#SharePoint Online Content Security Policy (CSP) enforcement

Content Security Policy (CSP) is an essential browser feature that protects web apps from XSS, clickjacking, and code injection. By letting administrators control which resources a page loads, CSP helps prevent malicious code execution. Microsoft will start CSP enforcement on March 1st, 2026. After this date, collection of page activity data and web parts could stop working without further action. Depending on your installation method and timing, no action may be required but it is imperative that you check your settings to ensure data will continue to be collected after March 1st, 2026. For customers that are affected who do not take action, an irreversible data gap will occur until the issue is resolved.

#Validating Trusted Script Sources

The new Script sources page in the Microsoft Admin Center allows you to specify which URLs from which you can safely load script including AvePoint. To validate your configuration go to Trusted Script Sources: SharePoint Online Admin Center > Advanced > Script sources. In our testing, we have seen that Microsoft has automatically imported script sources some of the time so no action may be needed. However, you should check and make sure the relevant scripts below are included.

For legacy tyGraph Pages:

https://tygraphpagescdn.azureedge.net/logger/

https://tygraphpagescdn.azureedge.net/webparts/

For AvePoint tyGraph:

https://config.tygraph.cdn.avepointonlineservices.com/pagesengine/

https://config.tygraph.cdn.avepointonlineservices.com/pageswebpart/

Please ensure the relevant URLs for your current installation are included in your Script sources list. As an alternative, you can choose to uninstall and reinstall both tyGraph pages packages which will add the required URLs to the list automatically. If you are a legacy tyGraph customers upgrading to AvePoint tyGraph and you complete the process before March 1st, 2026, no additional action will be required.