Block new custom scripts on SharePoint and OneDrive sites

Description

No SharePoint site or OneDrive allows custom scripts: every site has DenyAddAndCustomizePages enabled and the Baseline security mode setting Don't allow new custom scripts in SharePoint sites is on, which permanently removes the ability to add new custom scripts.

Custom scripts are blocked by default on OneDrive, self-service sites, modern sites and sites created from the admin center or New-SPOSite. An administrator can still allow them on a site temporarily: SharePoint reverts the site to Blocked within 24 hours. Since 15 March 2026 the tenant can no longer delay this enforcement.

Rationale

A custom script runs in the browser of every user who opens the page, with that user's session. Anyone with Add and Customize Pages permission (site owners by default) can use it to steal tokens, alter content or pivot to other sites, and the organization cannot scope, review or block the code once it is deployed. SharePoint Framework solutions give the same extensibility through an administered app catalog.

Impact

On sites where scripts are blocked, owners cannot save sites, lists or libraries as templates, use the theme gallery, add sandbox solutions, script editor or content editor web parts, or upload .aspx, .master, .swf and similar files. Existing items keep working. SharePoint Framework web parts flagged requiresCustomScript disappear from pages. Classic publishing sites that rely on script must be modernized.

Audit

1. Sign in to the SharePoint admin center (https://admin.microsoft.com/sharepoint) as at least a Global Reader.
2. Browse to Sites > Active sites and open the Custom script allowed sites view (or add the Custom script column).
3. In the Microsoft 365 admin center, browse to Settings > Org settings > Security and Privacy > Baseline Security Mode and check that Don't allow new custom scripts in SharePoint sites is on.
4. With the SharePoint Online Management Shell (SharePoint Administrator): Get-SPOSite -Limit All | Where-Object DenyAddAndCustomizePages -eq 'Disabled' | Select-Object Url.
5. Fail if any site allows custom scripts outside a documented, time-boxed change, or if the Baseline security mode setting is off.

Remediation

1. For each site listed, check with the owner what depends on script and plan a SharePoint Framework replacement.
2. In the SharePoint admin center, browse to Sites > Active sites, select the site, then Settings > Custom scripts > Blocked. PowerShell equivalent: Set-SPOSite -Identity <URL> -DenyAddAndCustomizePages 1. Role: SharePoint Administrator.
3. In the Microsoft 365 admin center, browse to Settings > Org settings > Security and Privacy > Baseline Security Mode, review the impact report, and turn on Don't allow new custom scripts in SharePoint sites.

References

• Allow or prevent custom script Microsoft, vendor-doc, accessed 2026-10-24
• Baseline security mode settings Microsoft, vendor-doc, accessed 2026-10-24
• Security considerations of allowing custom script Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft SharePoint Online and OneDrive baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-COLLAB-014 Prevent users from adding apps from the SharePoint Store

People and lifecycle