Microsoft recently made changes around look and feel customizations for SharePoint Online.
If you create a new site collection and try to edit page layouts, master pages or even image renditions, there’s a high chance you’ll get an access denied error message. That even if you’re site collection administrator.
Investigating further and checking your permissions on the master page gallery library, you will notice that every and each user has a “deny” permission for “Add and Customize Pages”. That permission level is not one of the originals we’re used to in SharePoint.
It comes from the tenant settings now providing an option for the tenant administrator to “traditional” branding in SharePoint.
Two ways to unlock this: PowerShell or the Tenant administration interface.
You’ll need to have the SharePoint Online Management Shell installed on your machine:
Connect-SPOservice -Url https://tenant-admin.sharepoint.com
Set-SPOsite https://tenant.sharepoint.com -DenyAddAndCustomizePages 0
(note that this setting only unlocks one site collection, but right away)
If you don’t want to write some PowerShell, go to the tenant administration, in the menu, select the SharePoint administration. Go to settings, scroll a little bit and check “Allow users to create Site Pages”.
If you’re doing to advanced customization you might also want to check “Allow users to run custom script on personal sites” and “Allow users to run custom script on self-service created sites” which will allow you to execute PowerShell against these sites.
Thanks Mike for pointing this setting out when I was pulling my hair.
Happing SharePoint customizing.