Updated 8 October 2026: Microsoft is retiring Restricted SharePoint Search, so this guide now covers how to choose which sites get its replacements.
Important: This article is general guidance only and is not tailored to your environment. Before you change settings or run any scripts in production, review them against current Microsoft Learn documentation and test them in a non-production environment first.
The earlier version of this article was about curating an allow list of up to 100 sites. That control is retiring. Microsoft blocked new enablement from 31 July 2026 and states it was never a security boundary. The decision you now face is the reverse: not which 100 sites Copilot may see, but which few sites need extra protection while their access is fixed.
Microsoft offers two tools for that. Restricted Content Discovery (RCD) keeps a site's content out of organisation-wide search and Copilot responses without changing permissions. Restricted Access Control (RAC) limits a site to members of a named group. This guide helps you choose between them, pick the sites and review the choices.
If you want the configuration steps, read How to use Restricted Content Discovery to govern Microsoft 365 Copilot. For what the retirement means for your tenant, read Restricted SharePoint Search is retiring.
Two controls that do different jobs
Restricted Content Discovery. A site-level SAM setting. Content from the site stays out of organisation-wide search and Copilot responses. Permissions do not change, so people who already have access can still open the content. Users can still discover content they own or recently interacted with. It also removes AI entry points such as the Copilot button on the site. Microsoft designs it as temporary, and it is not supported for OneDrive.
Restricted Access Control. A SAM feature that limits access to a site to members of a Microsoft Entra security group or Microsoft 365 group. People outside the group lose access even if they had a link or earlier permission. Copilot and organisation-wide search honour the policy. A user needs both site permission and group membership to get in.
The practical difference: RCD buys time, RAC changes the answer to "who can see this".
Use evidence to build the candidate list
Do not let departments nominate sites by preference. Start with the reports Microsoft lists:
- SAM data access governance reports for site permissions, sharing links and "Everyone except external users" (EEEU) access. Sensitivity label reporting for files needs Microsoft 365 E5.
- Content Management Assessment and the SharePoint Admin Agent.
- Microsoft Purview DSPM data risk assessments, which find overshared sites that hold sensitive data.
- Site ownership and inactive-site policies, which show sites with no accountable owner.
These reports tend to surface four kinds of problem site:
- Broad access. EEEU holds edit or contribute rights, so every internal user can reach the content.
- Wide sharing links. Links that reach beyond the people who need them.
- Labelling gaps. Labelled and unlabelled documents sit together, which signals labelling debt.
- No accountable owner. The owner has left or is unknown, so nobody can answer an access review.
Decide the control for each site
Use the answers to two questions.
Does the site hold content that must not be discoverable by Copilot while you work? If yes, RCD is the quick interim step.
Should only a defined group ever have access? If yes, RAC is the lasting fix. Typical examples are executive, HR case and legal matter sites.
| Situation | Starting control | Then |
|---|---|---|
| Overshared, owner can fix it in weeks | RCD | Run a site access review, then remove RCD |
| Content should only ever be seen by a defined group | RAC | Keep RAC, review group membership |
| Sensitive content spread across many sites | DLP for Copilot, labels | Use RCD only on the worst sites |
| No owner | RCD | Assign an owner first, then review |
| Low risk and well governed | Neither | Leave it discoverable |
The last row matters. Microsoft warns that excessive use of RCD reduces the content available to search and Copilot and can affect the completeness and relevance of answers.
Score the candidates
A rubric stops the loudest team winning. This one is EDUC4TE's own practice, not a Microsoft requirement. Score each candidate from zero (poor) to five (strong) on six dimensions:
- Access hygiene. EEEU removed, links reviewed.
- Label coverage. Share of files with a sensitivity label.
- Sharing posture. External sharing off, restricted or open.
- Owner discipline. Owner named and an access review done recently.
- Personal information. Site is known to hold HR, client, health or financial records.
- Business need. The pilot users depend on the content.
Read the scores this way. Low access hygiene, low label coverage and high personal information means restrict now. High scores across the board means leave the site discoverable. A high business need with poor hygiene is the awkward case, and the answer is a time-boxed RCD with a dated plan to fix access, not a permanent exemption.
For Privacy Act 1988 purposes, sites that hold personal information deserve extra attention, because APP 11 requires reasonable steps to protect it. The review record is useful evidence of those steps.
Owner sign-off
Restricting a site should not be an IT-only decision. Ask each owner to confirm in writing:
- the access list was reviewed on a stated date
- sensitivity labels cover files that hold personal information
- they understand the restriction is temporary and what ends it
- they know who to contact if people cannot find content
SAM site access reviews let you delegate the access review to the owner, so the record sits with the person who knows the content.
How to review restricted sites
Treat the restricted list as a work queue that should shrink.
- Keep a register. For each site record the control, the reason, the owner, the date applied and the target end date.
- Check the tenant view. Microsoft provides a PowerShell report of sites where RCD is on, and a separate insights report for sites with RAC. Compare them with your register.
- Use the audit log. Microsoft Purview audit records enabling and disabling RCD and RAC changes, with justifications when site administrators make them.
- Review monthly. For each RCD site ask: is access fixed? If yes, remove RCD. If no, why not and what is the new date?
- Review RAC membership quarterly. Group membership drifts. Remove leavers and people who changed roles.
- Measure what Copilot sees. Purview DSPM for AI shows Copilot interactions and oversharing signals, so you can tell whether restriction is helping. The DSPM for AI walkthrough covers the setup.
A 30-60-90 day plan
- Days 0 to 30. Run the SAM reports and a DSPM data risk assessment. Build the candidate list and name an owner for each site.
- Days 30 to 60. Score candidates and apply RCD to the highest-risk sites. Launch access reviews. Apply RAC to sites that should belong to a defined group.
- Days 60 to 90. Remove RCD from sites whose access is fixed. Check Copilot behaviour with a small pilot group. Plan the next batch.
Microsoft does not prescribe this cadence. Adjust it to your tenant size and the capacity of your site owners.
Common mistakes
- Restricting by department request. Use report evidence.
- Restricting too many sites. It degrades Copilot answers and hides value you paid for.
- Treating RCD as an access fix. It is discovery only.
- Leaving no end date. A temporary control without a date becomes permanent.
- Forgetting shared and private channel sites. They are separate sites, so configure RAC on each one.
- Forgetting OneDrive. RCD does not apply. Use labels and DLP for Copilot.
Where this fits
Microsoft's sequence is: identify high-risk sites, apply interim protections, fix access, then remove interim protections. After that come guardrails such as secure defaults, auto-labelling, DLP for Copilot and insider risk controls. The SharePoint and Teams Governance Audit is a self-service way to see where you stand, and the practitioner-led SharePoint and Teams Governance Assessment walks through your SAM reports and site decisions with you.
Related guides
- Restricted SharePoint Search is retiring explains the retirement and what to do if you already enabled it.
- AI in SharePoint: What Copilot Wave 3 Means for Australian Intranet Governance explains why Copilot output quality tracks SharePoint content quality.
- Microsoft Purview for SharePoint: The Governance Transition covers the DLP, retention and eDiscovery move compliance officers must navigate.
Disclaimer: this article is general guidance, not professional advice. Review and test all changes in a non-production environment before you apply them in production.
Sources: Microsoft Learn pages on Restricted Content Discovery, Restricted Access Control, Restricted SharePoint Search (retirement notice), SharePoint Advanced Management and the secure and governed foundation for Microsoft 365 Copilot, checked 8 October 2026; Office of the Australian Information Commissioner, Australian Privacy Principles guidelines.
