customization

What it observes

The surfaces by which executable content or customization can reach a page on one site.

m365-governance collect customization \
  --client-id <id> \
  --site-url https://<tenant>.sharepoint.com/sites/<site> \
  --output ./evidence/customization/

What it reads

The count of items in the library is not repeated here. modernity owns it.

One question, and a wider one it refuses

It answers what customization and page-execution control surfaces are observable on this site. It does not answer is this site safe, and it does not answer can no interactive content run here.

Both are wider than these facts carry. The second is the reading that blocking custom script exists to refuse: the setting stops nine file extensions from reaching a library, and .html is not among them.

Four surfaces, and this collects one

• Configuration is here: the custom script setting and the permission it operates through.
• Content is the Site Pages library, whose count modernity owns.
• The administrative execution path is SPFx and the app catalog, which spfx owns.
• Browser runtime policy: content security policy and strict file handling, is read by nothing in this engine.

They are different questions with different answers. Concluding one from another is how a reader ends up believing a site is inert because a setting with a narrow mechanism is switched off.

Why there is no rule

Microsoft documents each of these controls as reaching less than its name suggests, and in two cases prints the limit itself. Blocking custom script stops nine extensions. Preventing modern page creation hides the entry points, and Microsoft states two lines later that users can still add pages from other modern pages or from web parts.

A rule reading custom script: blocked as a pass would publish the conclusion the article refuses, with a rule identifier next to it. The facts are worth collecting long before anybody is entitled to conclude from them.