Overview

Custom scripting is a vital element of custom development in SharePoint Online. Scripting allows running custom scripts on SharePoint Online sites to achieve the desired result. It may be used to fetch the data from SharePoint or manipulate the DOM structure.

A few features of it are turned off by default. Scripting capability is also one of those features.

Custom Scripting Scenarios

The custom script by default is disabled on the below sites.

Mentioned below are a few scenarios that are impacted due to a disabled custom script.

If custom scripting is turned off, it does not allow you to upload the below file types.

The following site features are unavailable if the custom scripting is turned off.

Turn on custom scripting

Follow the below procedure to turn custom scripting on.

  1. Open SharePoint Online Admin Center (https://[tenant]-admin.sharepoint.com).
  2. From the left menu, click settings.
    Setting
  3. Check "Allow users to run custom scripts on personal sites and self-service created sites".
    Created sites

Enable Custom Script with PowerShell

If it is not feasible to wait for 24 hours until the timer job runs to turn on the custom scripting, we can turn it on using PowerShell.

  1. Download and Install SharePoint Online Management Shell from https://www.microsoft.com/en-us/download/details.aspx?id=35588
  2. Open SharePoint Online Management Shell.
  3. Connect to your SharePoint online tenant. 
    Connect-SPOService -Url "https://[tenant]-admin.sharepoint.com"
  4. Run the below command to enable custom scripting. 
    Set-SPOSite -Identity https://[tenant].sharepoint.com -DenyAddAndCustomizePages 0
  5. To disable scripting capabilities, run this command. 
    Set-SPOSite -Identity "https://[tenant].sharepoint.com" -DenyAddAndCustomizePages 1

Security Implications

Enabling the custom scripts on SharePoint tenant helps the developers in inserting the script to address different business scenarios. However, we can no longer enforce the governance around what custom scripts can do and where the scripts can be added to SharePoint.

Anyone who has "Add and Customize Pages" permission can insert the custom code. There are no boundaries for executing the script. This makes it very difficult to identify.

What can a custom script do?

The custom script runs in the context of the currently logged-in user. That means the script can access everything that a user has access to. The script can also access the content across Office 365 services.

Alternative to Custom Script (SharePoint Framework - SPFx)

To bring the governance, the recommended approach is to use SharePoint Framework (SPFx). Below are the features of SPFx.

Summary

Enabling custom scripts allows the developers to address business scenarios easily by inserting the scripts. However, it makes it very difficult to bring the governance. SharePoint Framework (SPFx) is a recommended way to implement the solutions that can work for both, classic and modern, SharePoint sites.