Restricted SharePoint Search
Common Use Cases
- Copilot rollout start: containing exposure across the whole tenant
- Allow-list approach: permitting only vetted sites in search and Copilot
- Buying time: pausing broad discovery during cleanup
- Risk containment: a tenant-wide guard rather than per-site
- Phased adoption: loosening restrictions as governance improves
- Early protection: reducing accidental surfacing organization-wide
Benefits
- Tenant-wide control: one switch limits search and Copilot broadly
- Curated allow-list: only approved sites are discoverable
- Access unaffected: direct site permissions are unchanged
- Fast containment: reduces exposure quickly during rollout
- Buys time: supports a careful, phased cleanup
- Reversible: designed to be eased over time
Details
- Feature Category: Search & AI
How It Works
- Tenant-level setting: enabled across the organization
- Allow-list of sites: admins curate the permitted sites
- Restricts org search: non-listed sites are held back from tenant search
- Limits Copilot grounding: Copilot draws from allowed sites
- Direct access remains: users still open sites they have rights to
- Temporary by design: intended as a stopgap, then relaxed
Limits and Nuances
- Allow-list cap: the number of allowed sites is limited
- Blunt instrument: it restricts broadly, reducing useful results too
- Temporary intent: not meant as a permanent configuration
- Licensing required: a SharePoint Advanced Management capability
- Direct access unchanged: it limits discovery, not permissions
- Verify the limits: confirm current caps and behavior for your tenant
Common Questions About Restricted SharePoint Search
What is Restricted SharePoint Search?
Restricted SharePoint Search is a tenant-wide control that temporarily limits organization-wide search and Microsoft 365 Copilot to a curated allow-list of selected SharePoint sites. When enabled, only the vetted sites can be surfaced by tenant search and Copilot, while everything else is held back. Direct access to each site is unchanged; the control affects discovery, not permissions.
How is it different from Restricted Content Discovery?
Restricted SharePoint Search works at the tenant level, allowing only a curated list of sites to be discoverable, while Restricted Content Discovery is applied per site to remove specific sites from discovery. One is a broad allow-list for the whole organization; the other is a targeted block on individual risky sites. Organizations often use Restricted SharePoint Search early, then shift to per-site RCD as cleanup progresses.
Why is Restricted SharePoint Search described as temporary?
Because it is a deliberately blunt instrument. By limiting search and Copilot to a small allow-list, it also holds back a lot of legitimately useful content, which is acceptable as a short-term containment measure but not as a permanent state. The intent is to switch it on at the start of a Copilot rollout, fix oversharing, and then ease the restriction so users regain full, well-governed search.
Does it stop people from accessing sites?
No. Like other discovery controls, it does not change site permissions. Users can still open and work in any site they already have access to. What it limits is how content is surfaced through organization-wide search and Copilot grounding, so the restriction shapes what AI and tenant search can find rather than what people can directly reach.
What does it require, and are there limits?
Restricted SharePoint Search is part of SharePoint Advanced Management and is configured by administrators. The allow-list of permitted sites is capped, and exact limits and behavior can change over time, so it is worth confirming the current numbers for your tenant in Microsoft documentation. Because it is broad, organizations plan its use as a defined phase rather than an open-ended setting.
How should organizations use it?
As a first, time-boxed line of defense. Greg Zelfond, the consultant behind LookBook 365, frames Restricted SharePoint Search as the tenant-wide gate you open carefully at the start of a Copilot journey, while data access governance reports and permission cleanup do the real work. Once oversharing is under control, the restriction is relaxed so people get the full benefit of search and Copilot on a properly governed estate.