Permission & Access Issues

Fix SharePoint Embed Permissions & Missing HTML Field Security Settings

Kushani Nimanthika Oct 13, 2026 868 views

Question details

The user is attempting to embed a chatbot code into a SharePoint site but the code is rejected due to permission restrictions. Additionally, the user is unable to locate the required Site Collection Administration or HTML Field Security settings.

How to Configure SharePoint Embed Permissions and HTML Field Security

Product: Microsoft SharePoint
Device & OS: not provided
Scenario: Embedding an external chatbot or third-party widget onto a SharePoint page using an iframe or embed code.
Observed behavior: The embed code is actively rejected with a 'website is not permitted' error, and the necessary Site Collection Administration and HTML Field Security menus are missing from the user's SharePoint settings.

Before you start

Verify that you have Site Collection Administrator privileges and ensure you are navigating to the top-level root URL of your SharePoint site collection, rather than a subsite.

Solution 1Recommended

Access HTML Field Security at the Site Collection Level

Ensure you are at the correct administrative level to access the HTML Field Security settings necessary for whitelisting external embed codes.

HTML Field Security and Site Collection Administration options are only visible if you are managing a top-level site collection. If you are currently viewing a subsite, these administrative options will be hidden by default.

Verify your current site URL

Examine your browser's address bar to determine if you are at the root site collection level (e.g., https://domain.sharepoint.com/sites/sitename) instead of a deeper subsite path.

Navigate to Site Settings

Click the gear icon (Settings) in the top right corner of your SharePoint site, select 'Site information', and then click on 'View all site settings'.

Modify HTML Field Security

Locate the 'Site Collection Administration' section and click on 'HTML Field Security'. Add the specific domain of your chatbot provider to the list of permitted domains to allow the iframe embed.

Access HTML Field Security at the Site Collection Level

Domain Whitelisting: Once the domain is added to the HTML Field Security list, SharePoint will instantly allow embeds from that specific source.

Solution 2

Allow Custom Scripts via SharePoint Management Shell

Use PowerShell to override default security restrictions and allow custom scripts on your specific SharePoint site collection.

Solution 3

Verify Iframe Embedding Permissions of the Target Website

Determine if the issue is caused by the external chatbot provider blocking itself from being embedded via iframes.

Free Microsoft Office alternative

Discover a Lightweight Alternative to Microsoft Office

Experiencing complex administrative hurdles with Microsoft 365 and SharePoint? Simplify your workflow with WPS Office. It offers a free, lightweight, and user-friendly alternative to Microsoft Office, ensuring smooth document management without complicated configurations.

1. Download the Installer: Visit the official WPS Office website and download the free installation package tailored for your operating system.
2. Open Your Office Documents: Launch WPS Office and directly open your existing Microsoft Word, Excel, or PowerPoint files without needing conversion.
3. Edit and Export Seamlessly: Edit your documents and securely save them in standard Microsoft formats or export them instantly to PDF for easy sharing.

Fully compatible with standard Microsoft Word, Excel, and PowerPoint formatsLightweight application that runs swiftly and smoothly on any deviceFamiliar user interface for a zero-learning-curve migrationFree built-in PDF editing, conversion, and annotation tools

microsoft office alternative - wps office

Frequently Asked Questions

Why is the Site Collection Administration section missing in my Site Settings?

This section only appears if you are at the root level of a site collection and possess Site Collection Administrator privileges. If you are navigating a subsite or only have standard edit permissions, this administrative menu is hidden by default.

How do I know if my chatbot widget supports iframe embedding?

You can test this by embedding a widely supported site like YouTube into your SharePoint page. If YouTube works but your chatbot fails, the chatbot provider is likely blocking iframe embedding via their own server security headers.

Is enabling custom scripts in SharePoint safe?

Enabling custom scripts allows users to embed third-party code, which can introduce security risks if the source is untrusted. It is recommended to only enable it for specific trusted sites rather than turning it on globally across your entire tenant.

Document & File Issues