Published: 11 August 2026. Source: What's New for SharePoint - July 2026 (HANDS ON SharePoint) and What's New in Copilot in SharePoint: August 2026 (Microsoft Tech Community).
Copilot in Microsoft 365 surfaces content from any SharePoint Online site a user can access, regardless of how sensitive that site is or how narrow its intended audience. For many organisations rolling out Copilot, this becomes the first governance question they cannot answer: how do you prevent specific internal sites from becoming Copilot source material without removing direct user access entirely?
Microsoft's answer, rolling out across tenants from July-August 2026, is Restricted Content Discovery (RCD): a site-level setting that removes a site's content from the Microsoft 365 search index and from the pool of data Copilot can reference, while leaving direct user access completely unchanged.
What Restricted Content Discovery does
RCD is a SharePoint Online administrative control applied to individual sites. When enabled, the following changes take effect:
- Content from the site no longer appears in tenant-wide Microsoft 365 search results.
- Copilot cannot use the site's content as a knowledge source, even for users who have site access.
- Users with permissions can still navigate directly to the site and work with its content as normal.
- Site-local search (the search bar within the site itself) continues to function for users with access.
This is distinct from Restricted Access Control (RAC), which gates whether a user can reach the site at all. RCD and RAC address separate concerns and can be applied independently or together.
| Setting | What it controls | User can access site directly? | Content in M365 Search? | Available to Copilot? |
|---|---|---|---|---|
| No restriction | Standard SharePoint permissions only | Yes | Yes | Yes |
| Restricted Content Discovery (RCD) | Discoverability via search and Copilot | Yes (unchanged) | No | No |
| Restricted Access Control (RAC) | Who can reach the site at all | Authorised users only | Scoped to authorised users | Scoped to authorised users |
| RCD and RAC combined | Both access and discoverability | Authorised users only | No | No |
Which sites are candidates for RCD?
RCD does not replace permissions governance; it adds a discoverability layer on top. The strongest candidates are sites where content is legitimately restricted by audience, but where the permission model is broad enough that Copilot might surface it to unintended recipients through an AI-generated response. Common examples include:
- HR policy sites with salary bands or employment records accessible to the HR team but not appropriate as Copilot answers to general staff queries.
- Legal and compliance repositories where privileged content should not appear in tenant-wide search results, even for users who hold site membership.
- Executive communications sites carrying board materials or unreleased financial information available to senior staff.
- Merger and acquisition project sites or commercially sensitive negotiation files open to a project team but inappropriate to surface in AI responses to colleagues outside the project.
Admin steps to apply RCD
RCD is configured through the SharePoint admin center or via PowerShell for sites in your tenancy. The setting is available now and actively rolling out across Microsoft 365 tenants through August 2026.
- Identify candidate sites. Build a site inventory that includes owner, sensitivity classification, and current permission scope. Sites with broad membership but sensitive content are the priority.
- Check existing governance controls. Document whether candidate sites already carry SharePoint Advanced Management policies, sensitivity labels, or RAC settings. RCD fits the same governance framework; record it alongside any other site-level policies already in place.
- Apply the setting. In the SharePoint admin center, open site properties and locate the content discovery control. Alternatively, use the
Set-SPOSitePowerShell cmdlet to apply RCD across multiple sites in a batch. - Communicate with site owners. Users with direct access are unaffected by RCD, but site owners may receive questions when colleagues notice that site content no longer appears in their search results or Copilot responses.
For organisations preparing their SharePoint environment for a broader Copilot rollout, RCD sits alongside permissions cleanup and content quality improvements as one of the practical governance levers. See the guide on how to audit SharePoint permissions for the foundation steps before configuring any site-level restriction policies.
Sources: What's New for SharePoint - July 2026 (HANDS ON SharePoint, August 2026); What's New in Copilot in SharePoint: August 2026 (Microsoft Tech Community). Rollout active across Microsoft 365 tenants from July-August 2026.
Frequently Asked Questions
What is the difference between Restricted Content Discovery and Restricted Access Control in SharePoint?
Restricted Access Control (RAC) governs whether a user can access a site at all. Restricted Content Discovery (RCD) is a separate layer: users with site access can still read content directly, but that content will not surface in Microsoft 365 search or be available to Copilot. Both settings are independent and can be combined on the same site.
If I enable Restricted Content Discovery on a site, can users still access files directly?
Yes. RCD does not change who can open or edit content. It removes the site from the tenant-wide search index and from Copilot's knowledge pool. A user navigating directly to the site retains all permissions they already hold.
Does Restricted Content Discovery affect SharePoint Online search within the site itself?
RCD restricts content from tenant-wide Microsoft 365 search and from Copilot. Local search within the RCD-enabled site continues to work for users with site access. The restriction applies to cross-site discoverability, not to the site's own internal search.