Restricted Content Discovery for Copilot

Restricted Content Discovery (RCD) is a SharePoint feature that hides a site's content from Microsoft 365 Copilot and organisation-wide search while leaving direct access — through the site URL, a link in an email, or a member navigating the site — unchanged. It's part of SharePoint Advanced Management (SAM), and it exists to solve one specific problem in Copilot rollouts: sites that were built for their members, not for the tenant, and whose content should not surface to anybody else through Copilot's data reach.

If your organisation is planning or running a Microsoft 365 Copilot deployment, RCD is one of the few concrete controls that gives you a graceful path between "leave the site as-is and hope Copilot ignores it" and "lock the site down".

What RCD actually does

RCD marks a SharePoint site as excluded from tenant-wide indexing surfaces. Concretely, once a site is under RCD:

• Its content does not appear in Microsoft 365 Copilot responses when the requesting user is not a member of the site.
• It does not appear in enterprise search results (SharePoint start page, Delve, Microsoft Search) for non-members.
• Members of the site — anybody who has been explicitly granted permissions — continue to see the content everywhere: search inside the site, Copilot when scoped to that site, direct URL, everything.

The mechanism is a filter at the search-and-Copilot layer, not a permission change. Nothing about who can access the content changes; only where it can be discovered changes.

When to use it

RCD fits a narrow but common shape: a site whose permission model is technically correct but whose discovery profile is too broad for Copilot. Typical examples:

• The old Legal team's site, on which historical contracts were saved with "Everyone except external users" permissions because at the time nobody needed a stricter model.
• HR sites containing individual performance conversations, saved to a site with membership limited to HR but SharePoint's tenant search still surfacing snippets to anyone with the right query.
• Executive strategy sites where the file permissions correctly restrict the exec team but the file names alone are sensitive.
• Historic project sites where "everyone can request access" was fine when they were live but should not be Copilot-visible now.

For these, RCD offers a fast intervention: switch the site to RCD, and Copilot stops considering it for non-members, without you having to run a permissions audit against thousands of files first.

What it does not fix

RCD is not a substitute for permission hygiene. Two limits are worth being clear about.

It does not restrict direct access. A non-member who has the URL, a link in an email chain, or a bookmark can still open the site and its files. RCD only removes it from Copilot's data grounding and from search for non-members.

It does not classify data. Sensitivity labels (from Purview) do that. A file under a "Confidential" label still enforces its label-based encryption and its rights, RCD or no RCD. Conversely, an unlabelled file on an RCD-scoped site is still unlabelled — its content is invisible to Copilot for non-members, but if it later leaves the site, no label follows it.

Use RCD alongside sensitivity labels and permissions, not instead of them. The graceful pattern is: correct permissions on the site so only intended members are in, sensitivity labels applied to files so they carry their own protection, and RCD on top so Copilot's tenant-wide reach does not surface content it should not.

How to enable it

RCD requires SharePoint Advanced Management, which is a paid add-on to the SharePoint plan (bundled with Microsoft 365 E5, standalone otherwise). Once SAM is licensed:

From the SharePoint admin center → Active sites → select a site → Membership → Restricted Content Discovery → enable. The site is flagged as RCD immediately; Copilot and search indexers respect the flag on their next refresh, which is minutes to hours in practice.

For bulk enablement — hundreds or thousands of sites in one go — the SharePoint Online PowerShell module supports the same operation through Set-SPOSite or the newer Set-SPOTenantRestrictedContent cmdlet family; the exact cmdlet name and parameter set has been shifting as Microsoft iterates, so check the current documentation before scripting.

SharePoint Advanced Management also ships Data Access Governance (DAG) reports that flag sites likely to be over-shared or over-permissioned — a natural feeder into "which sites should we apply RCD to first". Run a DAG report before enabling RCD broadly.

The rollout pattern

For a Copilot deployment, the typical order is:

1. Inventory. Use SAM's Data Access Governance reports to list sites with broad sharing (Everyone-except-external, tenant-wide anonymous links) or over-permissioned by content-type detection.
2. Prioritise. Legal, HR, Finance, Executive first — these are the sites where a Copilot response leaking a snippet is the biggest incident. Then broadly-shared historical sites.
3. Communicate. Site owners need to know: RCD does not lock them out or their members. Users outside the site's membership will not find its content through Copilot or tenant search.
4. Enable and observe. Turn on RCD for the prioritised sites. Watch Copilot audit logs for the following two weeks — if legitimate users were relying on Copilot to surface an RCD-scoped site, they will complain, and the response is either to add them as members or to reconsider.
5. Layer sensitivity labels. For files that need protection when they leave the site, sensitivity labels are the durable control. RCD is the discovery gate; labels are the file-level policy.

What Copilot users notice

Almost nothing. RCD is invisible in the Copilot UI — there is no "this site was excluded" message. From a non-member's perspective, the RCD-scoped site simply does not appear in Copilot's responses.

Members of the site have the full Copilot experience over the site's content: it grounds Copilot responses for them, appears in their scoped chats, and shows up in their file references.

This asymmetry — visible to members, invisible to non-members — is exactly the shape you want for a mid-rollout Copilot deployment where the permission model is correct but the historical file names, folder structures, and content snippets are too rich to expose broadly.

When RCD is the wrong answer

Two situations point at deeper cleanup rather than RCD:

If the site is genuinely over-shared — hundreds of people have permissions they should not have — RCD hides the site from Copilot without fixing the permission problem. A user who has permissions they should not have can still open the files directly. Fix the permissions, then decide about RCD.

If the file-level protection is the requirement — because files leave the site, get emailed, or need protection at rest — sensitivity labels are the tool, not RCD. RCD travels with the site; a label travels with the file.

RCD is a discovery control. When the requirement is access or protection, use the tool that matches.