Set-SPOSite -DenyAddAndCustomizePages 0: allow custom scripts on a SharePoint site

Set-SPOSite -Identity URL -DenyAddAndCustomizePages 0 (or $false) allows custom script on a SharePoint site collection: site owners can again use features that need script, such as the classic Script Editor web part, saving a site, list or library as a template, or some migration tools. $true (or 1) blocks it again, which is the default for most sites. Microsoft's instruction: "Run the following command. Set-SPOSite <SiteURL> -DenyAddAndCustomizePages 0". You need the SharePoint Administrator role and a Connect-SPOService session to the admin URL.

Connect-SPOService -Url https://contoso-admin.sharepoint.com
Set-SPOSite -Identity https://contoso.sharepoint.com/sites/finance -DenyAddAndCustomizePages 0
Get-SPOSite -Identity https://contoso.sharepoint.com/sites/finance | Select-Object Url, DenyAddAndCustomizePages
Set-SPOSite -Identity https://contoso.sharepoint.com/sites/finance -DenyAddAndCustomizePages 1   # block again

Accepted values

The reference gives PARAMVALUE: False | True and the type System.Boolean. Checked offline in Windows PowerShell 5.1 with module 16.0.27709.12000: a number binds, a word does not.

Import-Module Microsoft.Online.SharePoint.PowerShell -DisableNameChecking
"Type: " + (Get-Command Set-SPOSite).Parameters['DenyAddAndCustomizePages'].ParameterType.Name
$site = 'https://contoso.sharepoint.com/sites/finance'
foreach ($v in @(0, $false, 'no')) {
  try { Set-SPOSite -Identity $site -DenyAddAndCustomizePages $v -ErrorAction Stop }
  catch { "{0,-6} -> {1}" -f "$v", $_.Exception.Message }
}

Type: Boolean
0      -> No connection available. Use Connect-SPOService before running this CmdLet.
False  -> No connection available. Use Connect-SPOService before running this CmdLet.
no     -> Cannot convert 'System.String' to the type 'System.Boolean' required by parameter 'DenyAddAndCustomizePages'.

0 and $false pass binding and stop only at the missing connection (No connection available); 'no' fails while binding.

What changes

Microsoft: "If you allow custom script, all users who have Add and Customize Pages permission to a site or page can add any script they want." Site owners have that permission by default.

Pitfalls

• 24-hour limit. "Changes to allow custom scripts are overridden to Not allowed within 24 hours." Plan the work inside that window and run the command again when you need it; the documentation offers no permanent per-site allow.
• Locked sites. If the site is in the ReadOnly or NoAccess state, Microsoft notes that custom script changes don't appear in the admin center, and when the site is unlocked the setting immediately turns to Not allowed; see Set-SPOSite -LockState.
• Not for OneDrive. Personal sites cannot allow custom script.
• Security. Script runs with the permissions of every visitor. Allow it only for the time a task needs it.
• Identity format. Pass the full site URL; a wrong value fails with Cannot convert value to type SpoSitePipeBind.

FAQ