💡 Our Technical Review in summary
Microsoft is implementing significant changes to SharePoint Online to enhance security and promote modernization. Starting September 15, 2025, custom scripting will be disabled by default for several classic publishing site templates and SharePoint Embedded sites. Additionally, Microsoft will restrict the creation of new classic publishing site collections and the activation of publishing features across the tenant. These changes are part of a broader effort to move away from legacy SharePoint architectures toward Modern SharePoint experiences.
#### Impact
The following impacts have been identified for SharePoint administrators and site owners:
- Custom Scripting Restrictions: Templates such as Classic Publishing Portals (BLANKINTERNETCONTAINER#0), Publishing Sites (CMSPUBLISHING#0), and SharePoint Embedded Sites (CSPCONTAINER#0) will have
DenyAddAndCustomizePagesset to enabled by default. This prevents the use of Script Editor web parts, custom master pages, and custom page layouts. - Creation Block: New site collections using classic templates (including Enterprise Wiki, Search Center, and Product Catalog) can no longer be created via the UI or API by default.
- Feature Activation: Publishing features can no longer be activated in existing site collections that do not already have them enabled.
- Property Bag Management: A new setting
AllowWebPropertyBagUpdateWhenDenyAddAndCustomizePagesIsEnabledallows admins to manage site property bags without needing to enable custom scripting, decoupling these two functions for better security. - Existing Sites: Current classic publishing sites will continue to function, but their custom scripting setting will be flipped to “Disabled” by default, affecting further customizations.
#### Action Required
IT Administrators should perform the following steps to prepare for the September 2025 rollout:
- Update Tools: Install the latest SharePoint Online Management Shell (version 16.0.26211.12010 or higher) to support new PowerShell flags.
- Modernization: Review existing classic sites and provide guidance to site owners on migrating to Modern SharePoint sites and communication sites.
- Manage Classic Creation: If your organization still requires the ability to create classic publishing sites, use the following command to override the restriction:
Set-SPOTenant -AllowClassicPublishingSiteCreation $true. - Handle Scripting Exceptions: For sites requiring temporary custom script access, use
Set-SPOSite <SiteURL> -DenyAddAndCustomizePages $false. Note that this override is only effective for 24 hours. - Monitor Deadlines: The tenant-level opt-out for custom scripting (
-DelayDenyAddAndCustomizePagesEnforcementOnClassicPublishingSites) will be retired on March 15, 2026. Ensure all critical scripting tasks are governed or migrated before this date.
Microsoft Official Update
Service: N/A
Category: planForChange
Severity: normal
Updated January 29, 2026: We are updating this post as a reminder. Upcoming SharePoint Online changes may impact your organization. Please review the below.
We are implementing the following changes to custom scripting and classic publishing in SharePoint Online.
1. Disablement of custom scripting
Custom scripting will be disabled by default (setting DenyAddAndCustomizePages to 1 or $true) for sites created with the following templates:
- BLANKINTERNETCONTAINER#0 = Classic Publishing Portal Site
- CMSPUBLISHING#0 = Classic Publishing Site
- BLANKINTERNET#0 = Classic Publishing Site Blank
- CSPCONTAINER#0 = SharePoint Embedded Site
NOTE:
- Existing classic publishing sites created with the templates listed above will have custom scripting disabled by default.
- Disabling custom scripting does not affect the execution of scripts that have already been added to a site or page.
Refer to this documentation to learn more about the security considerations of ungoverned scripting.
2. Ability to set site property bag valued without requiring custom scripting enablement.
Users no longer need to set DenyAddAndCustomizePages to $false or 0 (i.e. enable custom scripting) in a site to manage site property bag values. We have introduced a new AllowWebPropertyBagUpdateWhenDenyAddAndCustomizePagesIsEnabled setting at the site level and at the tenant level to allow adding/managing site property bag values. Please see documentation here for tenant level setting and here for the site level setting.
3. Classic publishing sites creation and feature activation changes
Users will no longer be able to create new classic publishing related site collections or activate publishing features in existing site collections. This applies to both UX and API interactions.
Sites collections with the following templates cannot be created:
- BLANKINTERNETCONTAINER#0 = Publishing Portal Site
- CMSPUBLISHING#0 = Publishing Site
- BLANKINTERNET#0 = Publishing Site Blank
- ENTERWIKI#0 = Enterprise Wiki
- SRCHCEN#0 = Enterprise Search Center
- SPSSITES#0 = Site Directory
- SPSNHOME#0 = News Home Site
- PRODUCTCATALOG#0 = Product Catalog
- SPSREPORTCENTER#0 = Report Center
- SPSTOPIC#0 = Topic Area Template
Existing classic publishing enabled site collections are unaffected and can continue regular usage, including creation of sub sites.
[When this will happen]
Both changes, the extended custom scripting governance and the new classic publishing restrictions, will take effect starting September 15, 2025.
[How this will affect your organization]
- When custom scripting is disabled in classic publishing sites, users will no longer be able to use script editor web parts, create custom master pages or page layouts, and utilize several other features. More details on features affected when custom scripting is disabled can be viewed in this documentation.
- With the change to stop the creation of new classic publishing site collections and publishing feature activation, SharePoint admins will no longer be able to create new classic publishing enabled site collections or enable publishing features at site collection level.
[What you need to do to prepare]
We recommend taking the following actions to prepare for these upcoming changes.
1. Inform owners of the classic publishing sites in your organization of these upcoming changes. Promote switching to use of Modern sites. Refer to this guide.
2. The following tenant-level opt-out operation, used to allow custom scripting changes in classic publishing sites, will be retired starting March 15, 2026. Please ensure appropriate actions are taken ahead of this change.
Set-SPOTenant -DelayDenyAddAndCustomizePagesEnforcementOnClassicPublishingSites $true
3. Customers may still temporarily opt out of custom scripting enforcement for a specific site (any template) with tenant admin approval. This opt-out is effective for 24 hours and can be enabled using the following PowerShell command:
Set-SPOSite <SiteURL>
4. If you need to allow the creation of new classic publishing site collections or enable publishing feature activations, use the following PowerShell command set the flag to allow.
Set-SPOTenant -AllowClassicPublishingSiteCreation $true
NOTE:
- You need to install the latest (16.0.26211.12010 or higher) SharePoint Online Management Shell in order to run the commands above.
- The DelayDenyAddAndCustomizePagesEnforcementOnClassicPublishingSites command is scheduled to end starting on March 15, 2026, while all other commands are expected to remain functional beyond that date.
[Compliance considerations]
There is no impact or change to compliance.
[Referenced content]
Security considerations of allowing custom script – SharePoint in Microsoft 365 | Microsoft Learn
Allow or prevent custom script – SharePoint in Microsoft 365 | Microsoft Learn
