Restricted SharePoint Search was the short-term allow-list people reached for when Copilot arrived and SharePoint permissions weren't ready. That path is closing. Learn states Restricted SharePoint Search is retiring: starting 31 July 2026, new enablement is blocked. Microsoft points administrators to Restricted Content Discovery (RCD) for content discoverability instead.
RCD is a site-level setting. It limits discovery of that site's content in organization-wide search and in Microsoft Copilot responses while you review permissions and governance. It does not change who can open the files. Users who already have access keep it. That distinction is the whole design.
What Restricted SharePoint Search was, and why it stops
Restricted SharePoint Search maintained an allow list of up to 100 SharePoint sites for organization-wide search and, as a temporary measure, for Copilot chat and agentic experiences. It was never a security boundary. It didn't rewrite permissions. Sites a user owned, recently visited or had shared with them could still surface. Keeping it on limited search for everyone, capped the allow list at 100 hubs, and gave Copilot less to reference.
Learn's recommendation was always temporary: use SharePoint Advanced Management and Purview to find and fix oversharing, then turn Restricted SharePoint Search off. With new enables blocked since 31 July 2026, tenants that still have it on need a planned exit into something that scales.
What Restricted Content Discovery does
From Learn's Restricted Content Discovery page:
- It is applied per SharePoint site (not OneDrive).
- Organization-wide search and Microsoft Copilot discovery skip that site's content, including recently interacted files in those org-wide experiences.
- AI-powered entry points on the site are removed: the Copilot button, AI actions menus (including creating agents), and Create pages with AI.
- Existing permissions stay as they are. Direct access still works.
- Site-context search and experiences such as Microsoft 365 Feed and Recommendations are not affected.
- Content stays in the Microsoft 365 search index, so Purview eDiscovery and auto-labeling keep working.
- Propagation takes time. Learn notes that for sites with more than 500,000 items, an update can take more than a week to fully show in search and Copilot.
You enable it in the SharePoint admin center (Settings tab, Restrict content from Microsoft Copilot) or with Set-SPOSite with RestrictContentOrgWideSearch set to true. SharePoint administrators manage it by default; with tenant delegation, site administrators can manage their own sites and must give a justification. Purview audit logs record the changes. Tenant-wide reports use Start-SPORestrictedContentDiscoverabilityReport.
Prerequisites Learn lists: a Microsoft Copilot license and SharePoint Advanced Management.
How to use it without starving Copilot
Learn cautions against excessive use. Every restricted site shrinks what org-wide search and Copilot can see. Treat RCD as a review queue, not a permanent deny list.
A practical sequence:
- Use Data Access Governance reports, catalog management or a content management assessment to name the sites that need review (high oversharing risk, unclear owners, phased Copilot rollout).
- Apply Restricted Content Discovery to that short list while site owners fix permissions and sharing.
- Remove the restriction when the review is done, so Copilot and search can use the site under normal permissions again.
- Keep SharePoint Advanced Management and Purview labels, DLP and auditing as the lasting controls. RCD buys time; it does not replace them.
This is a different lever from sensitivity labels that keep Copilot from summarizing a file, archive actions that take files out of Copilot's reach, and Copilot Studio knowledge source rules. Those decide what happens to content Copilot already reaches. RCD decides whether org-wide discovery and Copilot get a path to the site at all while you clean access.
Who decides
The SharePoint or Microsoft 365 administrator owns the tenant setting and the report of which sites are restricted. Site owners (or delegated site administrators) own the permission cleanup that lets a site leave the list. The records or security owner decides which classes of site may be restricted during a Copilot rollout, and for how long, so RCD doesn't become permanent shadow governance.
Copilot respects SharePoint permissions. Restricted Content Discovery is how you keep discovery narrow until those permissions are ones you would defend.
