The process of building custom applications and tools that interact with Microsoft SharePoint, including SharePoint Online in Microsoft 365.
Having a tenant-wide issue that takes down custom forms across all lists and sites for multiple clients is certainly a critical situation. I understand that your SPFx Forms-Customizers have suddenly stopped working and you are looking to confirm if a recent Microsoft rollout is the root cause.
At this time, Microsoft has not released any official service health advisories or announcements regarding an outage or intentional change designed to break SPFx Form Customizers. However, there is a major recent rollout in SharePoint Online that is almost certainly causing this exact behavior.
As of March 1, 2026, Microsoft officially began enforcing Content Security Policy (CSP) in SharePoint Online. This is a tenant-level security change that directly impacts SPFx solutions. When CSP is enforced, SharePoint automatically blocks inline JavaScript, scripts loaded from untrusted sources, and dynamic script injection patterns. If your Form Customizer relies on any of these methods, the extension will fail to load, typically without displaying any obvious error messages on the user interface.
To prevent your solutions from breaking, you will need to take the following steps:
- Trust External Scripts: Ensure all external script locations your web parts use are added as trusted script sources. This can be configured at the tenant level without needing to update the SPFx solution code itself.
- Remove Inline Scripts: You must move all inline scripts to external
.jsfiles, which can then be defined as trusted sources. Note: This step will require updating and redeploying the SPFx solution package.
How to identify blocked scripts:
You can easily find out which script locations need to be added to the trusted list by opening the browser's Developer Tools (F12) console while trying to load the form. You will see warning messages indicating the blocked scripts. Look for console errors starting with:
"Loading the script '<path to script>' violates the following..." > or "Executing inline script violates the following Content Security Policy directive..."
If your team needs more time to review and update the affected SPFx solutions, there is an option to postpone the CSP enforcement by 90 days. A SharePoint Administrator can apply this delay by running the following cmdlet in the SharePoint Online Management Shell:
Set-SPOTenant -DelayContentSecurityPolicyEnforcement $true
Note: This option is available in the SPO Management Shell version 16.0.26712.12000 (November 2025) or higher.
I hope this information helps.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.