Content Security Policies (CSP) are coming to SharePoint Online and might impact your custom SPFx solutions

Starting March 1, 2026, SharePoint Online will enforce Content Security Policy (CSP), blocking scripts from non-trusted sources in custom SPFx solutions. To avoid disruption, ensure all scripts come from trusted sources and move inline scripts to files. CSP enforcement can be postponed 90 days via PowerShell. We’re improving SharePoint Online security via Content Security Policy (CSP) enforcement. Currently CSP is applied in reporting mode but as of March 1, 2026, the Content Security Policy will be enforced which will prevent the loading of script (e.g. JavaScript) from non-allowed sources. This message center post replaces MC1055557 (April 2024). This change is associated with Microsoft 365 Roadmap ID: 485797 When this will happen: This will be implemented starting March 1, 2026. How this will affect your organization: If your organization extended SharePoint Online using SPFx then the created custom SPFx solutions could potentially load scripts from locations which are not allowed. In most cases SPFx solutions use and load script from allowed locations, but that’s not always the case. Any script from a not allowed location will be blocked, the same applies for any inline script usage. SPFx solutions whose script is getting blocked will not function anymore as designed, impacting business scenarios depending on those solutions. To prevent solutions from breaking there you need to: Ensure all used script locations are trusted script sources. This can be done without updating the SPFx solution Move all inline script to script files which can then be defined as trusted source. This will require updating the SPFx solution! If you need more time to review your SPFx solutions, there’s an option to postpone CSP enforcement by 90 days via below SPO Management Shell PowerShell cmdlet. Set-SPOTenant -DelayContentSecurityPolicyEnforcement $true Note: This option will be available in the SPO Management Shell version 16.0.26712.12000 (November 2025) or higher. What you need to do to prepare: In addition to the default CSP settings, SharePoint Online will add locations listed in the Trusted Script Sources area of the SharePoint Online Admin Center as valid locations for CSP, thus enabling script loading from those locations. To add an entry, in […]

The post Content Security Policies (CSP) are coming to SharePoint Online and might impact your custom SPFx solutions appeared first on M365 Admin.