MC714186 – (Updated) Remove Custom Script setting in OneDrive and SharePoint

Product:

Microsoft 365 admin center, OneDrive, SharePoint

Platform:

Online, Web, World tenant

Status:

Change type:

Admin impact, Retirement, Updated message, User impact

Links:

Details:

Summary:
The Custom Script setting in SharePoint and OneDrive will be removed by early May 2024, with enforcement changes starting late April. A new PowerShell command is available to delay these changes until mid-November 2024. Existing scripts will not be affected, but the ability to add new custom scripts will be restricted.

Details:
Updated August 28, 2024: The template "GROUP#0 = Team site" will not be excluded from enforcement. Previously this was part of exempted templates. Thank you for your patience.
PowerShell command (DelayDenyAddAndCustomizePagesEnforcement) to delay the change will be fully available by mid- April (Previously March).
The enforcement to set NoScriptSite to True for all existing SharePoint sites and OneDrive sites if DelayDenyAddAndCustomizePagesEnforcement is not set to True will start late-April and be completed by early-May (Previously March)
There are changes happening to Custom script settings between April and May 2024 (Previously March).
The Custom Script setting, which determines if users can execute custom scripts on personal sites and self-service created sites will be removed by early-May (Previously March).
This setting is currently located in the SharePoint Admin Center, under Settings -> Classic Settings.

A new PowerShell command, "DelayDenyAddAndCustomizePagesEnforcement", has been introduced. This command is available in the SharePoint Online Management Shell version 16.0.24524.12000, or above which allows delay of the change to custom script set on the Tenant until mid-November 2024 (previously May).
Note: that while this cmdlet is available in the latest management shell, running the cmdlet will result in an error (The requested operation is part of an experimental feature that is not supported in the current environment) until Mid-April 2024 (Previously March) when the settings are shipped.
* False (default) - for site collections where administrators enabled the ability to add custom script, SharePoint will revoke that ability within 24 hours from the last time this setting was changed.
* True - All changes performed by administrators to custom script settings are preserved. When the value is set to true, a banner shows in the active sites list of the SharePoint admin center informing that changes to custom scripts are permanent.
Set-SPOTenant -DelayDenyAddAndCustomizePagesEnforcement $True
Please be aware that the new PowerShell command will only be accessible until mid-November 2024 (previously May). Post that period, on SharePoint sites if administrators wish to continue using features that are only available when unmanaged custom scripts are permitted to run, they will need to re-enable the running of custom scripts every 24 hours. This option does not impact existing custom scripts.
The NoScriptSite setting will be configured to True for all existing SharePoint sites and OneDrive sites except for below mentioned sites templates.
BLANKINTERNETCONTAINER#0 = Classic Publishing Portal site
CMSPUBLISHING#0 = Publishing Site
BLANKINTERNET#0 = Publishing Site
APPCATALOG#0 = App Catalog
CSPCONTAINER#0 = CSP Container
The execution of existing scripts in OneDrive and SharePoint sites will remain unaffected.
There will not be an option to enable custom script on OneDrive sites once the delay set using DelayDenyAddAndCustomizePagesEnforcement ends in mid-November 2024 (previously May).
Customers will retain the ability to permit the execution of custom scripts on specific SharePoint sites using the Set-SPOSite <SiteURL> -DenyAddAndCustomizePages PowerShell command or from the Active sites page in the SharePoint Admin Center.

Any modifications made to a site will be automatically reverted to False status within 24 hours, unless the new PowerShell command "DelayDenyAddAndCustomizePagesEnforcement" is used prior to mid-November 2024 (previously May). After mid-November, the 24 hour reversion will occur regardless of this setting.
[When this will happen:]
The Custom Script setting from SharePoint admin center will be removed early-May (Previously March)..
The new PowerShell command will be available by mid-April (Previously March).

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:

Created:
2024-02-09

updated:
2024-08-29

Task Type

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS How does it affect me

XXXXXXX ... free basic plan only

MS Preperations

XXXXXXX ... free basic plan only

MS Urgency

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

Pictures

XXXXXXX ... free basic plan only

Direct effects for Operations**

Removal of Custom Script Setting
Users will no longer be able to add new custom scripts to OneDrive and SharePoint sites, impacting customization capabilities.
   - roles: Site Administrators, End Users
   - references: https://learn.microsoft.com/sharepoint/allow-or-prevent-custom-script

Enforcement of NoScriptSite Setting
All existing SharePoint and OneDrive sites will have the NoScriptSite setting configured to True, preventing any new custom scripts from being added.
   - roles: Site Administrators, Developers
   - references: https://learn.microsoft.com/sharepoint/allow-or-prevent-custom-script

PowerShell Command Limitations
The new PowerShell command to delay changes will only be available until mid-November 2024, limiting administrative flexibility.
   - roles: IT Administrators, Site Administrators
   - references: https://learn.microsoft.com/sharepoint/allow-or-prevent-custom-script

Reversion of Custom Script Settings
Modifications to custom script settings will revert automatically within 24 hours unless the delay command is used, leading to potential disruptions.
   - roles: Site Administrators, End Users
   - references: https://learn.microsoft.com/sharepoint/allow-or-prevent-custom-script

Impact on Training and Documentation
Organizations will need to update training materials and documentation to reflect the changes, which may lead to confusion among users.
   - roles: Training Coordinators, Site Administrators
   - references: https://learn.microsoft.com/sharepoint/allow-or-prevent-custom-script

Configutation Options**

Delay Custom Script Changes
Use the PowerShell command to delay the enforcement of custom script restrictions until mid-November 2024.
   - technical instructions: Run the command: Set-SPOTenant -DelayDenyAddAndCustomizePagesEnforcement $True
   - references: https://learn.microsoft.com/sharepoint/allow-or-prevent-custom-script

Set NoScriptSite to True
All existing SharePoint and OneDrive sites will have the NoScriptSite setting configured to True unless the delay command is set.
   - technical instructions: No specific command needed; this will be enforced automatically unless delayed.
   - references: https://learn.microsoft.com/sharepoint/allow-or-prevent-custom-script

Revert Custom Script Settings
Any modifications to custom script settings will revert to False within 24 hours unless the delay command is used.
   - technical instructions: Ensure to run the delay command before making changes to avoid automatic reversion.
   - references: https://learn.microsoft.com/sharepoint/allow-or-prevent-custom-script

Manage Custom Script on Specific Sites
Administrators can still permit custom scripts on specific SharePoint sites using PowerShell commands.
   - technical instructions: Run the command: Set-SPOSite <SiteURL> -DenyAddAndCustomizePages $False
   - references: https://learn.microsoft.com/sharepoint/allow-or-prevent-custom-script

Inform Site Owners
Communicate the changes to site owners and update training materials accordingly.
   - technical instructions: Prepare a communication plan and update documentation to reflect the changes in custom script settings.
   - references: https://learn.microsoft.com/sharepoint/allow-or-prevent-custom-script

Potentional Risks**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only