  • RAM: 24 Gigabytes (GB)

  • Processor: Intel Xeon Processor E7 (16 core).

  • Office Web Apps Server is installed on the servers' system drive.

  • All servers are in a single Office Web Apps Server farm.

  • All servers that are in the Office Web Apps Server use identical configurations. The default out-of-the-box Office Web Apps Server configuration settings are used.

  • No Office Web Apps Server server roles are configured.

  • The servers that run Office Web Apps Server are located in the corporate network behind a hardware load balancer.

  • The servers that run Office Web Apps Server are joined to the corporate domain and are in a single Active Directory Domain Service organizational unit (OU) for operational purposes.

  • IPsec is not being used in these computers. Group Policy is applied to exclude IPsec. This is necessary to allow unblocked communications between the servers that run Office Web Apps Server in the corporate network.

• The hardware load balancer (HLB) is dual-homed. The HLB has access to the Internet and to the corporate network. When the Office Web Apps Server farm is configured, the external URL is bound to the virtual IP (VIP) of the external-facing HLB, and the internal URL is bound to the VIP of the internal-facing HLB.The HLB in this topology example uses soft affinity, which relies on Layer 7 load balancing to distribute requests based on the data in application layer protocols such as HTTP. Using soft affinity means that requests for any specific session are routed to the same front end.

  • On the Internet side, a VIP address is used to publish the WAC service over SSL on TCP port 443. This is an Internet-routable IP address that has appropriate permissions and policies in the Internet-facing firewall. This IP space is advertised through a public DNS so that it can be accessed from the Internet.

  • The corporate network side of the HLB communicates directly with the servers that run Office Web Apps Server. An internal VIP and internal DNS entries are used for internal corporate traffic. The following table lists the DNS names and VIP addresses that are used in the example topology for internal and external traffic. The xxx.xxx.xxx.xxx and yyy.yyy.yyy.yyy are placeholders for actual VIP addresses.

    DNS names and VIP addresses examples

    DNS	VIP address	Description
    Officewebapps.extranet.contoso.com	xxx.xxx.xxx.xxx	External facing SSL endpoint
    Officewebapps.corp.contoso.com	yyy.yyy.yyy.yyy	Internal facing SSL terminated endpoint

  • The HLB is configured to make HTTP requests to each server in the farm to ensure that IIS is running. Unresponsive servers are removed from rotation.

The following illustration shows the topology example that includes an Office Web Apps Server farm, a dual-homed hardware load balancer and firewall, Exchange Server 2013, Lync Server 2013 and SharePoint 2013 hosts, and clients.

Based on our performance tests, an Office Web Apps Server, togetherwith two Intel Xeon processors (8 cores), 8 GB of RAM, and a 60 GB hard disk, should support up to 10,000 users where most of the usage is viewing. A server that has a 16 core CPU and 16 GB of Ram should support up to 20,000 users. These results will vary, depending on usage patterns and other factors such as network hardware.

Office Web Apps Server can communicate with SharePoint 2013, Lync Server 2013, and Exchange Server 2013 by using the HTTPS protocol. In production environments, we strongly recommend that you use HTTPS. You’ll have to have to install an Internet Server certificate that can be assigned to the server that runs Office Web Apps Server (if you are using a single server) or to the load balancer (if you are using multiple servers that run Office Web Apps Server).

In test environments that contain no user data, you can use HTTP for SharePoint 2013 and Exchange Server 2013 and skip the certificate requirement. Lync Server 2013 supports only HTTPS.

Caution:
Use of HTTP exposes any data viewed by using Office Web Apps Server to security vulnerabilities. HTTPS is a core part of the security of Office Web Apps Server and we highly recommend that you use it.

Certificates that are used by Office Web Apps Server must meet the following requirements:

• The certificate must come from a trusted Certificate Authority and include the fully qualified domain name (FQDN) of your Office Web Apps Server farm in the SAN (Subject Alternative Name) field. (If the FQDN is not in the SAN when you try to use the certificate, the browser will either show security warnings or won’t process the response.)

• The certificate must have an exportable private key. On single-server farms, this option is selected by default when you use the Internet Information Services (IIS) Manager snap-in to import the certificate.

• The Friendly name field must be unique within the Trusted Root Certificate Authorities store. If you have multiple certificates that share a Friendly Name field, farm creation will fail because the New-OfficeWebAppsFarm cmdlet will not know which of those certificates to use.

• The FQDN in the SAN field must not begin with an asterisk (*).

• The certificate properties and extensions do not matter. For example, customers have asked us whether Client Enhanced Key Usage (EKU) extensions or Server EKU extensions are required. Office Web Apps Server requires no particular certificate property or extension.

Additionally, the certificate must be imported as follows:

• For single-server farms    You must import the certificate directly on the server that runs Office Web Apps Server. Don’t bind the certificate manually. The New-OfficeWebAppsFarm cmdlet that you run later will do this for you. If you bind the certificate manually, it will be deleted every time that the server restarts.

• For load-balanced farms    If you are offloading SSL, the certificate must be imported on the hardware load balancer. If you are not offloading SSL, you must install the certificate on each server in the Office Web Apps Server farm.

Note:
Don’t use self-signed certificates except in non-critical test environments.

For more information about certificates, see How to Obtain an SSL Certificate.

When you set up a new Office Web Apps Server farm, SSL offloading is set to off by default. When SSL is offloaded, it allows each Office Web Apps Server in the farm to communicate by using HTTP with the load balancer. However, all references to resources in the HTML are HTTPS references. If you don't set this and you try to use HTTP, users will not be able to see resources or they will see security warnings. When offloading is set to off, SSL terminates at the individual servers that run Office Web Apps Server instead of the hardware load balancer. If you terminate SSL at the load balancer instead, it provides the following advantages:

• Simplified certificates management

• Improved soft affinity

• Improved performance

Traffic from the load balancer to the servers that run Office Web Apps Server is not encrypted, so you need to make sure that the network itself is secure. Use of a private subnet can help protect traffic.

You can prevent unauthorized servers from joining an Office Web Apps Server farm by creating an organizational unit for those servers and then specifying the FarmOU parameter when you create the farm. See the article New-OfficeWebAppsFarm for more information about the FarmOU parameter.

The Allow List is a security feature that prevents unwanted hosts from connecting to an Office Web Apps Server farm and using it for file operations without your consent. By adding the domains that contain approved hosts to the Allow List, you can limit the hosts to which Office Web Apps Server allows file operations requests, such as file retrieval, metadata retrieval, and file changes.

You can add domains to the Allow List after you have created the Office Web Apps Server farm. See the article New-OfficeWebAppsHost to learn how to add domains to the Allow List.

Important:
If you do not add domains to the Allow List, Office Web Apps Server allows file requests to hosts in any domain. Do not leave this list blank if your Office Web Apps Server farm can be accessed from the Internet. Otherwise anyone can use your Office Web Apps Server farm to view and edit content.

Files that are intended to be viewed through a web browser by using Online Viewers must not require authentication. In other words, the files must be available publicly because Online Viewers can’t perform authentication when it is retrieving files. We strongly recommend that the Office Web Apps Server farm that you use for Online Viewers is only able to access either the Intranet or the Internet, but not both. This is because Office Web Apps Server does not differentiate between requests for Intranet and Internet URLs. If a request comes from the Internet for an Intranet URL, for example, a security leak might occur if an internal document is served to somebody on the Internet.

For the same reason, if you have set up the Office Web Apps Server to connect only to the Internet, we strongly recommend that you disable UNC support in Online Viewers. To disable UNC support, set the OpenFromUncEnabled parameter to False by using the Windows PowerShell cmdlets New-OfficeWebAppsFarm (for new farms) or Set-OfficeWebAppsFarm (for existing farms).

As an additional security precaution, Online Viewers are limited to viewing Office files that are 10mb or less.

You can configure Online Viewers by using the following Windows PowerShell parameters in New-OfficeWebAppsFarm (for new farms) or Set-OfficeWebAppsFarm (for existing farms).

• OpenFromUrlEnabled    Turns the Online Viewers on or off. This parameter controls Online Viewers for files that have URL and UNC paths. By default, this parameter is set to False (disabled) when you create a new Office Web Apps Server farm.

• OpenFromUncEnabled    When Online Viewers are turned on (set to True by using OpenFromUrlEnabled), this parameter turns on or off the ability for Online Viewers to display files in UNC paths. By default, this parameter is set to True, but be sure that OpenFromUrlEnabled is also set to True before you enable opening files from UNC paths. As described earlier, we recommend that you set this parameter to False if you have set up Office Web Apps Server to connect to the Internet.

• OpenFromUrlThrottlingEnabled    Throttles the number of open from URL requests from any given server in a time period. The default throttling values, which are not configurable, make sure that an Office Web Apps Server farm does not overwhelm a single server by sending requests for content to be viewed in the Online Viewers.