OWA customization and development
What is supported and works differs in different versions of OWA. So, its important to be sure that you understand what is viable before customizing OWA or upgrading your servers.
Working with OWA content in an IFRAME:
Hosting full OWA in an IFRAME:
Hosting the whole OWA UI in an IFRAME is not supported, however you can use OWA Web Parts, which provide a workable view of a specified folder. OWA was never designed or tested for its full UI to be run in an IFRAME. I know some developers have chosen to do things like modify the Exchange JS files in order to rework frame targeting to get it to seemingly work in an IFRAME; however there are issues with doing that. First of all those files are part of the product install and never were meant to be modified and alterign them may cause unpredictable behavior. Secondly, if there are any issues with OWA then there is a good chance that Microsoft Support engineers will ask you to remove those modifications. Third, any hotfix rollup, service pack or version update may overwrite your changes. Fourth, what you modify may not exist in a future release - so, you may lose the ability to have the features you have implemented.
Hosting Outlook Web Access in an IFrame Is Not Supported
https://technet.microsoft.com/en-us/library/ee221162(EXCHG.80).aspx
When I find that developers are trying to host full OWA in an IFRAME its almost always a scenerio where they doing it to have OWA show inside of their portal and when that happens they almost always are doing custom single-sign-on using some soft of ISAPI filter or IIS module. That approach though is not supported.
Using ISAPI Extensions to change-out OWA Credential is not supported
https://blogs.msdn.com/b/webdav_101/archive/2007/05/04/using-isapi-extensions-to-change-out-owa-credential-is-not-supported.aspx
The story for SSO is better for Exchange Online:
Overview of single sign-on for Office 365
https://technet.microsoft.com/en-us/library/hh852486.aspx
Setting up AD FS and Enabling Single Sign-On to the NEW Office 365
https://office365support.ca/setting-up-ad-fs-and-enabling-single-sign-on-to-the-new-office-365/
Geek of All Trades: Office 365 SSO: A Simplified Installation Guide
https://technet.microsoft.com/en-us/magazine/jj631606.aspx
Office 365 integration with on-premises environments
https://support.office.com/en-ca/article/Office-365-integration-with-on-premises-environments-263faf8d-aa21-428b-aed3-2021837a4b65
OWA Web Parts:
OWA Web Parts a workable view of a specified folder. An OWA Web Part is basically a URL which can be used by a browser or IFRAME to render view the content of an OWA folder. The view again is for a specific folder and you cannot target a specific item in a folder by URL.
OWA Web Parts in an iFrame sample
https://blogs.msdn.com/b/webdav_101/archive/2012/07/06/owa-web-part-in-an-iframe-sample.aspx
Using Outlook Web App Web Parts (2010)
https://technet.microsoft.com/en-us/library/bb232199.aspx
How to Use Outlook Web Access Web Parts (2007)
https://technet.microsoft.com/en-us/library/bb232199(EXCHG.80).aspx
IFRAME protection features:
IFRAMEs are protected as a browser standard, so you won’t be able to alter what happens inside of the Web Part. Some developers want to modify OWAs behavior by modifying OWA's code by using code which adds script to its pages hosted in an IFRAME at run-time - this is not a supported approach.
There is a specific issue with using IFRAME in newer browser and that is that there is protection built into browsers now which helps protects against a type of attack called Click-Clicking. Exchange 2013 will emit an X-Frame-Options header when it renders OWA content. If your 2013 server is not configured then your OWA Web Part content will not be rendered.
OWA Web Parts not working in 2013 - "This content cannot be displayed in a frame
https://blogs.msdn.com/b/webdav_101/archive/2015/01/20/owa-web-parts-not-working-in-2013-quot-this-content-cannot-be-displayed-in-a-frame-quot.aspx
Mitigating framesniffing with the X-Frame-Options header
https://support.microsoft.com/kb/2694329
Combating ClickJacking With X-Frame-Options
https://blogs.msdn.com/b/ieinternals/archive/2010/03/30/combating-clickjacking-with-x-frame-options.aspx
Please note that OWA web parts from a shared Exchange Online server cannot be used in an IFRAME because all the needed settings to override click-jacking cannot be set. One of the needed settings would cover all users on the server and it would affect more than one company. If you want ant to use OA Web Parts in an IFRAME then you need to use a dedicated Exchange Online server or an on premise server.
Branding OWA:
There is some support for branding in Exchange Online:
Personalize your Office 365 experience by selecting themes
https://blogs.office.com/2014/09/02/personalize-office-365-experience-selecting-themes/
There are also options if your serves are on-premise Exchange 2013:
Create a theme for Outlook Web App
https://technet.microsoft.com/en-us/library/bb201700(v=exchg.150).aspx
Older Exchange branding:
Customizing the Look of Outlook Web Access
https://technet.microsoft.com/en-us/library/bb310750(v=exchg.80).aspx
Exchange Server 2010 Outlook Web App Customization SDK
https://msdn.microsoft.com/en-us/library/office/ee693018(v=exchg.140).aspx
Managing Outlook Web App Advanced Features (2010)
https://technet.microsoft.com/en-us/library/bb124348(v=exchg.141).aspx
Customizing views for items in a folder:
In Exchange 2013 and Exchange Online development is quite different than in older versions of Exchange. Now you can create custom mail apps which get displayed with the rendering of pages for standard message types. So, you can do things like add buttons to work off the currently loaded message.
Mail apps for Outlook
https://msdn.microsoft.com/en-us/library/office/fp161135.aspx
In older versions of Exchange you could create custom folders which would display custom web pages related to message class. Developers would need to create these pages and update config files to tie them together. The pages would use EWS to pull content for a folder and work with the items in it. There was no way to augment existing pages for standard message types.
Working with Outlook Web App Customization
https://msdn.microsoft.com/en-us/library/office/bb891801(v=exchg.140).aspx
Things not supported:
Using ISAPI Extensions to change-out OWA Credential is not supported
https://blogs.msdn.com/b/webdav_101/archive/2007/05/04/using-isapi-extensions-to-change-out-owa-credential-is-not-supported.aspx
"Enhancing Exchange" via unsupported methods.
https://blogs.msdn.com/b/webdav_101/archive/2013/06/13/quot-enhancing-exchange-quot-via-unsupported-methods.aspx
What Does "Unsupported" Mean?
https://blogs.msdn.com/b/pcreehan/archive/2007/05/04/what-does-unsupported-mean.aspx
Microsoft support policy for the customization of Outlook Web Access for Exchange
https://support.microsoft.com/en-us/kb/327178/
OWA Customization Update : Outlook Web Access (OWA) 2010 Support Policy
https://blogs.msdn.com/b/deva/archive/2010/04/25/update-outlook-web-access-owa-2010-support-policy.aspx
OWA Customization: PSS support policy for Exchange Server 5.5, 2000; 2003
https://blogs.msdn.com/b/deva/archive/2009/01/31/owa-customization-pss-support-policy-for-exchange-server-5-5-2000-2003.aspx
Also see:
About: Messaging APIs
https://blogs.msdn.com/b/webdav_101/archive/2015/08/07/about-messaging-apis.aspx