How to fix the ACCESS DENIED error when restoring backed-up SharePoint data
When restoring backed-up SharePoint sites by using CodeTwo Backup, you might receive the following or similar error:
Access denied. You do not have permission to perform this action or access this resource.
The error prevents the program from finishing the restore job successfully.
This error is connected with the Custom Script settings in SharePoint admin center. Running custom script allows users to customize SharePoint sites. By default, custom script is allowed only on sites created by SharePoint admins but blocked on sites created by users, on OneDrive sites, and on the root site collection. If custom script is blocked, it prevents CodeTwo Backup from restoring the backed-up content.
To fix this error, you need to allow custom script. You can change the Custom Script settings:
- in the SharePoint admin center (does not apply to team sites);
- or via SharePoint Online Management Shell (does not apply to OneDrive sites)
Changes to the Custom Script settings made by using SharePoint Online Management Shell take effect immediately. On the other hand, by allowing custom script in the SharePoint admin center, you need to wait up to 24 h for the changes to propagate.
Also, keep in mind that changes made through SharePoint Online Management Shell will be overwritten by the Custom Script settings in the SharePoint admin center within 24 h.
- Log in to Office 365 and click Admin to open Microsoft 365 admin center (Office 365 admin center).
- In the left pane, expand Admin centers and click SharePoint (Fig. 1.).
- In the SharePoint admin center, access settings from the menu on the left (Fig. 2.).
- Scroll down to the Custom Script settings (Fig. 3.) and select the following options:
- Allow users to run custom script on personal sites
- Allow users to run custom script on self-service created sites
- Click OK to save changes.
- Open the SharePoint Online Management Shell command prompt.
- Connect to your SharePoint Online by using the following command:
Connect-SPOService -Url https://<organization>-admin.sharepoint.com -Credential <admincredential>where <organization> is the organization name set in Office 365, and <admincredential> is the email address of your Office 365 global administrator or SharePoint administrator. Enter the admin password when prompted.
- Run the following cmdlet:
Set-SPOsite <siteURL> -DenyAddAndCustomizePages 0where <siteURL> is the URL of the specific SharePoint site collection or team site.