Restrict discovery of SharePoint sites and content

Organizations preparing for Microsoft 365 Copilot often need time to review SharePoint sites, validate permissions, and implement governance controls before making content broadly discoverable. Restricted Content Discovery (RCD) helps you limit discovery of content from specific SharePoint sites while those reviews are taking place.

When you enable Restricted Content Discovery for a site, content from that site doesn't appear in organization-wide search and Microsoft 365 Copilot experiences unless a user recently interacted with the content. This restriction helps reduce the likelihood of accidental discovery of content while permissions and governance controls are being evaluated.

When a site has a Restricted Content Discovery policy applied to it, a Restricted tag is visible, as shown in the following screenshot:

Restricted Content Discovery is designed as a temporary governance control that gives organizations time to review and right-size access while continuing their Copilot deployment.

When to use Restricted Content Discovery

Use Restricted Content Discovery for sites that might need extra review before they become broadly discoverable through search and Microsoft 365 Copilot.

Common scenarios include:

• Sites with a high risk of oversharing.
• Sites undergoing permissions review.
• Phased Microsoft 365 Copilot rollouts.
• Governance initiatives that require content validation before wider discovery.

For example, you might temporarily apply Restricted Content Discovery to a group of Finance or Human Resources sites while site owners review permissions and access. After the review is complete, you can remove the restriction and allow the sites to become discoverable again.

Before enabling Restricted Content Discovery, consider using one or more of the following tools and reports to identify sites that require review:

• SharePoint Admin Agent
• Content management assessment
• Data Access Governance reports
• Catalog management

How Restricted Content Discovery works

Restricted Content Discovery is a site-level setting. When you turn on the setting, Microsoft 365 search systems propagate it so that content from the site doesn't appear in organization-wide discovery experiences.

Even when Restricted Content Discovery is enabled:

• Site permissions stay the same.
• Users can continue to access content they already have permission to access.
• Users can still discover content they own or have recently interacted with.
• The feature doesn't remove content from the Microsoft 365 search index.

Because the setting must propagate across indexing systems, updates can take time to become fully effective. The amount of time depends on site size and the number of concurrent updates being processed.

Prerequisites

Before configuring Restricted Content Discovery:

1. Review the SharePoint Advanced Management prerequisites, including:

   • SharePoint Online PowerShell module requirements
   • Role-based access control (RBAC) role assignments

2. Ensure your organization has a Microsoft 365 Copilot license. Restricted Content Discovery is intended for Microsoft 365 Copilot deployment and governance scenarios.

Enable Restricted Content Discovery for a site

You can enable Restricted Content Discovery from the SharePoint admin center or by using PowerShell.

Use the SharePoint admin center

1. In the SharePoint admin center, expand Sites and select Active sites.

2. Select the site you want to configure.

3. Open the Settings tab, and then turn Restrict content from Microsoft 365 Copilot on.

   

4. Select Save.

Use PowerShell

Open PowerShell as an administrator and run the following command:

Set-SPOSite -Identity <site-url> -RestrictContentOrgWideSearch $true

Remove Restricted Content Discovery from a site

To disable Restricted Content Discovery for a site, open PowerShell as an administrator and run the following command:

Set-SPOSite -Identity <site-url> -RestrictContentOrgWideSearch $false

Apply Restricted Content Discovery to multiple sites

Organizations often need to apply Restricted Content Discovery across large groups of sites during Copilot deployment or governance initiatives. Bulk application allows administrators to apply the feature to collections of sites instead of configuring sites individually.

Bulk operations retain existing Restricted Content Discovery behavior:

• Restricted Content Discovery remains a site-level property.
• Sites that already have Restricted Content Discovery enabled aren't modified.
• Existing permissions remain unchanged.
• Standard propagation behavior continues to apply.

When planning bulk operations, keep the following considerations in mind:

• Service guardrails and throttling limits apply to bulk operations.
• Large-scale updates can increase propagation time.
• Sites containing more than 500,000 items can require extended processing time before updates are fully reflected in search and Microsoft 365 Copilot.

Delegate management to site administrators

By default, only SharePoint administrators can manage Restricted Content Discovery.

If you want site administrators to manage the setting for their own sites, enable delegation by using the following PowerShell command:

Set-SPOTenant -DelegateRestrictedContentDiscoverabilityManagement $true

To verify delegation status, run:

Get-SPOTenant | Select-Object DelegateRestrictedContentDiscoverabilityManagement

When delegation is enabled, site administrators can manage Restricted Content Discovery for their sites.

If a site administrator makes a change to Restricted Content Discovery settings, they must provide a justification for the change.

Check Restricted Content Discovery status for a site

Open PowerShell as an administrator and run the following command:

Get-SPOSite -Identity <site-url> | Select RestrictContentOrgWideSearch

Restricted Content Discovery states

The following table lists states you might see when you check Restricted Content Discovery status:

Monitor Restricted Content Discovery across your tenant

Administrators can use PowerShell to generate reports that identify sites where Restricted Content Discovery is enabled.

Generate a report

Open PowerShell as an administrator and run the following command:

Start-SPORestrictedContentDiscoverabilityReport

View report status

Open PowerShell as an administrator and run the following command:

Get-SPORestrictedContentDiscoverabilityReport

Download a report

Open PowerShell as an administrator and run the following command:

Get-SPORestrictedContentDiscoverabilityReport -Action Download -ReportId <ReportGUID>

Use Catalog Management with Restricted Content Discovery

Catalog Management can help organizations govern Microsoft 365 Copilot deployments at scale by organizing sites into logical groups and supporting phased review processes. A common governance approach is to:

1. Organize sites into catalog groups. Built-in categories are available. Currently in private preview, you can also add your own categories. For more information, see Catalog management in SharePoint Advanced Management.

2. Review permissions and governance requirements for a group of sites.

3. Apply Restricted Content Discovery while reviews are underway.

4. Remove restrictions after validation is complete and the sites are ready for broader discoverability.

This approach allows you to manage Copilot readiness in stages rather than requiring all SharePoint sites to complete review before deployment.

When you apply Restricted Content Discovery through Catalog-based workflows, the feature continues to operate as a site-level setting and follows the same enforcement and propagation behavior as individually configured sites.

Auditing

Audit events are available through Microsoft Purview audit log activites for activities involving Restricted Content Discovery.

These events include:

• Enabling Restricted Content Discovery.
• Disabling Restricted Content Discovery.
• Justifications provided when updates are made to the setting.

Frequently asked questions

Is my organization eligible to use Restricted Content Discovery?

Customers who are licensed for Copilot and have SharePoint Advanced Management available to them can configure Restricted Content Discovery. See Prerequisites for SharePoint Advanced Management.

Does Restricted Content Discovery change user permissions?

No. Restricted Content Discovery affects discoverability, not access permissions. Users who already have access to content can continue to access it.

What search experiences are affected?

Restricted Content Discovery affects organization-wide search experiences (SharePoint home, Office.com, Bing) and Microsoft 365 Copilot discovery scenarios, including experiences that rely on tenant-wide content discovery. Restricted Content Discovery also doesn't affect experiences that operate on content that's already in use by the user, such as summarizing an open document.

How does Restricted Content Discovery affect the end user experience in SharePoint?

Restricted Content Discovery restricts usage of AI-powered features in SharePoint. Users don't see entry points such as the Copilot button, AI actions menus (including creating agents), or Create pages with AI.

Does Restricted Content Discovery affect Microsoft Purview features?

No. Restricted Content Discovery doesn't remove content from the search index. Microsoft Purview capabilities such as eDiscovery and auto-labeling continue to function.

How long does it take for updates to Restricted Content Discovery to take effect?

Restricted Content Discovery is a site-level property. Index update latency is highly dependent on the number of items in the site and the number of sites getting updated at the same time. For sites with more than 500,000 items, an update to Restricted Content Discovery could take more than a week to fully process and reflect in search and Copilot experiences.

How does Restricted Content Discovery fit into a Copilot readiness strategy?

Restricted Content Discovery helps organizations temporarily limit discovery of selected sites while permissions, ownership, and governance controls are reviewed. It's one component of a broader SharePoint governance and Copilot readiness strategy. See the following resources:

• Secure and govern Microsoft 365 Copilot: Foundational deployment guidance
• Get ready for Microsoft 365 Copilot and agents with SharePoint Advanced Management

Next steps

Restricted Content Discovery gives organizations time to review and/or audit permissions and deploy access controls while onboarding Copilot in a safe manner.

Ultimately for sites that are overshared, the goal is to ensure that proper controls are in place to manage access. SharePoint Advanced Management has a suite of features, such as advanced site content lifecycle management, to help site owners and admins create a robust SharePoint governance framework.