SharePoint O365 Permissions - Deny - Add and Customise Pages issue

Aug 20, 2015 - by Andrew Reeves

Associated errors:

“Web Part Error: A Web Part or Web Form Control on this Page cannot be displayed or imported. You don’t have Add and Customize Pages permissions required to perform this action.”

Access Denied to certain web pages that you should be able to see

Missing sections / headings in Site Settings such as Solutions Gallery – you should see in site settings

Problem:

I was working on one of our client’s sites on a brand new Office 365 configuration and after a while found that on my admin account I was being denied access to certain things and being told I didn’t have permission to do certain things. This was strange as I was logged on with the admin account and there were no other accounts yet created.

Diagnostics:

To check if this is your issue go to a library where the issue is occurring and check permissions for your account. Go to the Library tab and select Shared With on the ribbon then go straight to “advanced”. Select Check permissions on the ribbon at the top – enter your user account and do check now.

If you see this:

Or if any of your Galleries are missing as shown above from Site Settings then...

Resolutions:

Firstly to stop it happening again...

To enable or disable scripting from the SharePoint admin centre

Sign in to Office 365 with your work or school account.

Go to the SharePoint admin centre.

Select Settings.

Under Custom Script choose:

 

Any change to the scripting setting made through the SharePoint Online admin centre may take up to 24 hours to take effect.

To fix the current problem

To enable scripting on a particular site collection immediately, use the following PowerShell command.

In SharePoint online management shell (download if you don’t have it)

Enter:

Connect-SPOService 

then

Enter URL of admin site https://<yourdomain>-admin.sharepoint.com

Then username and password

Set-SPOSite -Identity https://<yourdomain>.sharepoint.com -DenyAddAndCustomizePages $false

Make sure the scripting setting in the admin portal matches what you set using PowerShell, or the site collection setting may be overridden again in the next 24 hours.

 

When you then run the command all should be well again and it should not happen again!

10 comments

  1. John Vance

    Tried this on my SharePoint 2013 Online tenant and received a 'Property set method not found" error.

  2. Marty

    Yep this advice worked for me. I can't believe a fresh O365 instance puts a blanket "Deny" across all users, even Site Collection admins!

  3. Don

    Was looking for this answer forever thanks for posting worked perfectly!

  4. Shaun

    Genius Thank you.

  5. Akin

    Finally... That's sick problem is gone. Big thanks.

  6. Charles

    Thanks! Saved me a lot of time !

  7. Elisiane

    Thanks!!! This article save my day!

  8. Nick Duxfield

    This solved the issue on the Modern Sites part of Teams. I discovered this issue when i tried to publish a 2010 workflow. Suddenly I got permissions error. As the Global admin, Site Collection Admin and Owner of the site this was puzzling. Microsoft even cleared my caches in an afternoon. I also reset my laptop. Tried multiple PC's etc.

  9. Martin

    Hi Nick, Are you able to edit and save the .aspx files within an MS Teams team site in sharepoint designer 2013 after this change? I'm trying to edit a list view to change a column width but sharepoint designer wont save even after the change suggested in this post.

  10. Eric Schrader

    Thanks! I ran into the following error when enabling the responsive UI PNP: Enable-PnPResponsiveUI : Access denied. You do not have permission to perform this action or access this resource. I could run it on a new classic publishing site collection but not the original root site collection, even though I was admin. I saw the deny flag on my user for the permissions and found this article. I didnt have to switch my custom script flag since I only need to run this code once, but did run into an issue with set-sposite: Set-SPOSite : Value cannot be null. I could do a get-sposite and return results, so I knew the issue was syntax related. I got it working with this: PS C:\users\ericschrader\desktop> get-sposite | where-object {$_.URL -eq "https://<yourdomain>.sharepoint.com/"} | set-sposite -DenyAddAndCustomizePages $false Great find! Any updates on why this was set by MS on this site but not on new Publishing classic sites would be appreciated.

Leave a reply