Overview
Microsoft is introducing Content Security Policy (CSP) enforcement in SharePoint Online to improve security by restricting where scripts can load from. This change impacts how scripts and customizations load, including SharePoint lists and SPFx extensions used within Microsoft Teams tabs.
Important: Upcoming SharePoint Content Security Policy (CSP) Changes
- CSP is currently running in report-only mode.
- Enforcement begins March 1, 2026, with a limited, optional delay available to administrators.
- Once enforcement starts, scripts loaded from untrusted sources will be blocked by the browser, which may cause existing customizations or extensions to stop working.
SFT announcement: https://learn.microsoft.com/en-us/sharepoint/dev/spfx/content-securty-policy-trusted-script-sources
What this means for you
To remain compatible with these changes and avoid disruptions, customers must upgrade to the latest versions of our SPFx packages.
The latest SPFx packages automatically:
- Register all required trusted script sources with SharePoint.
- Align with Microsoft’s CSP guidance and enforcement requirements.
- Prevent CSP-related runtime issues once enforcement is enabled.
What happens if you do not upgrade
Existing (older) SPFx packages will continue to function, however, no further updates or fixes will be pushed to these packages.
Older package versions may reference script sources that are not automatically trusted. Once CSP enforcement begins, this can result in blocked scripts, broken functionality, and loss of compatibility with future SharePoint updates.
Recommended action
We strongly recommend planning an upgrade to the latest SPFx package versions as soon as possible to ensure a smooth transition ahead of Microsoft’s Content Security Policy (CSP) enforcement.
The updated SPFx packages are available at the links below:
SharePoint Online
FORMS (Version 1.2.1.0)
https://catalog.kwizcom.com/sites/pc/Packages/kwizcom-modern-apps-upgrade.sppkg
Data View Plus (Version 1.1.1.0)
https://catalog.kwizcom.com/sites/pc/Packages/kwizcom-data-view-tools.sppkg
SharePoint 2019 / Subscription Edition
FORMS
https://catalog.kwizcom.com/sites/pc/Packages/kwizcom-modern-apps-upgrade-onprem.sppkg
Data View Plus
https://catalog.kwizcom.com/sites/pc/Packages/kwizcom-data-view-tools-on-prem.sppkg
Instructions on how to upload and deploy the package can be found in the Manual Installation Guide for the kwizcom-modern-apps-upgrade package.
CMS365
The CMS365 requires Package version 1.0.0.3, which can be downloaded from the App Store
Upgrading enables the new CSP-compliant SPFx packages, which automatically register the required trusted script sources in SharePoint and help prevent script blocking and functionality issues once CSP enforcement is applied.
More information
For full details from Microsoft, refer to their official announcement on SharePoint Online Content Security Policy (CSP) enforcement dates and guidance.
Microsoft is currently testing this change. While CSP is intended to initially run in report-only mode, a Microsoft platform issue is causing unexpected blocking behavior when SharePoint content is rendered inside Teams tabs.
What is happening?
- SharePoint lists work normally when opened directly in a web browser.
- The same lists may not work correctly when added as Microsoft Teams tabs.
- Custom features such as buttons, fields, or SPFx extensions may be missing.
- In some cases, the Teams tab appears blank or partially broken.
Why is this happening?
Microsoft is testing CSP enforcement to improve security by restricting where scripts can load from. Due to a Microsoft bug, required SharePoint and SPFx components are being blocked when SharePoint lists are embedded in Teams tabs.
This is a Microsoft platform issue. It is not caused by customer configuration or tenant-specific settings.
Upcoming product update
To align with Microsoft’s upcoming CSP enforcement, we will release an updated set of SPFx packages. These new packages automatically add our scripts to SharePoint’s trusted script sources, ensuring compliance with CSP requirements.
Key points:
- Existing SPFx packages will continue to function normally for now.
- To receive future updates and to ensure continued functionality once CSP enforcement is enabled, customers will need to upgrade to the new SPFx packages.
- The new packages are required to maintain compatibility after CSP enforcement begins in March 2026.
What can customers do now?
Temporary workarounds
- Open SharePoint lists directly in a web browser using a link instead of a Teams tab (recommended).
- Use the SharePoint app inside Microsoft Teams instead of custom list tabs.
- Monitor communications for the upcoming SPFx package update and plan to upgrade when available.
Important notes
- Administrators cannot resolve this issue through tenant settings.
- Adding trusted sources manually or changing configuration does not fix the current Teams tab behavior.
- A full resolution for the Teams tab issue requires a fix from Microsoft.
Next steps
- Customers experiencing this issue are encouraged to report it to Microsoft Support so it can be addressed by Microsoft engineering before full CSP enforcement goes live in March 2026.
- Customers should also plan to update to the new SPFx packages once released to ensure long-term compatibility with CSP changes.
For additional background on CSP enforcement and SPFx updates, refer to the Microsoft Tech Community announcement.
Frequently Asked Questions
Q: Will KwizCom SPFx solutions work with the new SharePoint CSP rules?
A: Yes. KwizCom SPFx solutions are compatible, once upgrading to the latest SPFx packages before Microsoft’s CSP enforcement.
Q: Why are my forms not loading anymore?
A: Make sure you have installed the latest supported Modern package (Version 1.2.1.0).
Q: Why are CMS365 pages showing up blank?
A: CMS365 pages may appear blank if scripts are blocked by SharePoint CSP or your SPFx package is outdated. Make sure all KwizCom script URLs are trusted and SPFx packages are up to date (Version 1.0.0.3).
For any additional questions, please reach out to our support team at support@snapon-software.com.