Updated text regarding language and NoScript

[wobba]

• Updated text to reflect NoScript is possible for modern team sites.
• Added note about timeouts and MUI settings, and how to work around it.

[msftclas]

@wobba,
Thanks for having already signed the Contribution License Agreement. Your agreement was validated by Microsoft. We will now review your pull request.
Thanks,
Microsoft Pull Request Bot

[saldana]

✅ Validation status: passed

File	Status	Preview URL	Details
articles/modern-experience-customizations-customize-sites.md	✅Succeeded

For more details, please refer to the build report.

Note: If you changed an existing file name or deleted a file, broken links in other files to the deleted or renamed file are listed only in the full build report.

[VesaJuvonen]

Thing is that it should not be possible, so will not merge this for now. The fact that noscript can be disabled on modern sites is apparently a bug. Will though still double check the situation internally and will come back on this later.

[wobba]

Hmmm....if this is a bug then API's need to change, as enabling script is the only way to add more entries ti HTMLField security for example again. As well as uploading pre-configures aspx files. If this is blocked I'll have my ass handed to me with multiple customers for sure.

So, clear guidance if a bug or feature is imperative indeed.

[VesaJuvonen]

Absolutely get that... Will try to get this solved through out, before we make any final conclusions.

[wobba]

The most important part in the PR is actually the note on languages and applying composed looks, based on a support ticket I had.

Some food for thought on the script issue. What about enrolling/upgrading existing sites to a Group? I'd be fine if this was the recommended way.

Also, applying composed look works with CSOM directly on NoScript, while prov templates won't work.

And I'm all for having NoScript on, and we have it off for all Group sites as well. We just happen to turn it on during provisioning to set up the site with composed look and content, then turn it back off. And we've discussed this before so you know the gaps. It's not about hacking things script wise, but using regular SP func also in modern sites. :) So appreciate you following up on this.

[wobba]

Interesting point: https://msdn.microsoft.com/en-us/pnp_articles/modern-experience-customizations-customize-lists-and-libraries has a reference to disabling scripting on modern sites :)

You however can disable NoScript in "modern" sites to achieve the same behavior for "modern" list and libraries across "classic" and "modern" sites.

[phillipharding]

Tried to disable NoScript on a Modern site this PM, which was unsuccessful
But I was able to disable NoScript on a Group site

Is this expected behaviour?

[wobba]

@phillipharding A modern site is per def today a Group site - that's how it's talked about. A team site (listed on sites pages in SPO admin) has by default scripting turned on. You can however make a team site noscript if you want. So a team site can still have all the moderness, and thus be a Modern Site ;) Which is why I like to talk about the site templates, GROUP#0 vs STS#0, as it's all technical.

[wobba]

@VesaJuvonen, wanted to add a bit more on the issue regarding Modern sites. Seems when we provision Groups via app-only, Sharing from the SP UI is disabled on the site collection. We then use Set-PnPTenantSite (Tenant.SetSiteProperties) to enable direct sharing from the site. If we then run any Set-PnPTenantSite without specifying the -Sharing value explicit, meaning it shouldn't be changed, it's reset to Disabled.

So setting tenant properties on Group sites seems a bit unstable - so proper guidance on what is supported and allowed is becoming more and more important. And I guess Sharing from the site itself should be supported - if I want to share a file outside of the Groups members.

Also, if I crate a Group via the UI, then sharing is set on the site collection, and not disabled as it is when creating via app-only. :) Fun stuffs!

[VesaJuvonen]

Hi Mikael,
I've manually now merged key parts of this to the article. After internal review, we have decided that we do support disabling 'noscript' setting also from the modern site. This should now be reflected with the customization article.

[wobba]

Great, and we good to have guidance on this :)