My problem is enabling custom script with DenyAddAndCustomizePages. A two-line script can describe my problem.

Background: I was using Set-SPOSite to enable it like this:

Set-SPOSite $SiteURL -DenyAddAndCustomizePages $False

This worked fine for sites with URLs of the form https://xxxxx.sharepoint.com/sites/MySite, i.e. top-level sites in the collection. When I used it on a subsite of MySite, it gave me an error: (The URL was "https://xxxxx.sharepoint.com/sites/MySite/Subsite1")

The error was:

Set-SPOSite: The managed path sites/Mysite is not a managed path in this tenant.

(It was not seeing past Mysite in the URL). I found an explanation that appeared to make sense, that Get/Set-SPOSite cmdlets only work at the top-level of the site collection. And suggested to use PnP PowerShell.

So I tried this script:

Connect-PnPOnline -Url $AdminCenterURL -Interactive
Set-PnPTenantSite -Identity $SiteURL -DenyAddAndCustomizePages:$False

It works fine on top-level sites, but on subsites I get the same error:

The managed path sites/MySite is not a managed path in this tenant.

Is there any way of scripting with PnP PowerShell to enable custom scripts on subsites?

(Pls excuse any formatting errors. First post here).


  • I don't think you can set this setting at "subsite" level, you have to set it at "site" level only. Can you please explain what are you trying to do exactly on subsite so that you want to enable this setting? Commented Feb 29 at 6:09
  • @GaneshSanap-MVP: Thank you. Your question tapped into my lack of understanding and a wrong assumption. My document library transfer script had failed on this classic site collection subsite and I had assumed it was caused by custom script setting because of a similar error earlier. It is set at site level, so my question premise was wrong. I'll get back to troubleshooting - thanks for the reset!
    – IshRashad
    Commented Feb 29 at 15:57
  • You're welcome! Can you share more details about the "document library transfer script"? What exactly are you trying to do and what is the error message? Commented Feb 29 at 17:33

2 Answers 2


As I mentioned in comments section above,

I don't think you can set this setting at "sub site" level, you have to set it at "site (site collection)" level only.

You can either enable it using SharePoint Online PowerShell or PnP PowerShell or CLI for Microsoft 365.

Here is an example using SharePoint Online PowerShell:

# SharePoint online admin center URL
$adminCenterUrl = "https://contoso-admin.sharepoint.com/"

# SharePoint online site URL
$siteUrl = "https://contoso.sharepoint.com/sites/SPConnect"

# Connect to SharePoint online admin center
Connect-SPOService -Url $adminCenterUrl

# Allow custom scripts on SharePoint online site
Set-SPOSite $siteUrl -DenyAddAndCustomizePages 0

# Verify that custom scripts are enabled on SharePoint online site
Get-SPOSite $siteUrl | select DenyAddAndCustomizePages

You can find the script examples using PnP PowerShell and CLI for Microsoft 365 in this article: Allow use of custom scripts in SharePoint Online using PowerShell.

  • 1
    Thanks, Ganesh. As I mentioned in my earlier reply, I had not realized that for classic site collections, enabling custom script is st the top level because it is the for the site collection. Larger picture, to answer your ealier question: Am migrating some old subsites for a small NFP client org, lots of piecemeal libraries. Stepping carefully through it because they cannot afford migration software - which would be overkill anyway. Sorry for the delay in replying. THanks again.
    – IshRashad
    Commented Apr 2 at 10:57

Custom script can only be enabled in the site collection level.

In the SharePoint admin center, you can choose to allow users to run custom script on OneDrive (referred to as "personal sites") or on all classic team sites they create.

Go to Settings in the SharePoint admin center -> Classic settings page at the end of page -> Enable custom script.

enter image description here

Or you use PowerShell to enable custom script for all site collections.

$TenantURL =  "https://Crescent.sharepoint.com"
#Get Credentials to connect
$Credential = Get-Credential
#Frame Tenant Admin URL from Tenant URL
$TenantAdminURL = $TenantURL.Insert($TenantURL.IndexOf("."),"-admin")
#Connect to Admin Center
Connect-PnPOnline -Url $TenantAdminURL -Credentials $Credential
#Get All Site collections 
$Sites = Get-PnPTenantSite
#Iterate through all sites
$Sites | ForEach-Object {
    Write-host "Processing Site Collection:"$_.URL
    #Enable Custom Script
    If ($_.DenyAddAndCustomizePages -ne "Disabled")
        Set-PnPTenantSite -Identity $_.URL -DenyAddAndCustomizePages:$false
        Write-host "`tCustom Script has been Enabled!" -f Green
        Write-host "`tCustom Script is Already Enabled!" -f Yellow

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.