Security Policy Errors

How to Fix Missing HTML Field Security Option in SharePoint Communication Sites

Chanuka Geekiyanage Oct 8, 2026 869 views

Question details

Users are unable to locate the HTML Field Security option on their SharePoint Communication Site to allow external iframe domains.

How to Fix Missing HTML Field Security Option in SharePoint Communication Sites

Product: SharePoint Online
Device & OS: not provided
Scenario: Attempting to embed a Sway presentation or another external iframe domain into a SharePoint Communication Site.
Observed behavior: The HTML Field Security option is completely missing or hidden from the site settings menu.

Before you start

Ensure you have SharePoint Administrator or Site Collection Administrator privileges, and install the SharePoint Online Management Shell before modifying tenant security and scripting settings.

Solution 1Recommended

Enable Custom Scripting via SharePoint Online Management Shell

Use PowerShell to enable custom scripting on your specific SharePoint site, which will reveal the HTML Field Security settings.

By default, modern SharePoint Communication sites have custom scripting disabled for security purposes. Disabling custom scripting automatically hides the HTML Field Security option. You can override this using administrative PowerShell commands.

Open SharePoint Management Shell

Launch the SharePoint Online Management Shell on your computer with administrator privileges.

Connect to your SharePoint Admin Center

Run the command 'Connect-SPOService -Url https://[yourtenant]-admin.sharepoint.com' and log in with your global administrator credentials.

Enable custom scripting on the site

Execute the command 'Set-SPOSite <SiteURL> -DenyAddAndCustomizePages 0', replacing '<SiteURL>' with the URL of your Communication site.

Access HTML Field Security

Navigate back to your SharePoint site's Site Settings. The HTML Field Security option should now be visible under the Site Collection Administration section.

Enable Custom Scripting via SharePoint Online Management Shell

Tenant Security Policies: Modifying custom script settings is subject to your organization's overarching tenant security policies. Ensure this change complies with your IT guidelines.

Solution 2

Verify Account Administrator Permissions

Check that your user account has the required administrative access to view and modify site-level security configurations.

Free Microsoft Office alternative

Experience a Lightweight and Seamless Office Alternative with WPS Office

While SharePoint and Microsoft 365 configurations often require complex administrative setups and PowerShell commands, your everyday document editing doesn't have to be complicated. WPS Office offers a completely free, lightweight, and highly compatible alternative to Microsoft Office. With a familiar user interface and robust tools, you can seamlessly migrate your workflow and start creating without administrative hurdles.

1. Download the Installer: Visit the official WPS Office website and click the download button for your operating system.
2. Install WPS Office: Run the downloaded installation file and follow the simple on-screen instructions to set up the software.
3. Start Creating: Open WPS Office and instantly create, edit, or open existing Microsoft Office documents without complex configurations.

Completely free and lightweight office suite for daily productivitySeamlessly compatible with Microsoft Office formats including Word, Excel, and PowerPointBuilt-in cloud collaboration and easy secure file sharingFamiliar and intuitive user interface requires zero learning curve

microsoft office alternative - wps office

Frequently Asked Questions

Why does SharePoint disable custom scripting by default?

Microsoft disables custom scripting on modern SharePoint Communication sites by default to prevent malicious scripts from running and to maintain strict security and integrity of the tenant's data.

Can I embed a Sway presentation if HTML Field Security is hidden?

No, if HTML Field Security is hidden, you cannot add sway.office.com to the allowed iframe domains list. You must first enable custom scripting to access the setting and whitelist the Sway domain.

How long does the PowerShell scripting command take to apply?

The 'Set-SPOSite' command typically applies immediately, but depending on server load, it can sometimes take a few minutes for the HTML Field Security option to appear in your site settings.

Microsoft Office Security Issues