Created by Claude - please verify

Custom script - DenyAddAndCustomizePages per site from Get-PnPTenantSite -Detailed (the site list is kept for 15 minutes).

Required Microsoft Graph permissions

SharePoint: Sites.FullControl.All (application, certificate) — application permission, granted to the app registration with admin consent.

Endpoint: Get-PnPTenantSite -Detailed (DenyAddAndCustomizePages)

To block it: Set-PnPTenantSite -Url <site> -DenyAddAndCustomizePages. Check the 'Custom script re-block delayed' row on the Sharing Posture page for the tenant setting.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Sites Allowing Custom Scripts

On a site where custom script is allowed, any owner or designer can add JavaScript that runs in every visitor's browser session - with their permissions. Microsoft now switches custom script off again 24 hours after it is enabled, so a site listed here was either changed in the last day or the tenant delays that enforcement.