Microsoft Viva

Overview

Microsoft Viva is an employee experience platform that integrates into Microsoft 365 to deliver engagement, learning, knowledge, and workplace analytics features. When it appears on a website, it is typically powering embedded content feeds, learning modules, or knowledge cards served to authenticated employees. Viva components load from Microsoft's cloud infrastructure and require user identity for personalization.

What This Script Does

Microsoft Viva scripts load modular components from Microsoft's cloud endpoints, primarily under *.microsoft.com and *.office.com domains. The platform sets authentication cookies tied to Microsoft Entra ID (formerly Azure AD) to verify the user's identity and organizational membership. These include session tokens stored as secure, HttpOnly cookies that persist across page navigation.

Viva modules may make network requests to Microsoft Graph API endpoints to retrieve personalized content — such as learning course recommendations, engagement feed posts, or knowledge topic cards. Data collected is scoped to the authenticated user's organizational context: employee profile information, content interaction events (views, clicks, completions), and session telemetry for platform health monitoring.

No cross-site advertising cookies are set. Viva does not participate in ad networks or share data with third-party marketing platforms. The cookies and tokens it stores are strictly for maintaining authenticated sessions and delivering personalized workplace content within the organization's Microsoft 365 tenant.

Consent & Compliance

Microsoft Viva is classified as functional. Its scripts deliver workplace features that users or their organization have opted into — learning content, engagement modules, and knowledge surfaces. It does not perform advertising, behavioral profiling for marketing, or cross-site tracking.

Under the GDPR, Viva's data processing is typically governed by the organization's data processing agreement with Microsoft. The legal basis is usually legitimate interest or contract performance (the employer providing workplace tools). Individual website consent banners are less relevant because Viva is consumed by authenticated employees within an organizational context, not anonymous visitors.

Under the ePrivacy Directive, the cookies Viva sets for authentication and session management qualify as strictly necessary for the service the user has requested (accessing workplace content), which exempts them from the consent requirement under Article 5(3).

Under CCPA/CPRA, Viva does not sell or share personal information for cross-context behavioral advertising. Data processing is limited to the employer-employee relationship and Microsoft's role as a service provider under the organization's contract.

Should You Block This Without Consent?

No. Microsoft Viva operates as a functional workplace tool that requires authentication cookies to deliver its core service. Its cookies are strictly necessary for the requested functionality, and it does not perform advertising or cross-site tracking. Blocking it would break embedded employee experience features without any privacy benefit.