How to Use Restricted Content Discovery to Govern Microsoft 365 Copilot

Updated 8 October 2026: Microsoft is retiring Restricted SharePoint Search, so this guide now covers its replacement, Restricted Content Discovery.

Important: This article is general guidance only and is not tailored to your environment. Before you run any PowerShell or change settings in production, review the commands against current Microsoft Learn documentation and test them in a non-production environment, such as a test tenant or a non-critical test site. Changes to search discovery and site access can affect users and Copilot results, so plan a rollback and keep a record of your changes.

Restricted Content Discovery (RCD) is a site-level setting in SharePoint Advanced Management (SAM). It keeps the content of selected SharePoint sites out of organisation-wide search and Microsoft 365 Copilot responses while you review who can access them.

If you are preparing Copilot for an Australian organisation, this is the control Microsoft now points to for oversharing. It sits inside a four-step sequence from Microsoft's secure and governed foundation guidance: identify high-risk sites, apply interim protections, fix access, then remove the interim protections. This guide follows that order.

Why this matters for Australian organisations

Copilot respects existing permissions. It does not fix them. If a site was shared with "Everyone except external users" years ago, Copilot can surface that content to anyone who asks a relevant question.

The Privacy Act 1988 and the Australian Privacy Principles (APPs) require reasonable steps to protect personal information. When Copilot summarises a file, it is processing stored content for the user. Employee records on a stale HR site or customer correspondence on an ungoverned team site are the cases to find first.

You can get a view of your current posture with the free SharePoint and Teams Governance Assessment before you change anything.

What changed: Restricted SharePoint Search is retiring

Earlier versions of this guide explained Restricted SharePoint Search. Microsoft is retiring it and has moved to block new enablement. It was a temporary measure limited to an allow list of 100 sites, and Microsoft states it is not a security boundary. It could also reduce Copilot answer quality by limiting the reference material available.

If your tenant already has it switched on, Microsoft's advice is to use it only temporarily, fix oversharing with SAM, apply Microsoft Purview controls, then disable it. Microsoft has not published an end date for tenants that already enabled it. Our companion article, Restricted SharePoint Search is retiring, covers that situation.

Prerequisites

• A Microsoft Copilot licence. Microsoft states RCD is intended for Copilot deployment and governance scenarios.
• SharePoint Advanced Management, which is included with Microsoft Copilot licences. Review Microsoft's SAM prerequisites page before you start.
• The SharePoint Online Management Shell (Microsoft.Online.SharePoint.PowerShell module) and an admin role that can manage sites. Connect first with Connect-SPOService -Url https://<tenant>-admin.sharepoint.com, replacing <tenant> with your tenant name. In the commands below, replace the example site URL and group ID with your own, and keep the quotation marks.
• A named owner for each site you plan to restrict. Without one, nobody can complete the review.

Step 1: Identify high-risk sites

Start with evidence, not guesses. Microsoft lists these tools for finding sites that need review:

• Data access governance reports in SAM. They cover site permissions, sharing links and "Everyone except external users" (EEEU) access. Sensitivity labels for files in these reports need Microsoft 365 E5.
• Content management assessment and the SharePoint Admin Agent, which help you find sites that need attention.
• Microsoft Purview Data Security Posture Management (DSPM) data risk assessments, which find overshared sites that hold sensitive data. The DSPM for AI walkthrough covers this step.

Record each site, its owner, why it is high risk and what you plan to do about it. Finance, HR, legal and executive sites are the usual starting points.

Step 2: Apply interim protections

Interim protections give you time. They do not fix the underlying problem.

Restricted Content Discovery for a site

In the SharePoint admin centre, expand Sites and select Active sites. Select the site, open the Settings tab, turn on "Restrict content from Microsoft Copilot" and select Save.

To do the same in PowerShell, run this against each site URL:

Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/Finance" -RestrictContentOrgWideSearch $true

Check the status of a site at any time:

Get-SPOSite -Identity "https://contoso.sharepoint.com/sites/Finance" | Select-Object RestrictContentOrgWideSearch

What to expect, per Microsoft Learn:

• Permissions do not change. People who already have access can still open the content directly.
• Users can still discover content they own or recently interacted with.
• The content stays in the Microsoft 365 search index, so Purview features such as eDiscovery and auto-labelling continue to work.
• Users no longer see AI entry points on the site, such as the Copilot button, AI actions or Create pages with AI.
• Changes take time to propagate. For sites with more than 500,000 items it can take more than a week.

DLP for Copilot

Microsoft pairs RCD with DLP for Copilot as an interim protection. A DLP policy can keep labelled content out of Copilot grounding, or block prompts that contain sensitive data. It also covers locations RCD cannot, because RCD does not apply to OneDrive.

Delegation and audit

By default only SharePoint administrators manage RCD. You can let site administrators manage it for their own sites, and they must give a justification for each change:

Set-SPOTenant -DelegateRestrictedContentDiscoverabilityManagement $true

To check the delegation status, run Get-SPOTenant | Select-Object DelegateRestrictedContentDiscoverabilityManagement.

Enabling and disabling RCD, and the justifications, appear as events in the Microsoft Purview audit log. Keep that record with your governance evidence.

Step 3: Fix access

This is the real work. While sites are restricted, remediate them.

1. Run site access reviews. SAM lets you delegate access reviews to site owners, so the people who know the content decide who keeps access.
2. Remove broad sharing. Remove EEEU grants and unneeded sharing links that the data access governance reports found.
3. Apply Restricted Access Control (RAC) where a site should be limited to a defined group. RAC limits access to members of a Microsoft Entra security group or Microsoft 365 group. People outside the group lose access even if they held a link or earlier permission. Copilot and organisation-wide search honour the policy.
4. Apply site sensitivity labels and ownership policies so access stays right after the review.

To turn RAC on for the tenant and apply it to a site:

# Tenant-wide setting. It can take up to one hour to take effect.
Set-SPOTenant -EnableRestrictedAccessControl $true

# Per site. Use the object ID (GUID) of the Entra security group or Microsoft 365 group.
$site = "https://contoso.sharepoint.com/sites/Finance"
Set-SPOSite -Identity $site -RestrictedAccessControl $true
Set-SPOSite -Identity $site -AddRestrictedAccessControlGroups "00000000-0000-0000-0000-000000000000"

# Confirm the result
Get-SPOSite -Identity $site | Select-Object RestrictedAccessControl, RestrictedAccessControlGroups

Two points from Microsoft Learn matter here. Adding someone to the control group does not give them access by itself, because they need both site permission and group membership. And a site can have up to 10 control groups. Shared and private channel sites are separate sites, so configure each one on its own.

Step 4: Remove the interim protections

When a site's access is fixed and reviewed, take RCD off so its content is discoverable again:

Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/Finance" -RestrictContentOrgWideSearch $false

Microsoft designs RCD as temporary, and heavy use reduces the completeness of search and Copilot answers. Treat every restricted site as having an end date and an owner.

To see where RCD is on across the tenant, generate a report, check its status, then download it using the report ID from the status output:

Start-SPORestrictedContentDiscoverabilityReport
Get-SPORestrictedContentDiscoverabilityReport
Get-SPORestrictedContentDiscoverabilityReport -Action Download -ReportId "<report-GUID>"

Test before you tell people

1. Restrict a test site that holds a distinctive phrase.
2. Wait for propagation, then sign in as a standard user and search for the phrase. It should not appear in organisation-wide search or Copilot answers.
3. Confirm the owner can still reach the content directly.
4. Repeat after you remove the restriction to confirm discovery returns.

Common mistakes

Restricting too many sites. Microsoft cautions that excessive use reduces the content available to Copilot. Restrict by evidence.

Treating discovery restriction as an access fix. RCD hides content from search and Copilot. People with permission can still open it. Fix permissions or use RAC.

Leaving sites restricted indefinitely. Without an end date, the restriction becomes permanent and Copilot answers degrade quietly.

Forgetting OneDrive. RCD is not supported for OneDrive. Use labels and DLP for Copilot there.

What comes next

Once access is fixed, move on to guardrails: secure defaults, auto-labelling, DLP for Copilot and insider risk controls, then retention, audit and eDiscovery. For the decision of which sites get RCD or RAC, read Choosing which SharePoint sites to restrict for Copilot. If you are not sure where your gaps are, start with the free SharePoint and Teams Governance Assessment.

Disclaimer: this article is general guidance, not professional advice. Review and test all changes in a non-production environment before you apply them in production.

Sources: Microsoft Learn pages on Restricted Content Discovery, Restricted Access Control, Restricted SharePoint Search (retirement notice), SharePoint Advanced Management and the secure and governed foundation for Microsoft 365 Copilot, checked 8 October 2026.