Restricted Content Discovery in SharePoint: a step-by-step guide

Copilot indexes whatever permissions allow, including forgotten or poorly protected sites. Restricted Content Discovery (RCD) lets you remove a site from the scope of Copilot and organization-wide search, without touching its permissions. This guide covers step-by-step activation, propagation times, PowerShell automation and the link with the retirement of Restricted SharePoint Search, set for January 31, 2027.

What RCD hides, and what it leaves intact

RCD removes a SharePoint site's content from Copilot results and organization-wide search. The site's permissions stay the same: anyone who has access can still open it and view its files.

Observed effects on a restricted site:

• The Copilot button and related features, such as agent creation, disappear from the site.
• Copilot and organization-wide search (hub search, the SharePoint home page, Office.com) no longer surface its content.
• Search within the site, at site or library level, keeps working.
• The site displays the Restricted label on the page.

The Microsoft Learn documentation specifies one point: if RCD is enabled, Copilot in SharePoint and AI actions do not appear on the site, regardless of other settings.

Two scope limits apply. RCD works site by site: there is no tenant-level switch. It does not cover OneDrive, only SharePoint sites.

Prerequisites: Copilot license and SharePoint admin access

The feature is not free, but no specific purchase is needed. According to Microsoft Learn, RCD can be configured when the organization has a Copilot license and SharePoint Advanced Management (SAM) is available. SAM is included as soon as at least one Microsoft 365 Copilot license is assigned: no separate SAM purchase.

To place RCD within a complete approach, see the technical checklist for preparing a tenant for Copilot.

The timeline that forces the move to RCD

Restricted SharePoint Search is being retired, and RCD takes its place for restriction scenarios. The dates below come from the Microsoft Learn documentation, the message center and the retirement schedule.

Tenants that rely on Restricted SharePoint Search will find the migration approach in our article Migrating from Restricted SharePoint Search to Restricted Content Discovery.

Step by step: restrict a site from the portal

The procedure takes less than five minutes per site. It is performed in the SharePoint admin center.

Propagation, visible effects and verification

RCD is not instantaneous. The content stays in the search index, with a propagation indicator. For sites with more than 500,000 items, full processing can take more than a week.

Once the restriction is active, the site displays the Restricted label.

Three useful points for your acceptance tests:

• Microsoft Purview features, including eDiscovery and auto-labeling, keep working.
• RCD does not affect experiences that work on content already open, for example summarizing a document the user is viewing.
• Changes to the setting by a site administrator are logged in the Purview audit log.

Reliable verification combines three checks: the Restricted label on the page, the absence of the Copilot button on the site, then, once propagation is complete, a search test from Office.com on a term specific to the site.

Implementation: automate with PowerShell and the catalog

Beyond a few sites, the portal becomes tedious. Four approaches exist, depending on scale and the level of delegation you want.

Batch restriction script

The script below applies or removes RCD on a list of sites. It relies on the documented command Set-SPOSite -Identity <url> -RestrictContentOrgWideSearch $true, and $false to remove the restriction.

• Required module: Install-Module Microsoft.Online.SharePoint.PowerShell
• Permissions: an account with SharePoint administration rights
• Output: one line per site indicating the action performed or simulated

1# Applique ou retire Restricted Content Discovery sur une liste de sites
2param(
3    [Parameter(Mandatory)][string]$AdminUrl,   # ex. https://contoso-admin.sharepoint.com
4    [Parameter(Mandatory)][string[]]$SiteUrls, # URL des sites à traiter
5    [switch]$Remove,                           # retire la restriction au lieu de l'appliquer
6    [switch]$DryRun                            # simulation : aucune écriture
7)
8 
9# Connexion au centre d'administration SharePoint
10Connect-SPOService -Url $AdminUrl
11 
12# $true active RCD, $false le retire
13$valeur = -not $Remove.IsPresent
14 
15foreach ($url in $SiteUrls) {
16    if ($DryRun) {
17        Write-Host "[Simulation] $url -> RestrictContentOrgWideSearch = $valeur"
18        continue
19    }
20    try {
21        Set-SPOSite -Identity $url -RestrictContentOrgWideSearch $valeur -ErrorAction Stop
22        Write-Host "[OK] $url -> RestrictContentOrgWideSearch = $valeur"
23    }
24    catch {
25        Write-Warning "[Échec] $url : $($_.Exception.Message)"
26    }
27}

Always do a first run with -DryRun, review the list, then run without simulation.

Apply RCD to groups of sites

Catalog management in SharePoint Advanced Management (Reports > Catalog management) applies RCD to groups of sites in bulk, up to 20,000 sites. The added group is, however, a snapshot: sites added to the group afterwards are not restricted until you remove and re-add the group.

Delegate to site administrators

Delegation is enabled with the following command.

1# Autorise les administrateurs de site à gérer la restriction de découvrabilité
2Set-SPOTenant -DelegateRestrictedContentDiscoverabilityManagement $true

A site administrator who changes the setting must provide a justification, and the change is logged in the Purview audit log. Tenant-wide PowerShell reports are available via Start-SPORestrictedContentDiscoverabilityReport. Contrary to what some guides suggest, delegation is no longer PowerShell-only: the site interface exists too. Tony Redmond indicated in January 2026 that general availability was pushed to later in 2026; check the current status in message center MC1259825.

A temporary control to use sparingly

Microsoft presents RCD as a temporary governance control, to be used selectively. Excessive use reduces the completeness and relevance of answers from Copilot and organization-wide search.

Illustrative scenario: an organization deploys Copilot in phases. It first restricts the human resources site and an unreviewed archive site while it audits their permissions. It then removes the restriction site by site, once permissions are fixed.

For the logical next step, notably remediating oversharing, refer to the approach described in the recommended pages below.

Frequently asked questions

Do I need to buy SharePoint Advanced Management to use RCD?

No. According to the Microsoft Learn documentation, SAM is included as soon as at least one Microsoft 365 Copilot license is assigned in the organization. No separate SAM purchase is needed.

Does RCD prevent a user from opening the site's files?

No. Permissions do not change: anyone who has access can still open the site and its files. RCD only removes the content from Copilot and organization-wide search. To block access, you must fix the permissions.

Does search inside the site keep working?

Yes. Search at site or library level stays operational. Only organization-wide experiences, such as Copilot, Office.com or hub search, no longer display the site's content.

How long does it take for the restriction to take effect?

The delay depends on the site size. For sites with more than 500,000 items, full processing can take more than a week. The content stays in the index, with a propagation indicator.

What happens to Restricted SharePoint Search?

Any new activation has been blocked since July 31, 2026, and the retirement of the feature is set for January 31, 2027. The sites concerned must be handled with RCD before that date.

Where to start

The fastest approach is to handle the sites already covered by Restricted SharePoint Search first, since their deadline is set for January 31, 2027.

If your organization deploys Copilot in phases, enable RCD on sensitive sites before opening up licenses. If it already has Copilot without having audited its permissions, start with obsolete or heavily shared sites. Our roundup of Copilot news in SharePoint for August 2026 complements this work.

Further reading

• Restrict discovery of SharePoint sites and content (Microsoft Learn): reference documentation on prerequisites, PowerShell, delegation, propagation times, auditing and the FAQ.
• Catalog management in SharePoint Advanced Management: applying RCD to many sites via catalog groups, and snapshot pitfalls.
• Site Administrators Can Enable RCD to Block Copilot Access (Office 365 for IT Pros): expert analysis of delegation to site administrators and its timeline.
• Get ready for Microsoft Copilot with SharePoint Advanced Management: RCD within a broader approach, with identification of at-risk sites, access restriction and oversharing remediation.