Hide the riskiest sites from Copilot while you fix them (Restricted Content Discovery)¶
Licence and role
Microsoft 365 Copilot licence (SharePoint Advanced Management included). SharePoint sites only, not OneDrive. SharePoint Administrator role.
Why it matters¶
Fixing permissions on a big site takes weeks. Restricted Content Discovery keeps a site's content out of organisation-wide search and Copilot answers in the meantime. Microsoft calls it an interim protection: remove it once access is fixed.
Steps¶
- SharePoint admin center > Sites > Active sites > select the site > Settings > turn on 'Restrict content from Microsoft Copilot' > Save. Or: Set-SPOSite -Identity <site-url> -RestrictContentOrgWideSearch $true (this changes the site; run it yourself, it is not part of the read-only script).
- Apply it only to the high-risk sites from CR01. Microsoft advises using it selectively: every restricted site makes Copilot answers less complete.
- Allow time. Sites with more than 500,000 items can take over a week to reflect the change.
- Test with a pilot user who has access: ask Copilot about the site's content and check the answer no longer cites it.
- Record a removal date per site in the tracker (when CR01's owner has fixed access).
Impact on users¶
Copilot and organisation-wide search stop surfacing the site's content. Permissions do not change: users with access can still open files directly, and searches from inside the site still work. AI entry points such as the Copilot button and agent creation are removed on that site.
Rollback¶
Turn the setting off on the site (or Set-SPOSite -Identity <site-url> -RestrictContentOrgWideSearch $false). Allow the same propagation time.
Read-only check¶
Reads settings only. It changes nothing in your tenant or on the device.
Modules, connection and role
Requires: Microsoft.Online.SharePoint.PowerShell (SharePoint settings), ExchangeOnlineManagement (audit).
Connect first:
Connect-SPOService -Url https://<tenant>-admin.sharepoint.com
Connect-ExchangeOnline
Note: Microsoft retires Search-UnifiedAuditLog on 15 Oct 2027 (MC1505599). CR05 will move to the Graph AuditLogQuery API before then.
Get-SPOTenant | Select-Object DelegateRestrictedContentDiscoverabilityManagement | Format-List | Out-String
'Existing Restricted Content Discovery reports:'
Get-SPORestrictedContentDiscoverabilityReport
How to verify¶
Every high-risk site from CR01 either has access fixed or has 'Restrict content from Microsoft Copilot' on, with a removal date in the tracker. A pilot user's Copilot answer no longer cites the restricted site.
Sources¶
- Restricted content discovery (Microsoft Learn)
- Configure secure governed data foundation Microsoft 365 Copilot (Microsoft Learn)
This control is in the M365 Copilot Readiness Kit
The free Top 5 has this control with its Jira import, Excel project plan, tracker CSV and the read-only PowerShell script. The Complete kit has all 24 controls.