"Custom Scripts" setting inside our tenant, How it works exactly

Question

I spent many days reading about how "Custom scripts" work for sharepoint online, but i can not fully understand it. for example we have this case.

1. inside SP admin center >> Settings >> we have custom scripts disabled as follow:-

2. now using the office 365 admin (who is also a sharepoint admin), i created 2 sites (modern communication site + classic team site).

3. so now i got these "custom script" setting for the site collections:-

   • our build-in root site collection (which is a classic team site)--> custom scripts is Disabled.
   • the modern site collection --> custom scripts is Disabled.
   • the classic team site which i created --> custom scripts is Enabled!!

so i have the following questions:-

1. since we have prevent custom scripts inside the "SharePoint admin center", then how custom script was enabled inside the classic team site i have created?

2. if we allow custom scripts from the "SharePoint admin center", then i assume this will affect future site collections, but will it also affect all our current 3 site collections?

3. if i want to enable custom scripts for our modern communication site collection ONLY. so can i do so? or as a first step i will need to enable custom scripts from "SharePoint admin center" ?

4. if i want to add a script to a classic page. can i Temporary enable custom script on the intended site >> add the custom script >> disable custom script inside the site collection? will the script keep working as-is even if we disable custom script on the site?

5. final question inside the "SharePoint admin center" >> "Custom Script", they use the word "Prevent users" & "Allow users".. so what do users represent? does it cover office 365 & sharepoint admins? or users refer to non-admin users?

Thanks in advance for any help.

Answer 1

You can enable / disable Custom Scripts at the Tenant Level and at The Site level.

Please Read the following posts carefully, most of your questions will be answered:

• https://docs.microsoft.com/en-us/sharepoint/allow-or-prevent-custom-script
• http://sharepoint.handsontek.net/2018/10/28/enable-custom-script-on-modern-sharepoint-sites-using-powershell/

Both pages have a matrix of the effects of this setting. Also, the second link talks about why you should not enable Custom Scripts on modern sites.

Question #1:

As per Link #1 above, wait 24 hours. It will be overridden.

Question #2:

As per documentation in Link #1, it will override the settings on the current sites until you run this command:

Set-SPOsite <SiteURL> -DenyAddAndCustomizePages 0

Question #3:

See Link #2 above.

Question #4:

As per link #1 above: If you change this setting for a user's OneDrive or a classic team site, it will be overridden by the Custom Script setting in the admin center within 24 hours.

Question #5:

"Users" all users in SharePoint. If you allow custom scripts at a tenant or site level, any one with the "Add and Customize Pages" permission level or higher will be able to add custom scripts to a site that they have that permission level (or higher).