Sites Allowing Custom Scripts

The question it answers: Which SharePoint sites allow custom script, so any owner or designer can add JavaScript that runs for every visitor?

On a site where custom script is allowed, any owner or designer can add JavaScript that runs in every visitor’s browser session - with their permissions. Microsoft now switches custom script off again 24 hours after it is enabled, so a site listed here was either changed in the last day or the tenant delays that enforcement.

Note

To block it: Set-PnPTenantSite -Url <site> -DenyAddAndCustomizePages. Check the ‘Custom script re-block delayed’ row on the Sharing Posture page for the tenant setting.

At a glance

Where in the app	SharePoint Online › Sharing & Governance › Sites Allowing Custom Scripts
Workload	SharePoint Online
Kind	Table
Data	Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report.
Licence	SharePoint Online.
Report id (API and MCP)	sharepoint.governance.custom-script-sites

Columns

Column	Key	Type
Site	Title	Link
URL	Url	Text
Type	Kind	Status
Template	Template	Text
Owner	Owner	Text
Last content change	LastContentModified	Date
Storage (GB)	StorageUsedGb	Text

What it needs

Licence: SharePoint Online.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Sites.FullControl.All	Office 365 SharePoint Online	Have full control of all site collections	application, certificate

Data sources it reads

• Get-PnPTenantSite -Detailed (DenyAddAndCustomizePages)

Through the API and MCP

GET /ir-api/v1/reports/sharepoint.governance.custom-script-sites?size=100

An AI assistant reads it with the MCP tool get_report and the id sharepoint.governance.custom-script-sites. The client needs the Read grant for SharePoint Online. See Using the API.