Add and Customize Pages Permission Denied to Site Collection Administrator

In SharePoint online, you may come across strange access denied issue working with SharePoint Designer, Master pages, style libraries and Page Layout not just for users with Designer, Full Control access but even for Site Collection Administrator.

On verifying the permission of the user, you will see explicit Deny permission for "Add and Customize Pages" is applied. See the following screenshot for the Deny permission.

The Deny permission cannot be removed using the standard permission management procedure in SharePoint.

Also, you will find this issue with the root site collection in SharePoint online.

To get rid of the issue, perform the steps outline by Microsoft in the article - Turn scripting capabilities on or off

The scripting needs to be allowed SharePoint Admin Center and if you need it on immediate basis you must use power shell command.

NOTE: If you miss to enable scripting in SharePoint Admin Center, the change performed by the power shell command will be reverted after 24 hours.

Allow Custom Script in SharePoint Admin Center

1. Go to SharePoint Admin Center

2. Select Settings

3. Under Custom Scripts sections, you will see option to Allow / Disallow custom script on persoanl sites and Self-Service sites

4. To get rid of the permission issue permanently, you need to select following options:

1. Allow users to run custom script on personal sites
2. Allow users to run custom script on self-service created sites

The changes done will require up to 24 hours to get reflected. To make the change immediately you must use the power shell command. Also, as described by Microsoft, change the custom script setting will affect the root site collection. If you need to apply this change to another site collection, you must use the same power shell command to perform the change to different site collection. 

Power Shell Command to remove Deny Permission

1. Open SharePoint Online Management Shell 

2. Enter the following line, replace the Site URL with your site collection URL and press enter.

Set-SPOsite "SiteURL" -DenyAddAndCustomizePages 0