Updating and using the property bag in 2024

It’s an old but useful feature, the property bag. It’s a key-value store that can be used to store metadata about a site or a list and it’s been around since SharePoint ran on premises. It has something to do with NoScript though. This blog post describes how you need to work with it in 2024.

Introduction

The SharePoint property bag is a versatile key-value store that has been a part of SharePoint since its early on-premises versions. It allows administrators and developers to store metadata about a site or list, which can be used for various purposes. Specific key-value pairs can even be indexed by SharePoint search, allowing even more interesting scenario’s. The property bag does not have a dedicated user interface, making it accessible primarily through PowerShell scripts or custom code. The feature remains relevant even with the modern changes in SharePoint. Think about searching through all project sites on your tenant using metadata, like a project number, or a department name. It’s a very interesting feature to use, and it’s still around in 2024.

The property bag on NoScript sites

In 2024, Microsoft is pushing a change (Link to the message center here) that impacts the use of the property bag. The change is related to the NoScript setting for SharePoint sites, which imposes certain restrictions. NoScript is a setting on sites that results in custom scripts (injected JavaScript) not being allowed to run. This restriction is enforced to improve security and prevent malicious scripts from running on SharePoint sites. It’s been around for quite a while, but till recently you still had the opportunity to disable NoScript on specific sites if you liked to do so. But Microsoft has recently started to enforce this restriction even more. If you disable NoScript starting from November 2024, Microsoft will re-enable the NoScript setting after 24 hours.

NoScript is a perfectly fine security measure, if you ask me. Instead of injecting JavaScript files into SharePoint, we should always use SharePoint Framework (SPFx), which is the defacto standard for building customizations on SharePoint anyway.

However, for some odd reason, the NoScript setting also affects the use of the property bag. Updating the property bag on a site with NoScript enabled returns the following error:

Set-PnPPropertyBagValue -Key MyKey -Value MyValue
# Returns error: Set-PnPPropertyBagValue: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)) Site might have NoScript enabled, this prevents setting some property bag values.

So setting property bag values is dependant on the NoScript feature being disabled. I’m not sure why this is the case, but I’m sure some SharePoint dinosaur could tell you the logic behind it. 🦕 😉 So if you want to update the property bag nowadays, you’ll need to first disable a security setting, which kind of feels icky, doesn’t it?

In PowerShell, this would result in us having to do something like this to update a property bag value:

# First disable the NoScript setting
Set-PnPTenantSite -Url "https://contoso.sharepoint.com/sites/sales" -DenyAddAndCustomizePages:$false

# Update the property bag
Set-PnPPropertyBagValue -Key MyKey -Value MyValue

# Re-enable the NoScript setting
Set-PnPTenantSite -Url "https://contoso.sharepoint.com/sites/sales" -DenyAddAndCustomizePages:$true

🤢 It works… but ieewww, right? 🤢

A new tenant-wide setting

Luckily, Microsoft has introduced a new tenant-wide setting that allows you to update the property bag even when the NoScript setting is enabled. This setting is called AllowWebPropertyBagUpdateWhenDenyAddAndCustomizePagesIsEnabled. The setting is currently available in the latest versions of CSOM and the SharePoint Online Management Shell, and can be set using the Set-SPOTenant cmdlet. But I’m sure PnP PowerShell and the CLI for Microsoft 365 will soon follow with a similar option.

Run the following script to install the latest version of SharePoint Online Management Shell and set the new tenant-wide setting:

Install-Module Microsoft.Online.SharePoint.Powershell -Force

Connect-SPOService -Url "https://contoso-admin.sharepoint.com" -ModernAuth:$true
Set-SPOTenant -AllowWebPropertyBagUpdateWhenDenyAddAndCustomizePagesIsEnabled $true

The change is almost immediate, and you can now update the property bag on sites with the NoScript setting enabled.

Updating the property bag

I’ll demonstrate updating the property bag using PnP PowerShell. First, connect to your site using Connect-PnPOnline. Next, be sure to check if the NoScript setting is indeed enabled on your site. You can do this using the Get-PnPTenantSite cmdlet.

$site = Get-PnPTenantSite -Url "https://contoso.sharepoint.com/sites/sales"
$site.DenyAddAndCustomizePages # If this returns 'Enabled', NoScript is enabled.

Then set the property bag value using Set-PnPPropertyBagValue.

Set-PnPPropertyBagValue -Key MyKey -Value MyValue

And that’s it! You’ve updated the property bag on a site with the NoScript setting enabled.

Conclusion

The property bag is an old but useful feature, but it remains relevant in 2024. Even if other old features are being retired, this one has been polished up by Microsoft. So, don’t worry, the property bag is here to stay!

Happy coding!! 🚀

Sources

• Microsoft Docs - Set-SPOTenant
• Microsoft Admin Message Center - changes to NoScript
• PnP PowerShell - Set-PnPTenant
• CLI for Microsoft 365 - spo tenant settings set