MC1186368 – M365 Change Digest

One-line summary

Custom scripting will be disabled by default on SharePoint Online App Catalog sites starting mid-January 2026 to enhance security; app operations remain unaffected.

Similar updates

Details

Summary

Starting mid-January 2026, custom scripting will be disabled by default on the tenant-wide SharePoint App Catalog site to enhance security. App operations remain unaffected, but new custom script changes will be blocked. Admins can temporarily opt out using PowerShell commands and should inform site owners accordingly.

Body (from Message Center)

To strengthen security and reduce the risk of ungoverned scripting, Microsoft is expanding the custom scripting governance in the App Catalog site. This change helps ensure a more secure and manageable environment in SharePoint Online.

What will happen:

Custom scripting will be disabled (setting DenyAddAndCustomizePages to 1 or $true) for the tenant-wide App Catalog site using the APPCATALOG#0 template.

When this will happen: Default custom scripting governance on the App Catalog site will take effect starting in mid-January 2026.

Who is affected: Admins managing the SharePoint tenant-wide App Catalog site and content inside.

How this affects your organization:

App operations remain unaffected: Uploading, updating, and deploying SharePoint and Office apps will continue to work.
Custom script-based changes will be blocked: New changes related to custom scripting in the App Catalog Site will be disabled by default; existing custom scripting related customizations will remain unaffected.

What you can do to prepare:

Inform App Catalog site owners and helpdesk staff in your organization of this upcoming change to reduce confusion and support calls.

To temporarily opt out of custom scripting governance for a specific site (effective for 24 hours with tenant admin approval), use the following PowerShell command:

Set-SPOSite <SiteURL> -DenyAddAndCustomizePages $false

To update the site property bag (by default disallowed when custom script governance is enabled), use the following PowerShell commands to enable it at tenant or site level:

Set-SPOTenant -AllowWebPropertyBagUpdateWhenDenyAddAndCustomizePagesIsEnabled $true

Set-SPOSite <SiteURL> -AllowWebPropertyBagUpdateWhenDenyAddAndCustomizePagesIsEnabled $true

Learn more:

Compliance considerations:

No compliance considerations identified, review as appropriate for your organization.

Raw JSON (for debugging)

Expand/collapse the full payload below.

Show/hide raw

{
  "snapshot_item": {
    "action_required_by": "2026-01-13T08:00:00Z",
    "ai_action_required_by": null,
    "ai_actions": [
      "Inform App Catalog site owners and helpdesk staff",
      "Review PowerShell options for temporary opt-out or property bag updates"
    ],
    "ai_master_tags": [
      "Admin",
      "Security"
    ],
    "ai_model": "gpt-4.1",
    "ai_summary": "Custom scripting will be disabled by default on SharePoint Online App Catalog sites starting mid-January 2026 to enhance security; app operations remain unaffected.",
    "ai_topics": [
      "SharePoint"
    ],
    "category": "planForChange",
    "details_map": {
      "Summary": "Starting mid-January 2026, custom scripting will be disabled by default on the tenant-wide SharePoint App Catalog site to enhance security. App operations remain unaffected, but new custom script changes will be blocked. Admins can temporarily opt out using PowerShell commands and should inform site owners accordingly."
    },
    "id": "MC1186368",
    "importance": 5,
    "is_major_change": true,
    "last_modified": "2025-11-15T00:00:07Z",
    "ms_products": [
      "SharePoint"
    ],
    "platforms": null,
    "roadmap_ids": [],
    "services": [
      "SharePoint Online"
    ],
    "severity": "normal",
    "tags": [
      "Feature update",
      "User impact",
      "Admin impact"
    ],
    "title": "Microsoft SharePoint: Update to custom scripting governance in App Catalog site"
  }
}