I came across an issue in an Office 365 tenancy where SharePoint – Site Collection Admins were getting “Access Denied” errors when they tried to work with assets in the Master Page gallery.

The Solution:

1. Open SharePoint Online Management Shell with Administrative rights
2. run: ​Connect-SPOService https://tenant-admin.sharepoint.com (change tenant with your URL)
3. Get-SPOSite -Identity “https://tenant.sharepoint.com” | fl *
4. DenyAddAndCustomizePages should be Disabled, in order to disable it run the following command
5. Set-SPOSite -Identity “https://tenant.sharepoint.com” -DenyAddAndCustomizePages $false