Convert Microsoft Office files

The Conversion Service offers three options for converting Word, Excel, and PowerPoint documents to PDF:

Standard Converter (default): Converts Office documents without requiring Microsoft Office or any additional license. Works on both Windows and Docker.
Local Microsoft Office installation: Highest visual fidelity using Microsoft Office COM automation. Windows only.
Office for the web service: Cloud-based conversion using Microsoft Azure. Works on both Windows and Docker.

Choose a conversion method

Use the Standard Converter (default) if you:

Need Office conversion that works without additional setup or licenses out of the box.

Use the local Microsoft Office installation if you:

Require the highest visual fidelity with pixel-perfect layout preservation.
Need to convert large documents (more than 100 MB).
Want to process many large Excel files.
- Only the local installation option supports fit to page in Microsoft Excel.
- Microsoft Excel files with many sheets or hundreds of pages aren’t supported in the Office for the web service.
Must repair Word documents.
Work with password-protected documents.
Need to convert binary PowerPoint formats (PPT, PPS) or WordML/SpreadsheetML (XML-based) formats.
Need to use special or custom fonts.
- Fonts can be installed locally but not added to the web service.
- The web service includes more default fonts than a typical Windows server.
Keep data on-premise if required by security policies or if you require a lack of internet access.
- Web service conversions temporarily store files in the Azure cloud. Storage region depends on your subscription.

Use the Office for the web service if:

You’re converting smaller files (smaller than 100 MB), especially Word documents.
Files were created using Microsoft Office for the web.
You prefer lower setup and maintenance overhead.

Standard Converter (default)

The Standard Converter converts Word, Excel, and PowerPoint files without a Microsoft Office installation or license. It’s enabled by default on fresh installations.

Supported input formats

Microsoft Word: DOC, DOT, DOCX, DOCM, DOTX, DOTM, RTF
Microsoft Excel: XLS, XLT, XLSX, XLSM, XLTX, XLTM
Microsoft PowerPoint: PPTX, PPTM, PPSX, PPSM

Limitations

The Standard Converter doesn’t support:

Binary PowerPoint formats (PPT, PPS)
Password-protected or encrypted documents
WordML/SpreadsheetML (XML-based legacy formats)

For these formats, configure a local Microsoft Office installation or the Office for the web service.

Configuration options

Configure the Standard Converter in the Standard Converter Settings section in the Conversion Service Configurator. These settings are organized by document type:

Word Settings
- Track Changes (Redlining): When enabled, renders revision marks (insertions, deletions, and formatting changes) in the converted PDF.
Excel Settings
- Allow Scaling: When enabled, scales worksheet columns to fit on one page.

The Standard Converter automatically embeds fonts in the output PDF for consistent rendering across Windows and Docker (Linux).

Fonts in Docker

The Conversion Service Docker image includes fonts that cover common Office document fonts, including metric-compatible replacements for Calibri, Cambria, and other Microsoft Office fonts. Documents retain their original line breaks and page layout during conversion. If a font used in the document isn’t available, the Standard Converter automatically substitutes the closest available alternative.

Add custom fonts

If your documents use corporate or proprietary fonts, mount a font directory into the container:

docker run -dp 13033:13033 \
  -v /PATH_TO_YOUR_CUSTOM_FONTS:/usr/local/share/fonts/custom \
  pdftoolsag/conversion-service

Replace PATH_TO_YOUR_CUSTOM_FONTS with a path to your custom font. As a result, Standard Converter automatically detects fonts in /usr/local/share/fonts/custom at startup.

Local Microsoft Office installation

A local Microsoft Office installation is the pixel-perfect Office conversion option. Configure it only if the Standard Converter doesn’t meet your fidelity, format, or feature requirements.

caution

To comply with Microsoft licensing, each client submitting Word, Excel, or PowerPoint jobs must be licensed for Microsoft Office. For more information, see Licensing Microsoft Office software in Commercial Licensing on the Microsoft site.

If you want to convert files using local Microsoft Office installation, you must have a compatible version of Microsoft Office installed on the Conversion Service server:

Office version
Office 2021 (64-bit)
Office 2024 (64-bit)
Microsoft 365 (64-bit)

The supported language is English (United States). The Microsoft Print to PDF virtual printer must also be installed.

Microsoft Office version compatibility

For optimal conversion results, use the same Microsoft Office version that was used to create the documents. The Conversion Service only supports Microsoft Office 2021 and later.

Install and configure local Microsoft Office installation

During Microsoft Office setup, follow these steps and requirements:

Use a static license key (device-based license), especially with Microsoft 365. Avoid user logins to prevent dialog pop-ups that can interrupt processing.
After installation, activate the Office license.
Open sample Word, Excel, and PowerPoint files to confirm there are no blocking pop-ups.
If your documents rely on language features like hyphenation, install the required language packs.

Improve performance with Windows Defender exceptions

If Windows Defender is active, enabling the Windows Defender Rules setting in the Configurator may improve conversion speed. It adds exceptions for specific processes and folders to reduce scanning overhead.

Enable it under Conversion Service > Windows Defender Rules. Windows Defender in Configurator

Make sure group policies don’t override these exceptions.

Third-party antivirus software

Third-party tools like Bitdefender may block required operations. To guarantee successful conversion, you must add any application exceptions to your third-party antivirus software.

Set up on Windows

Assign a user account for the local Microsoft Office installation. You can either:

Recommended: Use automatically generated user account
Existing user account

Recommended: Use automatically generated user account

Unless restricted by security policies or domain controllers, let the Conversion Service Configurator create a ConvsrvOfficeUser account with a secure password.

The following settings are applied automatically:

Joins the Users group.
Has encrypted credentials saved through the Windows Data Protection API.
Grants the user Allow log on locally and Log on as a batch job security policies.
Has registry and DCOM permissions for Word, Excel, and PowerPoint.

To set up an automatically generated user account in the Configurator:

In the Conversion Service Configurator, go to the Conversion Service tab, and then find the Configuration section.
If the Standard Converter is configured, next to Office Conversion click Remove.
Next to Office Conversion, click Configure.
Select Local Office Installation and Automatically Create a User Account, and then click Next.
Click Apply, and then in the Changes detected dialog box, click Save & Restart Service.
ConvsrvOfficeUser appears in the username field with a random password. Click Apply.

note

The automatically generated user account is recommended for most servers unless specific security policies or domain controller restrictions apply. This is the case if:

Log on as a batch job security policy is applied.
Allow log on locally security policy is applied.
The server is managed by a domain controller.

Use an existing user account

Use this if your server has strict security rules or is managed through a domain controller.

Requirements:

Create the user account manually (local or domain). The Conversion Service Configurator does not modify this account.
Grant Allow log on locally and Log on as a batch job (or assign to a group with these rights).
Don’t assign admin privileges. Set up the user account with minimum user rights (don’t assign the user account to the Administrators group).
Update the configuration if the password changes or expires.

These properties and settings are set automatically:

The password is encrypted using the Windows Data Protection API before it is stored in a configuration file.
The registry and DCOM permissions for Word, Excel, and PowerPoint are adjusted.

caution

If using a domain user, disable any group policies enforcing regular password changes. Otherwise, you’ll need to reconfigure the Office setup each time the password changes.

To set up an existing user account in the Configurator:

In the Conversion Service Configurator, go to the Conversion Service tab, and then find the Configuration section.
If the Standard Converter is configured, next to Office Conversion click Remove.
Next to Office Conversion, click Configure.
Select Local Office Installation with an Existing User Account, and then click Next.
Enter the username and password for the user account. The Conversion Service accepts all standard formats for Windows users (both Username@domain and domain\Username formats). The Username is automatically resolved to ServerName\Username.
Click Apply, and then in the Changes detected dialog box, click Save & Restart Service.

Set up in Docker container

Send Office documents to another Conversion Service instance running on Windows. Office document conversion can be activated as follows:

Set up and run the service on Windows.
Enable Office Conversion in the Processing Steps section of your profile. Note that this is active by default.
When starting the Docker container, set the WINDOWS_SERVICE_ENDPOINT environment variable:
```
docker run -dp 13033:13033 ... \
  -e WINDOWS_SERVICE_ENDPOINT=http://server:13033/conversion/v1.0/rest \
  pdftoolsag/conversion-service
```
Note that if the Windows service uses HTTPS, its host certificate must be trusted by the Docker container. Otherwise, no connection can be established. By default, no trusted certificates are installed.
Copy trusted certificates to /usr/local/share/ca-certificates/.
Run the command update-ca-certificates.

Office for the web service

The Office for the web service option converts the documents using a Microsoft Azure Cloud service. Technologies used with this option include the Microsoft Authentication Library (MSAL), the Microsoft Graph API, and the Microsoft Sharepoint API.

The conversion flow:

Upload the file to the user’s OneDrive.
Convert the file to PDF.
Delete the uploaded file.

All connections use HTTPS. The service encrypts files before transmitting them over the internet.

caution

You need a valid license to allow the Conversion Service to convert Word, Excel, and PowerPoint documents. This means you must have:

Microsoft 365 for business subscription (Azure Cloud tenant) with a dedicated user account.
Microsoft 365 license for this dedicated user.

You should create a dedicated user account, as full control over this user’s OneDrive is requested.

Set up on Windows

Use the Configurator to set up the Office for the web:

In the Conversion Service Configurator, go to the Conversion Service tab, and then find the Configuration section.
If the Standard Converter is configured, next to Office Conversion click Remove.
Next to Office Conversion, click Configure.
Select Office for the web, and then click Next.
Enter the user account login (usually, an email address) for the Microsoft Office for the Web Service in the Username field.
Click Apply, and then in the Changes detected dialog box, click Save & Restart Service.
Sign in to the Microsoft 365 user account in the pop-up window that appears. Enter the password for the user account. If your company has set up 2-factor authentication, enter the authenticator code and click Verify.

Set up in Docker

Prerequisites

Before you start, you need:

An account for Microsoft Office for the web.
A Conversion Service profile with Office Conversion enabled. Most profiles have this option enabled by default. For more details, see Configure and export a profile.
A working Conversion Service Docker setup. For more details, see Conversion Service in Docker.

You can configure Office for the web in Docker with either Docker Compose or the docker run command. Use Docker Compose if you already manage the Conversion Service through docker-compose.yaml. Use docker run for standalone container setups or quick tests.

Set up using Docker Compose

Edit the docker-compose.yaml to add the Office for the web environment variables and a persistent volume for the authentication token cache:

volumes:
    vol-conversion-srv-app-data: {}
services:
    conversion-service:
        image: pdftoolsag/conversion-service:IMAGE_VERSION
        environment:
            LICENSEKEY: LICENSE_KEY_VALUE
            LICENSINGSERVICE: http://LGS_IP_ADDRESS:9999
            IMPORT_PROFILES: /etc/convsrv/PROFILE_EXPORT_FILE
            SERVICE__OFFICE__TYPE: OfficeWebService
            SERVICE__OFFICE__USERNAME: YOUR_OFFICE_USERNAME
        ports:
            - "13033:13033"
        volumes:
            - HOST_PROFILE_DIR/PROFILE_EXPORT_FILE:/etc/convsrv/PROFILE_EXPORT_FILE
            - vol-conversion-srv-app-data:/etc/convsrv

Replace the following:

IMAGE_VERSION: The Conversion Service version number (for example, 6.11.0, 6.11, or 6).
LICENSE_KEY_VALUE: The Conversion Service license key.
LGS_IP_ADDRESS: The IP address of the machine running the Licensing Gateway Service. Use 9999 as the recommended port.
HOST_PROFILE_DIR: The directory on the host machine that contains the exported profile (for example, C:/Users/john-doe/Desktop).
PROFILE_EXPORT_FILE: The filename of the exported profile (for example, ProfileExport-6.11.0.export).
YOUR_OFFICE_USERNAME: The Microsoft 365 account used for Office for the web conversion.

In the directory containing docker-compose.yaml, start the container:
```
docker compose up -d
```
List the running containers and copy the Conversion Service container ID:
```
docker ps
```
note
Each docker compose up -d generates a new container ID. Copy the current ID before running the next steps.
Grant the Conversion Service user access to the token cache volume:
```
docker exec -u root CONTAINER_ID_OR_NAME chown convsrv:convsrv /etc/convsrv/
```
Replace CONTAINER_ID_OR_NAME with the container’s name or ID.
Initialize the authentication token cache:
```
docker exec CONTAINER_ID_OR_NAME ./bin/csconfig office webinit
```
The output contains a sign-in URL and a one-time code.
Open the provided link, enter the code, and sign in with the account you set as SERVICE__OFFICE__USERNAME. If your organization requires multi-factor authentication, complete the prompt.

Set up using docker run

Enable Office Conversion in the Processing Steps section of your profile. This option is active by default.
Create a persistent volume to store the authentication token cache:
```
docker volume create --name convsrv-etc
```

Mount the volume, create the TokenCaches folder, and grant the Conversion Service user read and write access:

docker run --rm \
  --mount "type=volume,src=convsrv-etc,dst=/etc/convsrv" \
  --user root pdftoolsag/conversion-service \
  bash -c "mkdir /etc/convsrv/TokenCaches && chown convsrv:convsrv /etc/convsrv/TokenCaches"

Initialize the token cache by running the csconfig tool:

docker run \
  --mount "type=volume,src=convsrv-etc,dst=/etc/convsrv" \
  -e SERVICE__OFFICE__TYPE=OfficeWebService \
  -e SERVICE__OFFICE__USERNAME=myuser@myorganization.onmicrosoft.com \
  pdftoolsag/conversion-service \
  bash -c "bin/csconfig office webinit"

Start the Docker container with the token cache volume mounted and the required environment variables set:

docker run -dp 13033:13033 \
  --mount "type=volume,src=convsrv-etc,dst=/etc/convsrv" \
  -e SERVICE__OFFICE__TYPE=OfficeWebService \
  -e SERVICE__OFFICE__USERNAME=myuser@myorganization.onmicrosoft.com \
  pdftoolsag/conversion-service

Set SERVICE__OFFICE__TYPE and SERVICE__OFFICE__USERNAME to match the configured user and Office type.

Choose a conversion method​

Standard Converter (default)​

Supported input formats​

Limitations​

Configuration options​

Fonts in Docker​

Add custom fonts​

Local Microsoft Office installation​

Install and configure local Microsoft Office installation​

Set up on Windows​

Recommended: Use automatically generated user account​

Use an existing user account​

Set up in Docker container​

Office for the web service​

Set up on Windows​

Set up in Docker​

Set up using Docker Compose​

Set up using docker run​

Choose a conversion method

Standard Converter (default)

Supported input formats

Limitations

Configuration options

Fonts in Docker

Add custom fonts

Local Microsoft Office installation

Install and configure local Microsoft Office installation

Set up on Windows

Recommended: Use automatically generated user account

Use an existing user account

Set up in Docker container

Office for the web service

Set up on Windows

Set up in Docker

Set up using Docker Compose

Set up using docker run