Changes to Custom Scripting and Classic Publishing in SharePoint Online

Many organizations continue to rely on classic publishing sites and custom scripting within SharePoint Online to meet business needs. However, these configurations introduce challenges in maintaining consistent security, governance, and modernization across environments.

To address these realities, Microsoft is updating custom scripting governance and classic publishing site management in SharePoint Online, ensuring a secure, manageable, and modern platform for users and administrators.

Starting September 15, 2025, these updates will take effect, and it is important for organizations to prepare proactively. This blog breaks down the changes into clear, actionable sections to help you understand the impact and next steps for your environment.

Why Is Microsoft Disabling Custom Scripting in SharePoint Online?

These updates align with Microsoft’s broader goal to improve SharePoint Online security and governance while reducing risk in your environment. Here’s why:

• Scripts Run with User Permissions: Any script executes using the permissions of the visiting user, accessing everything the user can access.
• No Boundaries Across Services: Scripts can retrieve data across site collections and other Microsoft 365 services, increasing risk.
• Cannot Audit Script Insertion: Once scripting is allowed, admins cannot track what was added, where, or by whom.
• Scripts Cannot Be Blocked After Insertion: Disabling scripting later will not block scripts already added unless the page is deleted, risking data loss.
• Organization-Wide Impact: Users with “Add and Customize Pages” can insert scripts affecting all users and resources without governance boundaries.

Which Classic Sites Will Have Custom Scripting Disabled by Default?

Custom scripting will be turned off by default for sites created with the following templates:

• Classic Publishing Portal Site (BLANKINTERNETCONTAINER#0)
• Classic Publishing Site (CMSPUBLISHING#0)
• Classic Publishing Site Blank (BLANKINTERNET#0)
• SharePoint Embedded Site (CSPCONTAINER#0)

This enforces DenyAddAndCustomizePages to 1 or $true, restricting the use of Script Editor Web Parts, custom master pages, and ungoverned scripts.

How Can You Manage Property Bags Without Enabling Custom Scripting?

Previously, managing site property bag values required enabling custom scripting. With this update, administrators can now add or modify property bag values while keeping custom scripting disabled.

A new setting, AllowWebPropertyBagUpdateWhenDenyAddAndCustomizePagesIsEnabled, is available at both the site and tenant levels, allowing property bag management while maintaining security.

What Restrictions Are Coming to Classic Publishing Site Creation in SharePoint Online?

Microsoft will block the creation of new classic publishing site collections and disable publishing feature activation within existing site collections (via UI and APIs). The following templates will no longer be creatable:

• Publishing Portal Site (BLANKINTERNETCONTAINER#0)
• Publishing Site (CMSPUBLISHING#0)
• Publishing Site Blank (BLANKINTERNET#0)
• Enterprise Wiki (ENTERWIKI#0)
• Enterprise Search Center (SRCHCEN#0)
• Site Directory (SPSSITES#0)
• News Home Site (SPSNHOME#0)
• Product Catalog (PRODUCTCATALOG#0)
• Report Center (SPSREPORTCENTER#0)
• Topic Area Template (SPSTOPIC#0)

📝 Note: Existing classic publishing-enabled site collections will continue to function, including subsite creation under them.

How Will This Impact Your SharePoint Environment?

Disabling custom scripting will impact the ability to use script editor web parts, custom master pages, and classic page layouts.

The removal of classic publishing site creation enforces your organization’s transition to modern SharePoint sites, aligning with Microsoft’s modernization goals while reducing security risks.

PowerShell Commands to Manage Enforcement

To give your organization time to prepare, you can temporarily delay enforcement:

Delay enforcement tenant-wide until March 15, 2026:

Set-SPOTenant -DelayDenyAddAndCustomizePagesEnforcementOnClassicPublishingSites $true

Temporarily disable custom scripting for a specific site for 24 hours:

Set-SPOSite <SiteURL> -DenyAddAndCustomizePages $false

Allow classic publishing site creation if required:

Set-SPOTenant -AllowClassicPublishingSiteCreation $true

📝 Note: Ensure you are using SharePoint Online Management Shell version 16.0.26211.12010 or higher to run these commands.

SharePoint Framework (SPFx): The Modern, Governed Alternative

To continue customizing SharePoint securely, Microsoft recommends using the SharePoint Framework (SPFx):

1. Provides a fully supported, governed approach to building solutions using scripting technologies.
2. Supports modern frameworks like React, Angular, and others.
3. Allows admin control to disable solutions immediately across all sites and pages if needed.
4. Works across both classic and modern SharePoint experiences while maintaining governance.

Moving Forward

These upcoming changes represent Microsoft’s continued efforts to enhance SharePoint Online with improved security and a consistent modern experience while providing a structured transition path for organizations with existing classic publishing environments.

Preparing your environment early will help avoid disruptions, maintain governance, and enable a smoother modernization journey across your SharePoint infrastructure.