New options are rolling out, and your tenant may already have them. The options control custom scripting, a feature that was previously only enabled and disabled via PowerShell.
What is custom scripting?
Custom scripting gives users a way to change the look and feel of sites. More importantly, it allows users to add custom JavaScript to a site. If you allow custom scripts, all users who have Add and Customize Pages permission to a site or page can add any script they want. (By default, users who create sites are site owners and therefore have this permission.)
Typically, you may be required to enable custom scripting on a site in order to add some 3rd-party web parts. You would also enable custom scripts to add JavaScript to a site. That’s what I remember from my experience, anyways. While that’s less common of a requirement to see nowadays, it’s still important to know about. That’s more important now considering that Microsoft is making it very easy to control.Â
Enabling and disabling custom scripts
Until recently, the only way admins could enable or disable custom scripting on a site was through PowerShell. This could be done either through SharePoint Online Management Shell:
Set-SPOSite <SiteURL> -DenyAddAndCustomizePages 0
or through PnP PowerShell:
Set-PnPSite -Identity <SiteURL> -NoScriptSite $false
Either of these commands would enable custom scripting on a site.
Learn JSON Formatting from me
Now there’s a MUCH easier way to control this, and it doesn’t even involve PowerShell. In the SharePoint Admin Center, you’ll find a new option when you select a site and view its properties.
On the Settings tab, you’ll see this new Custom scripts setting. This will easily let you change the setting, as seen on this screen, which appears after clicking the Edit button.
Notice the warning message that indicates the setting will revert to it’s normal value after 24 hours. That means that after enabling custom scripts, users will only have 24 hours to add the script they need to. After that point, they’ll be unable to add more scripts.
This lets you keep your sites secure while also allowing those power users who have scripting experience to customize their sites the way they prefer. In the past, the change was “sticky” and didn’t revert after some time elapsed. I think that Microsoft made a good decision to add this to the UI only after also introducing that auto-revert feature to keep sites as secure as possible.
I thought custom scripts were bad?
While it’s still considered bad practice to add custom JavaScript to a site this way (using SharePoint Framework is the preferred way), it’s better than having to deal with PowerShell. Not all administrators have PowerShell experience, and having this option in the UI makes their lives just a little bit easier.
