Introduction: the scheduled end of Restricted SharePoint Search
Microsoft has officially announced the retirement of the Restricted SharePoint Search (RSS) feature in SharePoint Online. This decision directly impacts organizations that rely on this mechanism to control content discoverability within Microsoft 365 experiences, particularly Microsoft Search and Microsoft 365 Copilot.
The retirement timeline is precise and non-negotiable:
| Date | Event |
|---|---|
| July 31, 2026 | Blocking of any new RSS activation |
| July 2026 – January 2027 | Transition period |
| January 31, 2027 | Permanent shutdown of RSS functionality |
| February 28, 2027 | Retirement of RSS PowerShell cmdlets |
Microsoft will not provide automatic migration of existing RSS configurations. It is therefore up to administrators to evaluate their environment, document the configurations in place, and plan a transition to Restricted Content Discovery (RCD), the recommended replacement mechanism.
Action required before July 31, 2026
After July 31, 2026, it will no longer be possible to activate RSS in a tenant. Any organization that has not migrated to an alternative solution will see its discoverability restrictions disappear without notice on January 31, 2027.
Understanding Restricted SharePoint Search
In SharePoint Online, content is naturally indexed and made discoverable via Microsoft Search, provided that users have appropriate permissions. RSS introduced an additional control layer: rather than allowing all SharePoint sites to contribute to the search index, the administrator defined an allowlist of sites eligible for indexing.
This approach addressed several use cases:
- Preparation for regulatory compliance and governance audits
- Management of SharePoint migration projects
- Controlled rollout programs for Microsoft 365 Copilot
- Protection of sensitive business content
- Progressive control of content exposure in search results
Why Microsoft is discontinuing RSS
RSS was designed as a tenant-level restriction mechanism, operating through a centralized allowlist. This architecture has several structural limitations:
- Lack of granularity: management is performed at the tenant level, without the ability to target each site precisely
- Limited scalability: the model quickly reaches its limits beyond a modest number of sites
- Inadequacy for Copilot scenarios: RSS was not designed for modern generative AI experiences
Microsoft has explicitly documented RSS as a transitional solution, not a permanent governance control. The evolution toward more flexible and granular governance models, driven particularly by the adoption of Microsoft 365 Copilot, justifies this retirement.
Restricted Content Discovery: the recommended successor
Restricted Content Discovery (RCD) is the official replacement mechanism for RSS. It allows organizations to exclude specific SharePoint sites from organization-wide discovery experiences, including Microsoft Search and Microsoft 365 Copilot.
Essential distinction
RCD acts only on content discoverability, not on access permissions. A user with rights on a site can still access it via direct URL or navigation. RCD only prevents this content from appearing in search results and Copilot responses.
This separation between permissions and discoverability is fundamental: it allows fine-grained management of visibility without modifying existing access rights. For example, a legal site containing confidential documents can remain accessible to authorized collaborators while being excluded from Microsoft Search results and Copilot-generated responses.
Comparison RSS vs Restricted Content Discovery
| Characteristic | Restricted SharePoint Search | Restricted Content Discovery |
|---|---|---|
| Control model | Tenant-level allowlist | Site-level configuration |
| Granularity | Low (centralized) | High (per site) |
| Microsoft Search support | Yes | Yes |
| Microsoft 365 Copilot support | Limited | Designed for Copilot |
| Scalability | Moderate | High |
| Future | Retirement in 2027 | Recommended solution |
Checking the current state of RSS in your tenant
Before taking any action, start by determining whether RSS is actually enabled in your tenant. Many environments have never used this feature, in which case no migration is necessary.
Connect to the SharePoint Online Management Shell with an account that has the SharePoint Administrator role, then run:
1Connect-SPOService -Url https://contoso-admin.sharepoint.com2Get-SPOTenantRestrictedSearchModeThe command returns Enabled or Disabled. If the result is Disabled, no migration action is required.
Inventorying sites governed by RSS
If RSS is active in your tenant, the next step is to retrieve the complete list of sites currently included in the allowlist. This inventory forms the basis for planning the transition.
1Get-SPOTenantRestrictedSearchAllowedListTo maintain an usable record for planning and post-migration validation, export the results to CSV:
1Get-SPOTenantRestrictedSearchAllowedList | 2 Export-Csv .\RSSAllowedSites.csv -NoTypeInformationGovernance tip
Keep this CSV file as a baseline reference. It will be used during post-migration validation to ensure that all critical sites have been adequately protected via RCD.
RSS to Restricted Content Discovery migration process
Migration from RSS to RCD is a multi-step process that should be approached methodically. Here is the recommended approach.
Verify licensing and access prerequisites
RCD is subject to specific prerequisites. Before planning the migration, confirm that your organization meets the following conditions:
- At least one active Microsoft 365 Copilot license in the tenant
- Access to SharePoint Advanced Management
If these prerequisites are not met, RCD cannot be used as a substitute for RSS. In this case, consider other governance mechanisms: sensitivity labels, sharing restrictions, or conditional access policies.
Analyze each site in the RSS inventory
Avoid replicating the RSS configuration identically in RCD. For each site in your inventory, evaluate:
- The initial reason for its inclusion in RSS
- Whether discoverability restrictions are still justified
- Whether current sensitivity labels or permissions already provide adequate protection
- Whether the site should now be fully indexed
Organizations often find that some restrictions are no longer necessary, as business requirements or governance policies have evolved since the initial RSS implementation.
Apply Restricted Content Discovery to targeted sites
After analysis, apply RCD only to sites that actually require discoverability restrictions. To enable RCD on a site:
1Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/MySite" -RestrictContentOrgWideSearch $trueTo verify that the configuration is properly applied:
1Get-SPOSite -Identity "https://contoso.sharepoint.com/sites/MySite" | Select-Object RestrictContentOrgWideSearchTo remove the restriction if it is no longer necessary:
1Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/MySite" -RestrictContentOrgWideSearch $falseAutomate migration for large-scale environments
Large organizations may have tens or even hundreds of sites to process. The following script uses the CSV file exported in the previous step to apply RCD in bulk:
1$sites = Import-Csv .\RSSAllowedSites.csv2 3foreach ($site in $sites) {4 try {5 Set-SPOSite -Identity $site.Url -RestrictContentOrgWideSearch $true6 Write-Host "RCD applied: $($site.Url)" -ForegroundColor Green7 }8 catch {9 Write-Warning "Error on $($site.Url): $_"10 }11}Adapt the Url column according to the actual column name in your CSV export.
Generate an RCD coverage report
Once the migration is complete, generate a report to validate RCD coverage across the entire tenant.
Start report generation:
1Start-SPORestrictedContentDiscoverabilityReportCheck the report status:
1Get-SPORestrictedContentDiscoverabilityReportDownload the report once complete:
1Get-SPORestrictedContentDiscoverabilityReport -Action Download -ReportId "<Report GUID>"This report is valuable documentary evidence for governance audits and post-migration validation.
Disable RSS manually
Once all critical sites are protected via RCD, proactively disable RSS rather than waiting for its automatic retirement. This allows you to control the timing of the transition and validate search behavior before the deadline.
1Set-SPOTenantRestrictedSearchMode -Mode DisabledAfter disabling, monitor Microsoft Search and Copilot experiences to detect any discoverability anomalies.
Delegating RCD management to site owners
For organizations that favor a decentralized governance model, it is possible to delegate RCD management to site administrators. This approach empowers business owners while maintaining centralized traceability.
Enable delegation at the tenant level:
1Set-SPOTenant -DelegateRestrictedContentDiscoverabilityManagement $trueVerify the current state of delegation:
1Get-SPOTenant | Select-Object DelegateRestrictedContentDiscoverabilityManagementWhen delegation is enabled, each change to a site's RCD status requires a business justification from the site administrator. These actions are also recorded in the Microsoft Unified Audit Log, creating an auditable history of discoverability changes.
Traceability and compliance
Microsoft Unified Audit Log entries related to RCD include the identity of the user who made the change, the justification provided, and the before/after state. This data is useful for compliance reviews or security investigations.
Points of caution before deploying RCD at scale
Do not over-restrict with RCD
Microsoft explicitly warns against excessive use of RCD. Each restricted site removes content from Microsoft Search and Microsoft 365 Copilot responses. Over-restriction degrades the quality and relevance of Copilot responses by reducing the information base available for grounding.
Here are the key points to integrate into your deployment strategy:
- Indexing delays: RCD changes propagate through the Microsoft Search index and are not immediate. Sites containing more than 500,000 items may take more than a week to reflect changes. Plan your test phases accordingly.
- Selectivity: Reserve RCD for sites containing truly sensitive, regulated, or high-risk information, identified through formal governance review.
- Balance: Find the right balance between protecting sensitive content and preserving the added value of Microsoft Search and Copilot for your users.
- Do not migrate mechanically: The RSS inventory should not be applied as-is in RCD. Each site deserves individual reassessment.
Microsoft reference resources
To deepen understanding of each topic covered in this article, consult the official Microsoft documentation:
- Announcement of Restricted SharePoint Search retirement
- Restricted Content Discovery documentation
- SharePoint Online PowerShell cmdlets
- SharePoint Advanced Management
- Microsoft Unified Audit Log
Conclusion
The retirement of Restricted SharePoint Search is an opportunity to modernize the governance of SharePoint content discoverability. The transition to Restricted Content Discovery offers a more granular approach, better integrated with Microsoft 365 Copilot experiences, and more aligned with modern governance principles.
The key to a successful migration lies in three principles: anticipate (start inventory and analysis well before July 2026), select (apply RCD only to sites that genuinely justify it), and validate (use reports and audit logs to confirm coverage).
Organizations that act early will avoid unintended content exposure, governance gaps, and operational disruptions at the time of permanent retirement in January 2027.
