SPFx CDN Configuration for CSP Compliance

From March 1st 2026 Microsoft will introduce stricter Content Security Policy rules.

This means that scripts and stylesheets will only be loaded if they are defined in the manifest on the site in question.

When installing WorkPoint 365 using the online web installer, the WorkPoint 365 Modern UI app is deployed to the tenant app catalog.

In that case the URL pointing to the WorkPoint CDN containing scripts and stylesheets, is automatically whitelisted, and you don't need to take any action.

In some cases the Modern UI app is deployed to a site collection app catalog instead. Going forward Microsoft will no longer automatically whitelist the CDN URL's.

This means that this needs to be managed manually by a global admin on the tenant.

A user with Global Admin access.

To ensure that the relevant resources can be reached by when needed, the following URL must be white listed.

*.workpoint365.com

To manually do this you must go add it into the "Trusted script sources" section in the SharePoint admin center.

Either find it by opening the SharePoint admin center, expanding "Advanced", and navigating to "Script sources", or open the following link.

https://TENANTNAME-admin.sharepoint.com/_layouts/15/online/AdminHome.aspx#/contentSecurityPolicy

Example:

When the URL has been added, the app should be able to fetch all the required content again, and no further steps need to be taken.