SharePoint Custom Scripts

December 25, 2025

Microsoft is proceeding with the staged retirement of custom scripts across SharePoint Online and OneDrive. Here is what an admin needs to know.

Quick Introduction to SharePoint “custom scripts”

In SharePoint, “custom scripts” broadly refers to client‑side code (Javascript) added to pages. Custom scripts were actively used for sites customizations, and still present in “classic” features (like “script editor web part”). Today Microsoft consider custom scripting in SharePoint Online as a Security risk. Custom scripts can execute with the current user’s permissions, making it hard to govern what code runs, who added it, and where it loads resources from—opening doors to script injection, XSS, and compliance/performance issues. See more here.

When custom script is blocked, SharePoint disables numerous features (Script/Content Editor, “Save as template,” sandbox solution upload, certain file types, SharePoint Designer operations, etc.), while previously created items continue to function.

Historically, this was common in classic SharePoint experiences and early SharePoint Online, but Microsoft has steadily constrained it to reduce risk. Modern team/communication sites, OneDrive, and even the root site block custom scripts by default. Microsoft’s guidance encourages migrating to the SharePoint Framework (SPFx). Microsoft tightened policy further in 2024 by removing the easy tenant toggles and expiring the DelayDenyAddAndCustomizePagesEnforcement workaround, making persistent enablement impractical.

In 2025, classic publishing site templates were set to have custom script disabled by default and new classic publishing sites/feature activation were blocked, with temporary opt‑outs only until March 15, 2026.

In 2025, Microsoft also introduced a way to update site property bag values without turning on custom script—further reducing reasons to flip that switch

Looking ahead, SharePoint Online is rolling out Content Security Policy (CSP): tenant admins can now set trusted script sources for modern pages, and enforcement moves from report‑only to full blocking on March 1, 2026, which will impact any customization that loads scripts from untrusted CDNs.

So let me give you a deep technical overview Of the depreciation of custom scripting in SharePoint online along with the most recent developments

Today’s status and the Future of custom scripting in SharePoint Online

You can still see the following setting in the SharePoint online modern admin center custom scripting blocked or allowed the scripting setting in the classic SharePoint online admin center has been removed

Summary of key changes Microsoft is proceeding with the staged retirement of custom scripting across SharePoint online and OneDrive

Key updates include

removal of the custom scripting setting from the classic SharePoint admin center (March 2024)
introduction of the “DelayDenyAddAndAustomizePagesEnforcement” PowerShell parameter allowing temporary postponement of enforcement until mid November 2024
After enforcement administrators may temporarily enable custom script on specific sites for 24 hours using Set-SPOSite -DenyAddAndCus… . This scope is limited and requires repeated enabling

Upcoming major enforcement milestones new lane

Mid-January 2026 App catalog governance enforcement

custom scripting will be disabled by default for the SharePoint online app catalog
existing scripts will continue functioning but new script development modification require a 24 hour temporary enablement window
app operations such as uploading updating deploying SPFx and office apps remain unaffected

September 15 2025 (classic publishing and template enforcement)

Per MC 1117115 updates found in SharePoint custom script deprecation and web search results. Custom scripting is disabled by default for classic publishing templates

blankInternetContainer
CMSpublishing
BlankInternet
CSPcontainer Creation of new classic publishing sites is blocked (UI/API) publishing feature activation is prevented existing classic publishing sites remain fully functional but operate under no script restrictions

New technical capabilities introduced

Property back updates without allowing custom scripts
Microsoft introduced a new configuration option AllowWeb property back update when deny add and customize age is enabled that allows property bag manipulation without disabling no script mode. This applies at both site and tenant level.

This is a major governance improvement enabling modern customization without reopening scripting vulnerabilities

Improved administrative controls

Microsoft recommends transitioning customization to supported models

Sharepoint framework is SPFX
Power platform (power apps, power automate, power BI)
Power pages
PnP templates, APIs
Site designs and site scripts

These alternatives offer secure supportable and scalable approaches to customization

Impact on your organization carriage return

Administrators

Cannot permanently enable custom scripts post enforcement
Temporary enabling 24 hours requires continuous reauthorization
Must prepare for loss of classic features including
- Script editor and content editor web parts
- Custom master pages, page layouts
- Sandbox solution updates
- Sharepoint designer modifications (severely restricted)

Users and site owners

No ability to upload certain file types, such as .aspx .ascx .swf .xap
Save site as template, solution gallery, theme gallery, and other legacy features become unavailable
Existing scripts continue to operate but cannot be modified without temporary scripting enablement

Recommended customer actions

Inventory existing scripts and identify areas using classic web parts master pages or designer customizations
Modernize customizations by moving to SPFx, powerapps, site scripts or PnP solutions
Plan for 24 hour enablement window if future modifications are needed
Educate site owners on feature removals and modern alternatives
Review governance policies to ensure alignment with these enforcement timelines


$pnpTenantSite = Get-PnPTenantSite -Connection $connectionAdmin -Identity $siteUrl -Detailed
$pnpTenantSite | Select-Object Url, Template, DenyAddAndCustomizePages, SensitivityLabel, Owner | fl

Set-PnPTenantSite -Identity $siteUrl -Connection $connectionAdmin -DenyAddAndCustomizePages:$false
Set-PnPTenantSite -Identity $siteUrl -Connection $connectionAdmin -DenyAddAndCustomizePages:$true

$tenant = Get-PnPTenant -Connection $connectionAdmin
$tenant.AllowWebPropertyBagUpdateWhenDenyAddAndCustomizePagesIsEnabled



$connectionSite = Connect-PnPOnline -ReturnConnection -Url $siteUrl -ClientId $clientid -Tenant $tenantId -Thumbprint $thumbprint
$connectionSite.Url
# Get-PnPPropertyBag -Connection $connectionSite -Key "SiteSearchClassification" # RefinableString08 aka SiteSearchClassification
Get-PnPPropertyBag -Connection $connectionSite -Key "SiteCustomSubject" # RefinableString09 aka SiteCustomSubject
Get-PnPPropertyBag -Connection $connectionSite -Key "SiteCustomProperty" # RefinableString09 aka SiteCustomSubject

Set-PnPAdaptiveScopeProperty -Key "SiteCustomProperty" -Value "TestSite" -Connection $connectionSite
Request-PnPReIndexWeb -Connection $connectionSite 




PS C:\Users\Vlad\code\m365-PowerShell> Set-PnPPropertyBagValue -Key "SiteCustomSubject" -Value "Test" -Indexed:$true -Connection $connectionSite

Confirm
The current site is a no-script site. Do you want to temporarily enable scripting on it to allow setting property bag value?
[Y] Yes  [N] No  [S] Suspend  [?] Help (default is "Y"): y


# user

PS C:\Users\Vlad\code\m365-PowerShell> 
PS C:\Users\Vlad\code\m365-PowerShell> Get-PnPTenantSite -Identity $siteUrl
Get-PnPTenantSite: Unable to connect to the SharePoint Online Admin Center at 'https://s5dz3-admin.sharepoint.com' to run this cmdlet. If this URL is incorrect for your tenant, you can pass in the correct Admin Center URL using Connect-PnPOnline -TenantAdminUrl. If you are using Privileged Identity Management (PIM) on your tenant, please ensure you have activated at least the SharePoint Administrator role and allowed some time for it to activate. Error message: Attempted to perform an unauthorized operation.


PS C:\Users\Vlad\code\m365-PowerShell> 
PS C:\Users\Vlad\code\m365-PowerShell> Set-PnPAdaptiveScopeProperty -Key "SiteCustomSubject" -Value "Test2"
Set-PnPAdaptiveScopeProperty: Unable to connect to the SharePoint Online Admin Center at 'https://s5dz3-admin.sharepoint.com' to run this cmdlet. If this URL is incorrect for your tenant, you can pass in the correct Admin Center URL using Connect-PnPOnline -TenantAdminUrl. If you are using Privileged Identity Management (PIM) on your tenant, please ensure you have activated at least the SharePoint Administrator role and allowed some time for it to activate. Error message: Attempted to perform an unauthorized operation.


Set-PnPTenantSite -Connection $connectionAdmin -Identity $siteUrl -DenyAddAndCustomizePages:$false

Get-PnPPropertyBag 
Set-PnPAdaptiveScopeProperty -Key "SiteCustomSubject" -Value "Test2"
Set-PnPPropertyBagValue      -Key "SiteCustomSubject" -Value "Test3" -Indexed:$true 

Set-PnPTenantSite -Connection $connectionAdmin -Identity $siteUrl -DenyAddAndCustomizePages:$true

PS C:\Users\Vlad\code\m365-PowerShell>
PS C:\Users\Vlad\code\m365-PowerShell> Set-PnPAdaptiveScopeProperty -Key "SiteCustomSubject" -Value "Test4"
PS C:\Users\Vlad\code\m365-PowerShell> 
PS C:\Users\Vlad\code\m365-PowerShell> Set-PnPPropertyBagValue      -Key "SiteCustomSubject" -Value "Test5" -Indexed:$true
Set-PnPPropertyBagValue: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))


PS C:\Users\Vlad\code\m365-PowerShell> DisConnect-PnPOnline
PS C:\Users\Vlad\code\m365-PowerShell> 
PS C:\Users\Vlad\code\m365-PowerShell> Connect-PnPOnline -Url $siteUrl -ClientId $ClientId -Tenant $tenantId -Interactive
PS C:\Users\Vlad\code\m365-PowerShell> 
PS C:\Users\Vlad\code\m365-PowerShell> Set-PnPPropertyBagValue      -Key "SiteCustomSubject" -Value "Test6" -Indexed:$true
Set-PnPPropertyBagValue: Unable to connect to the SharePoint Online Admin Center at 'https://s5dz3-admin.sharepoint.com' to run this cmdlet. If this URL is incorrect for your tenant, you can pass in the correct Admin Center URL using Connect-PnPOnline -TenantAdminUrl. If you are using Privileged Identity Management (PIM) on your tenant, please ensure you have activated at least the SharePoint Administrator role and allowed some time for it to activate. Error message: Attempted to perform an unauthorized operation.   
PS C:\Users\Vlad\code\m365-PowerShell> 
PS C:\Users\Vlad\code\m365-PowerShell> Set-PnPAdaptiveScopeProperty -Key "SiteCustomSubject" -Value "Test7"
Set-PnPAdaptiveScopeProperty: Unable to connect to the SharePoint Online Admin Center at 'https://s5dz3-admin.sharepoint.com' to run this cmdlet. If this URL is incorrect for your tenant, you can pass in the correct Admin Center URL using Connect-PnPOnline -TenantAdminUrl. If you are using Privileged Identity Management (PIM) on your tenant, please ensure you have activated at least the SharePoint Administrator role and allowed some time for it to activate. Error message: Attempted to perform an unauthorized operation.


PS C:\Users\Vlad\code\m365-PowerShell> Get-PnPTenant -Connection $connectionAdmin | Select-Object AllowWebPropertyBagUpdateWhenDenyAddAndCustomizePagesIsEnabled

AllowWebPropertyBagUpdateWhenDenyAddAndCustomizePagesIsEnabled
--------------------------------------------------------------
                                                         False


Set-PnPTenant -Connection $connectionAdmin -AllowWebPropertyBagUpdateWhenDenyAddAndCustomizePagesIsEnabled $true


PS C:\Users\Vlad\code\m365-PowerShell> Get-PnPTenant -Connection $connectionAdmin | Select-Object AllowWebPropertyBagUpdateWhenDenyAddAndCustomizePagesIsEnabled

AllowWebPropertyBagUpdateWhenDenyAddAndCustomizePagesIsEnabled
--------------------------------------------------------------
                                                          True



PS C:\Users\Vlad\code\m365-PowerShell>
PS C:\Users\Vlad\code\m365-PowerShell> Set-PnPAdaptiveScopeProperty -Key "SiteCustomSubject" -Value "Test7"
PS C:\Users\Vlad\code\m365-PowerShell> 
PS C:\Users\Vlad\code\m365-PowerShell> Set-PnPPropertyBagValue      -Key "SiteCustomSubject" -Value "Test6" -Indexed:$true
PS C:\Users\Vlad\code\m365-PowerShell> 
PS C:\Users\Vlad\code\m365-PowerShell> Get-PnPPropertyBag

Key                              Value
---                              -----
SiteCustomSubject                Test6




PS C:\Users\Vlad\code\m365-PowerShell>
PS C:\Users\Vlad\code\m365-PowerShell> Set-PnPPropertyBagValue      -Key "SiteCustomSubject" -Value "Test9" -Indexed:$true

Confirm
The current site is a no-script site. Do you want to temporarily enable scripting on it to allow setting property bag value?
[Y] Yes  [N] No  [S] Suspend  [?] Help (default is "Y"): y
PS C:\Users\Vlad\code\m365-PowerShell> 
PS C:\Users\Vlad\code\m365-PowerShell> Get-PnPPropertyBag

Key                              Value
---                              -----
vti_associategroups              5;4;3
FollowLinkEnabled                TRUE
vti_associateownergroup          3
vti_indexedpropertykeys          VABoAGUAbQBlAFAAcgBpAG0AYQByAHkA|UwBpAHQAZQBDAHUAcwB0AG8AbQBQAHIAbwBwAGUAcgB0AHkA|UwBpAHQAZQBDAHUAcwB0AG8AbQBTAHUAYgBqAGUAYwB0AA==|
disabledhelpcollections
vti_approvallevels               Approved Rejected Pending\ Review
vti_defaultlanguage              en-us
taxonomyhiddenlist               4cc93225-d917-4b8e-9139-a92412a1d1cb
enabledhelpcollections           VGSEndUser
vti_sitemasterid                 d2c702b5-65a4-4311-929e-f5dd2daf612b
_VTI_ACCESSREQUESTSLISTID        2ce14573-1f0f-4ade-ab04-ceafed60c01c,Access Requests
_VTI_PENDINGREQUESTSVIEWID       /sites/tst/Access Requests/pendingreq.aspx
contenttypessynctimestampversion 1
ThemePrimary                     #A4262C
UseFastCloneFromSiteMaster       FALSE
vti_associatevisitorgroup        4
vti_extenderversion              16.0.0.25110
vti_associatemembergroup         5
contenttypesusagebackfillversion 3
_VTI_SHARINGLINKSLISTID          280ba1fc-73cb-4d51-9e83-f71971918afc,Sharing Links
profileschemaversion             1
vti_categories                   Travel Expense\ Report Business Competition Goals/Objectives Ideas Miscellaneous Waiting VIP In\ Process Planning Schedule
vti_createdassociategroups       3;4;5
SiteCustomProperty               TestSite
__AllowExternalEmbedding         1
SiteCustomSubject                Test9


PS C:\Users\Vlad\code\m365-PowerShell> 
PS C:\Users\Vlad\code\m365-PowerShell> Set-PnPPropertyBagValue      -Key "SiteCustomSubject" -Value "Test9" -Indexed:$true
Set-PnPPropertyBagValue: Unable to connect to the SharePoint Online Admin Center at 'https://s5dz3-admin.sharepoint.com' to run this cmdlet. If this URL is incorrect for your tenant, you can pass in the correct Admin Center URL using Connect-PnPOnline -TenantAdminUrl. If you are using Privileged Identity Management (PIM) on your tenant, please ensure you have activated at least the SharePoint Administrator role and allowed some time for it to activate. Error message: Attempted to perform an unauthorized operation.   

PS C:\Users\Vlad\code\m365-PowerShell>