Updated 22 October 2026: Microsoft has now published the full retirement schedule, so this guide carries the dates, the fact that configurations are not migrated for you, and Microsoft's warning about what happens if you do nothing. An earlier version said no end date had been published, which is no longer true.
Important: This article is general guidance only and is not tailored to your environment. Before you change settings or run any scripts in production, review them against current Microsoft Learn documentation and test them in a non-production environment first.
Restricted SharePoint Search was Microsoft's quick, tenant-wide way to limit what Microsoft 365 Copilot and organisation-wide search could reach while a tenant dealt with oversharing. Microsoft is retiring it and blocked new enablement from 31 July 2026.
If you are planning a Copilot rollout, you cannot use it. If you already switched it on, you now have a dated deadline to move off it. This article covers both.
The retirement schedule
Microsoft has published the full timetable, and the dates are firm.
| Date | What happens |
|---|---|
| 31 July 2026 | New enablement blocked |
| July 2026 to January 2027 | Retirement period |
| 31 January 2027 | Fully retired, with "no extensions or exceptions" |
| 28 February 2027 | PowerShell cmdlets retired |
Two further points from Microsoft's announcement change what the deadline means:
- Your configuration will not be migrated for you. Microsoft states it "will not automatically migrate RSS configurations to Restricted Content Discovery (RCD)", and that administrators must transition to RCD or other governance controls themselves.
- Doing nothing has a consequence. Microsoft warns that "if no action is taken, restricted content may become discoverable after RSS retirement."
Read those together and this stops being a housekeeping deadline. Sites your tenant deliberately kept out of organisation-wide search and Copilot can become discoverable again on 31 January 2027 unless somebody migrates them first. The retirement applies to Worldwide, GCC, GCC High and DoD.
What Restricted SharePoint Search was, before its retirement
It was a tenant-level setting. When on, organisation-wide search and Copilot drew only from an allow list of up to 100 SharePoint sites, plus content a user owned or had recently used. Many Australian tenants adopted it as a stop-gap before Copilot pilots because it was quick to turn on.
The problem it addressed is real. Copilot respects existing permissions. If a site was shared with "Everyone except external users" years ago, Copilot will surface that content to anyone who asks a relevant question. Microsoft Learn describes this in its Copilot data, privacy and security documentation (Microsoft Learn, Data, privacy and security for Microsoft 365 Copilot).
Why Microsoft is retiring it
Microsoft's own documentation gives the reasons:
- Temporary by design. It was meant to buy time while organisations fixed their permissions, not to be a lasting control.
- A 100-site limit. A tenant with more than 100 sites worth searching had to choose which ones Copilot could see.
- Not a security boundary. It changed what search showed, not who had access. Anyone with permission could still open a file directly.
- Reduced answer quality. Limiting the reference material available to Copilot can make its answers less complete and less relevant.
The takeaway is simple. It hid oversharing rather than fixing it, and the fix is in the permissions.
What to use instead
Microsoft's guidance, in its "Configure a secure and governed foundation for Microsoft Copilot" documentation, runs in four steps.
1. Identify high-risk sites
- SharePoint Advanced Management (SAM) data access governance reports. These cover site permissions, sharing links and "Everyone except external users" access. SAM is included with Microsoft Copilot licences. Sensitivity label reporting for files needs Microsoft 365 E5.
- Microsoft Purview Data Security Posture Management (DSPM) data risk assessments. These find overshared sites that contain sensitive data.
2. Apply interim protections
- Restricted Content Discovery (RCD). A site-level SAM setting that keeps a site's content out of organisation-wide search and Copilot responses without changing permissions. Users can still reach content they own or recently interacted with. It is not supported for OneDrive and Microsoft warns that overuse reduces the completeness of answers.
- DLP for Copilot. Keeps labelled content out of Copilot grounding, or blocks prompts that contain sensitive data.
3. Fix access
- Site access reviews. SAM lets you delegate reviews to site owners.
- Restricted Access Control (RAC). Limits a site to members of a Microsoft Entra security group or Microsoft 365 group. People outside the group lose access, even if they held a link or earlier permission.
- Site sensitivity labels and site ownership policies.
4. Remove the interim protections
Once access is remediated, take RCD off so Copilot can use the content again.
The step-by-step version is in How to use Restricted Content Discovery to govern Microsoft 365 Copilot. For deciding which sites to restrict, read Choosing which SharePoint sites to restrict for Copilot.
If your tenant already has it on
You have until 31 January 2027, and nothing will be migrated for you. Microsoft's own sequence is to check whether the feature is enabled, identify the sites configured and the allow list behind them, plan the transition to Restricted Content Discovery or other governance controls, apply those controls and validate the behaviour, then disable the old feature once migration is complete.
Work back from the date rather than towards it. Fixing access is the slow part, and it is the part that has to happen before you remove a blanket control.
A practical sequence:
- Take stock. Record which sites are on the allow list and why.
- Run SAM data access governance reports across the whole tenant, not only the allow-listed sites. Sites outside the list may have the worst sharing.
- Fix access first. Run site access reviews, remove broad sharing and apply RAC where a site belongs to a defined group.
- Replace the blanket control with targeted ones. Apply RCD to the specific high-risk sites that remain under review.
- Disable the retiring Restricted SharePoint Search after you have validated permissions, and before 31 January 2027 rather than on it. Test with a standard user account before and after. Remember the cmdlets you might script this with disappear on 28 February 2027.
- Tell your pilot users. Copilot will reach more content after you disable it, which is the point, but people notice the change.
Common pitfalls
- Treating 31 January 2027 as the start of the work. It is the date the control stops, not the date to begin migrating. Fixing access takes longer than applying a setting, and Microsoft warns restricted content may become discoverable afterwards if nothing is done.
- Disabling it before fixing permissions. Copilot would then reach everything users can already open, including overshared content.
- Replacing one blanket control with another. Restrict by evidence from reports, not by department request.
- Forgetting OneDrive. Neither the old control nor RCD covers it. Use sensitivity labels and DLP for Copilot.
- Treating any discovery control as an access fix. RCD hides content from search and Copilot. People with permission can still open it. Microsoft says the same of both controls: the retiring Restricted SharePoint Search "isn't a security boundary and doesn't change any permissions on SharePoint sites", and Restricted Content Discovery "affects discoverability, not access permissions". What the Copilot readiness report cannot tell you works through why that distinction decides which instrument answers which question.
Australian context
Microsoft's guidance is the same for every region. The Australian angle is why the fix matters.
Privacy Act 1988, APP 11. APP 11 requires reasonable steps to protect personal information from misuse, interference, loss and unauthorised access. Overshared personal information that Copilot can surface is the kind of exposure your access reviews should find. Keep the review records (OAIC, Australian Privacy Principles guidelines).
Notifiable Data Breaches scheme. An incident that exposes personal information to people who should not see it can be an eligible data breach if serious harm is likely (OAIC, Notifiable Data Breaches).
Essential Eight. Microsoft states that Copilot inherits your existing Essential Eight controls and posture. This article does not map any SharePoint control to an Essential Eight strategy.
Next steps
- Take the free Microsoft 365 Health Check for a view of your tenant configuration
- Read the pillar Microsoft Secure Score for Australian SMBs
- Walk the companion How to run a Microsoft 365 health check in 60 minutes
- Follow the Restricted Content Discovery how-to
- For deeper SharePoint governance scoring, run the SharePoint and Teams Governance Assessment
- For a practitioner-led review, book the AI-Ready Microsoft 365 Health Check
Disclaimer: this article is general guidance, not professional advice. Review and test all changes in a non-production environment before you apply them in production.
Sources: Microsoft 365 Message Center post MC1395311, "Microsoft SharePoint Online: Retirement of Restricted SharePoint Search", for the retirement schedule, the no-auto-migration statement and the discoverability warning, checked 22 October 2026; Microsoft Learn pages on Restricted SharePoint Search, Restricted Content Discovery, Restricted Access Control, SharePoint Advanced Management and the secure and governed foundation for Microsoft 365 Copilot, checked 22 October 2026; OAIC Australian Privacy Principles guidelines and Notifiable Data Breaches scheme.
