SharePoint HTML Pages Now Run 5 JavaScript Libraries

TL;DR: SharePoint HTML pages can now use Chart.js, Mermaid, React, Fluent UI and Babylon from a Microsoft-managed CDN, inside a locked sandbox. HTML pages are on by default, reach general availability from mid-November 2026 and can't be turned off tenant-wide. Set site-level rules, an authoring standard and one measured pilot before then.

SharePoint HTML pages just went from static pages to small apps. Anyone who can create pages on a site can now publish interactive charts, process diagrams, 3D scenes and React mini-apps on live list data, with no developer, no SharePoint Framework (SPFx) package and no app catalog review. Pages are on by default, general availability starts in mid-November, and there is no tenant-wide switch to turn them off.

A SharePoint HTML page is an .html file stored in a site's Site Pages library that SharePoint renders as a page inside a sandboxed iframe, separate from the site's header, footer and navigation. Microsoft announced HTML pages in Message center post MC1479517 on September 25, 2026. This week Microsoft's Content AI product team showed what the five named libraries unlock for organizations in the Frontier program: a 3D explorer, a Mermaid process map and a React and Fluent UI command center browsing 30,000 transactions.

We covered the intranet opportunity in SharePoint HTML pages: a new way to think about your intranet. This piece is the IT leader's view: what changed, what stays locked and what to set up before general availability.

What is changing with SharePoint HTML pages, and when?

HTML pages become a standard page type in every SharePoint site between mid-November and late December 2026, and the five JavaScript libraries are already live for Frontier customers. Here is each change, its timing and what it means for you.

Which JavaScript libraries can SharePoint HTML pages use?

SharePoint HTML pages can use five libraries: Chart.js, Mermaid, React, Fluent UI and Babylon, all served from a Microsoft-managed CDN. JavaScript you write inside the same HTML file also runs, but scripts from any other CDN or open-source location are not loaded.

Each library suits a different job. Use this map to choose the right one, pick a first page and decide what to check before it goes live.

Start with Chart.js and Mermaid. They solve the most common intranet problem, information scattered across slides, spreadsheets and emails, with the least to maintain. Bring in React, Fluent UI and Babylon once you have an owner and a review habit in place. When a page needs to collect or change data, it has become an app, and our IT leader's guide to Copilot Studio apps, workflows and agents shows where those belong.

What stays locked inside the SharePoint HTML sandbox?

Almost everything that matters for security stays locked: the five libraries add capability, not reach. SharePoint renders each page in a sandboxed iframe with Content Security Policy rules, so the page can't touch the rest of SharePoint or call out to the internet.

• No outbound calls. Arbitrary fetch requests, outbound API calls and cross-tenant communication are blocked. Live data comes only from SharePoint lists, Excel and CSV.
• No other scripts. Only the Microsoft-managed versions of the five libraries load, and the sandbox can't use browser localStorage.
• Links need approval. Links to another tenant or outside SharePoint open only for domains on the site's HTML Field Security allow list.
• Some page features are missing. HTML pages can't yet be promoted to news, amplified to Microsoft Teams or Viva Engage, scheduled, co-authored, saved as templates or used with comments and reactions. The HTML file itself is capped at 10 MB.
• Copilot licensing is narrow. A Microsoft 365 Copilot license is needed only to create or edit a page with Copilot. Uploading, direct editing, publishing and viewing don't require one.

One detail deserves attention in healthcare, financial services and HR. Live data loads with each viewer's own permissions, but numbers pasted into the HTML file are visible to everyone who can open the page. Keep sensitive figures in the list, not in the markup.

The sandbox protects your tenant. It doesn't check whether the page is right.

Why do five libraries change your SharePoint governance?

They turn a page into a small application that anyone with page rights can publish, with no tenant switch and no app catalog review. Until now, custom interactive interfaces in SharePoint meant SPFx: a developer, a package and a deployment check. React, Fluent UI and live list data now deliver much of that inside a page.

In 2toLead's governance reviews, attention goes to SPFx packages, Power Apps and agents. HTML pages won't appear in those inventories, and Copilot can produce a convincing dashboard from a stale copy of a spreadsheet in minutes. This is the same shift we described in what an intelligent intranet looks like with Copilot and SharePoint: the intranet becomes a place where content is generated, so ownership matters more than layout.

• Nonprofit: program and impact dashboards built from a list, without a developer budget. Only authors who use Copilot need a Copilot license; HTML built in other tools can be uploaded without one.
• Education: interactive explainers, diagrams and 3D models for teaching and staff onboarding. Check them against your accessibility obligations before they reach students.
• Government: the Message center post lists general availability for Worldwide, so government cloud tenants should confirm timing first. Keep HTML Field Security allow lists short on public-facing communication sites.

What should IT leaders do before general availability in mid-November?

Make six moves in the next three weeks: set site-level rules, publish an authoring standard, prepare your AI tools and run two measured pilots. Together they let you say yes to HTML pages without losing track of them.

1. Decide which sites allow HTML pages. HTML pages are on by default. On sites where official content must stay tightly controlled, such as HR policy, legal or regulated communications, ask the site owner to go to the Site Pages library, select File types and turn off Allow HTML files. Record the decision for each site.
2. Review HTML Field Security on hub and communication sites. Go to Settings > Site information > View all site settings > HTML Field Security. Keep external domains to an approved list, because those links will open from HTML pages.
3. Publish a one-page HTML authoring standard. Name the five libraries, the approved data sources, the accessibility check and the rule that anything writing data becomes an app. Give every page an owner and a review date, and add HTML pages to your Copilot-ready intranet governance checklist.
4. Point your AI tools at the /_html guidance. Share https://<tenant>.sharepoint.com/_html with makers who build in Copilot Cowork, GitHub Copilot or Copilot Studio. Turn your standard into a reusable skill so every generated page follows it; our guide to SharePoint skills and reusable AI workflows shows how.
5. Run two pilot pages with named owners. Build a Chart.js status page on a live list and a Mermaid process map. Measure views and hours saved for 30 days, then decide on React, Fluent UI and Babylon for wave two.
6. Brief authors and support teams. Explain the new + New > HTML page entry point, who needs a Copilot license and that publishing never grants new permissions. Microsoft recommends this in MC1479517.

How do you measure the value of a SharePoint HTML page?

Compare the hours people spend assembling the same information today with the page's upkeep, and track reach in page analytics. HTML pages get similar analytics to modern pages, so views and unique viewers come with no extra setup.

Here is an illustrative example; replace the figures with yours. A project management office has 15 project managers who each spend 3 hours a month turning a SharePoint project list into status slides: 45 hours. A Chart.js status page reads the same list live. Each project manager now spends 30 minutes keeping list items current, and the office lead spends 3 hours a month reviewing the page for accuracy: 10.5 hours.

That returns 34.5 hours a month. At an $80 loaded hourly cost, that is $2,760 a month, or about $33,100 a year. Building the page takes a Copilot-licensed author and a reviewer about 6 hours, or $480 once, and viewers need no additional license.

Track three numbers for 30 days: hours spent before and after, unique viewers, and whether status meetings get shorter. Report them alongside the Copilot adoption metrics that prove value, so finance sees one consistent story.

What do IT leaders ask about SharePoint HTML pages?

Four questions come up most: tenant control, supported libraries, licensing and external data.

Can you turn off SharePoint HTML pages for the whole tenant?

No. Microsoft states that HTML pages can't be disallowed or restricted at the tenant level. Site owners control them per site by turning off Allow HTML files under File types in the Site Pages library.

Which JavaScript libraries can SharePoint HTML pages use?

Chart.js, Mermaid, React, Fluent UI and Babylon, hosted on a Microsoft-managed CDN. JavaScript inside the same HTML file also runs. Scripts from other CDNs or open-source locations are not loaded, and the sandbox can't use localStorage.

Do you need a Microsoft 365 Copilot license for SharePoint HTML pages?

Only to create or edit a page with Copilot. Uploading HTML, editing text directly, publishing, sharing and viewing pages don't require a Microsoft 365 Copilot license, just the right SharePoint permissions.

Can SharePoint HTML pages call external APIs?

No. SharePoint blocks arbitrary fetch requests and outbound API calls from HTML pages. Pages can show live data from SharePoint lists, Excel and CSV, but not from third-party sources such as Jira.

How can 2toLead help?

2toLead helps organizations in healthcare, nonprofit, education, financial services, professional services, government and manufacturing adopt SharePoint and Copilot features with governance in place from day one. In a fixed-scope, two-week HTML Pages Readiness Sprint, our Microsoft MVP team will:

• Decide which sites allow HTML pages and set Allow HTML files and HTML Field Security
• Write your HTML authoring standard, covering the five libraries, data sources and review rules
• Package that standard as a skill your AI tools follow, alongside your tenant's /_html guidance
• Build two pilot pages on live list data: a Chart.js status page and a Mermaid process map
• Set a value baseline in hours saved and page analytics

For the full list of capabilities and limits, read Microsoft's guide to creating, uploading, editing and publishing HTML pages in SharePoint.

For everything else landing before March, our Microsoft 365 quarterly newsletter for November 2026 maps each deadline to an owner.

Find more practical guidance on the 2toLead Insights hub, or book an HTML Pages Readiness Sprint.

No hype. Just practical, governed AI that actually gets adopted.