What it decides

Rule
SPO-SCRIPT-001
Applies to
sharepoint · site
Default severity
medium
Basis
documented-guidance

On what authority

Microsoft's advice, not a requirement: the setting exists, it is supported, and a site with a deliberate classic customisation can hold it open. What makes this worth reporting is the consequence Microsoft documents rather than a preference of ours. It is `guidance` and not `requirement` because nothing in the product forbids it.

What it needs to decide

  • customization.custom_script_denied

Without these facts the rule answers unknown, which is not a pass and is not a failure: it is the rule saying the evidence could not settle the question.

Where the evidence comes from

  • customization: the surfaces by which executable content or customization can reach a page on one site · not live-validated

What a pass does not establish

BLOCKED IS NOT INERT, AND THIS IS THE MISREADING THE CONTROL INVITES. Under *What features are affected when custom scripts are blocked?* Microsoft lists exactly nine extensions that cannot be uploaded, copied, moved or opened: `.asmx`, `.ascx`, `.aspx`, `.htc`, `.jar`, `.master`, `.swf`, `.xap`, `.xsf`. `.html` and `.htm` are not among them. Writing about Content Security Policy, Microsoft states the same thing from the other side: added script will not execute, added HTML will still work. A site that passes this rule can still hold HTML, and other extensibility models are unaffected by this setting entirely.

  • A PASS MAY DESCRIBE A DEFAULT RATHER THAN A DECISION, AND THE DIFFERENCE IS NOT IN THIS EVIDENCE. Microsoft announced in MC1117115 that custom scripting became disabled by default on classic publishing sites on 15 September 2025, and that the tenant-level opt-out command retired on 15 March 2026. A site reported as blocked today may have been closed by an administrator or by that change, and this reads the resulting state rather than what produced it. The tenant's own Message Center is where that history is settled.
  • This reads the setting and never what the site contains. It says nothing about pages that already carry script, about who placed it, or about whether anything currently depends on it.
  • The permission the setting operates through is collected separately. `AddAndCustomizePages` absent from the effective permissions of the identity that ran is a fact about that identity, not about the site.

Source

The rule as the Engine holds it, at the revision this page was generated from: 1.0.0b8@99fe04eb3def.

Generated from capability-manifest/1.0.0 at1.0.0b8@99fe04eb3def, contract1.0.0b8. Every fact on this page is the Engine's; this site publishes it and does not maintain it.