Restricted SharePoint Search Retirement: What to Do by Jan 31

TL;DR: Microsoft is retiring Restricted SharePoint Search (RSS), the temporary allow-list that kept all but 100 SharePoint sites out of organization-wide search and Microsoft 365 Copilot. New enablement has been blocked since July 31, 2026, and RSS is fully retired by January 31, 2027. Microsoft will not carry your settings over to the replacement, Restricted Content Discovery (RCD), and the two controls work in opposite directions. If you do nothing, sites outside your allow-list can become discoverable in Copilot when RSS goes away. Start now, because large sites can take more than a week to process an RCD change.

If your organization turned on RSS during its first Copilot rollout, that was a sensible call. It bought time to review permissions before Copilot could surface overshared content. That time now has an end date: January 31, 2027, about 15 weeks away.

The detail that catches teams out is the direction of the change. RSS hid everything except the sites on your list. RCD shows everything except the sites you flag. Moving from one to the other is not a settings migration. It is a governance decision about which content Copilot should reach, and it deserves a plan rather than a last-minute switch.

What is Restricted SharePoint Search, and what replaces it?

Restricted SharePoint Search is a tenant-wide allow-list of up to 100 SharePoint sites. When it is on, only those sites (plus content a user owns, recently opened or had shared with them) appear in organization-wide search and Microsoft 365 Copilot. Restricted Content Discovery replaces it. RCD is a site-level setting that keeps a flagged site out of organization-wide search and Copilot, while every other site stays discoverable.

What is changing with Restricted SharePoint Search?

Microsoft's Restricted SharePoint Search documentation on Microsoft Learn now opens with the retirement notice and points organizations to Restricted Content Discovery, SharePoint Advanced Management and Microsoft Purview for long-term control.

How do Restricted SharePoint Search and Restricted Content Discovery differ?

Both controls change what appears in organization-wide search and Copilot. Neither changes who can open a file. The difference is the default.

How do you turn on Restricted Content Discovery for a site?

In the SharePoint admin center, go to Sites, then Active sites, select the site, open the Settings tab, set Restrict content from Microsoft 365 Copilot to On and select Save. For bulk changes, use PowerShell: Set-SPOSite -Identity <site-url> -RestrictContentOrgWideSearch $true.

Once the change propagates, people who visit the site see a Restricted tag, and the Copilot button, AI actions and Create pages with AI disappear from that site. Anyone with permission can still open the content directly.

You can also let site admins manage the setting for their own sites with Set-SPOTenant -DelegateRestrictedContentDiscoverabilityManagement $true. Each change then asks for a justification, and Microsoft Purview records it in the audit log.

RCD requires a Microsoft 365 Copilot license in your tenant and SharePoint Advanced Management, which Microsoft includes for Copilot-licensed tenants. If you have not explored it yet, Take Advantage of SharePoint Advanced Management in Your Microsoft 365 Copilot Tenant walks through the features worth turning on first.

Why does the Restricted SharePoint Search retirement matter?

• The default flips. Under RSS, a forgotten finance or HR site stayed out of Copilot because nobody added it to the list. Under RCD, that same site is discoverable unless someone flags it. Your exposure is every site that was never on the allow-list.
• Indexing takes time. RCD is a site-level setting that must propagate through search. Microsoft notes that sites with more than 500,000 items can take more than a week to fully reflect a change. Flag late, and there is a gap between RSS ending and RCD taking effect.
• RSS was never a security boundary. Even with RSS on, people could still see content they owned, recently accessed or had shared with them. RCD does not change permissions either. Only permission cleanup actually reduces oversharing.
• RSS was costing you Copilot value. Limiting Copilot to 100 sites means fewer sources, less complete answers and a narrower search experience for everyone, including people without Copilot. Retiring it is a chance to give Copilot the reviewed content it needs to be useful, which is the idea behind an intelligent intranet.

The pattern is familiar. In Your Agent Estate Doubled. Your Controls Didn't., we looked at how AI adoption keeps outpacing the controls behind it. A temporary control quietly becoming permanent is one of the most common ways that gap forms.

Some sectors have extra decisions to make:

• Nonprofits often share HR, donor and client case sites broadly so staff and volunteers can work quickly. Review those sites first, and flag any you cannot clean up before RSS ends.
• Education institutions hold student records, counselling notes and staff HR files across many departmental sites. The retirement lands as winter term begins, so finish flagging and permission reviews before the December break.
• Government tenants in GCC, GCC High and DoD are included in the retirement. RCD does not remove content from the index, so Purview eDiscovery and auto-labeling keep working, which matters for records and access-to-information obligations.

What should IT leaders do before January 31, 2027?

1. Confirm whether RSS is on. Use the Restricted SharePoint Search PowerShell scripts to check its status and export your allow-list. If RSS was never enabled, your search and Copilot experience will not change, but this is still a good moment to apply RCD to your highest-risk sites.
2. Find the sites the allow-list was hiding. Everything not on the list is your exposure set. Run Data Access Governance reports for sites shared with "Everyone except external users" and broad sharing links, then rank sites by sensitivity and breadth of access.
3. Flag high-risk sites with RCD now. Use the admin center setting or the PowerShell command shown above, and start with your largest sites so indexing finishes well before January.
4. Fix permissions, not only visibility. Send site access reviews to owners, remove unneeded org-wide access and apply sensitivity labels. For your most confidential content, add a Purview DLP rule for Copilot, as covered in How to Use Copilot Policy Location (Purview DLP) to Block Sensitive Content.
5. Give every RCD flag an owner and an exit date. Microsoft describes RCD as a temporary governance control too. Track flagged sites with the RCD report cmdlets, review them monthly and remove the flag once a site passes review. If you delegate RCD to site admins, they must record a justification, and Purview audits each change.
6. Turn off RSS on your date, not Microsoft's. Once your flags have processed and the riskiest sites are clean, disable RSS deliberately during a quiet week, ideally well before January 31, so you control the timing and can watch the results.
7. Tell people what is changing. Let users, site owners and Copilot agent owners know that answers will draw on more content. Site owners should expect a Restricted tag and no Copilot button on flagged sites, and should know how to request a review.

Doing this once is not enough. As we argue in Copilot Governance Gap in 2026: Why Deployments Stall and How to Close It, governance holds when it becomes a routine with owners, not a project with an end date.

How do you tie Copilot spend to measurable value?

RSS carried a hidden cost. Every Copilot seat you paid for was grounding on a fraction of your SharePoint content. Retiring RSS well is one of the few governance changes that can lower risk and raise Copilot value at the same time, as long as you measure both sides.

A simple monthly view is enough to start:

• Coverage: the share of active sites Copilot can ground on, compared with the 100-site ceiling under RSS
• Risk: sites still shared with the whole organization, RCD flags open and flags past their exit date
• Value: Copilot usage and time saved on two or three measured workflows, before and after RSS is turned off
• Decision: remove flags as sites pass review, coach teams where usage stalls and expand seats where value is proven

For example, if 150 Copilot users each save 30 minutes a week once Copilot can reach reviewed policy, project and client content, that is about 300 hours a month. Set that against your license cost and the case for finishing the cleanup is easy to make. The metrics in Beyond 'Active Users': The Copilot Adoption Metrics That Actually Prove Value show how to capture the value side, and Secure Copilot Adoption in 8 Weeks: A Purview Governance Case Study shows what a structured remediation looks like.

What do IT leaders ask about the Restricted SharePoint Search retirement?

When does Restricted SharePoint Search retire?

New enablement was blocked on July 31, 2026, and Restricted SharePoint Search is fully retired by January 31, 2027. Microsoft does not migrate RSS settings to Restricted Content Discovery, so plan the move yourself.

What replaces Restricted SharePoint Search?

Restricted Content Discovery, a site-level setting in SharePoint Advanced Management, replaces it. Microsoft also points to SharePoint Advanced Management access controls and Microsoft Purview for long-term governance.

Will the retirement delete content or change permissions?

No. RSS only affected what appeared in organization-wide search and Copilot. When it retires, permissions stay exactly as they are, which is why sites with broad access need attention before then.

Does Restricted Content Discovery stop people from opening a file?

No. RCD keeps a site's content out of organization-wide search and Copilot discovery, but anyone with permission can still open the content directly. Use permission changes, Restricted Access Control or sensitivity labels to limit access itself.

How can 2toLead help?

2toLead works with small and mid-market organizations across healthcare, nonprofit, education, financial services, professional services, government and manufacturing on Copilot readiness, SharePoint governance and adoption. Before January 31, we can help you:

• Check your RSS status and map the sites your allow-list was hiding
• Prioritize overshared sites and apply Restricted Content Discovery where it is needed
• Run site access reviews, labeling and Copilot DLP so flags can come off on schedule
• Set up a simple scorecard that tracks coverage, risk and Copilot value month over month

For more on Copilot, SharePoint and governance, browse the 2toLead Insights hub. When you are ready, book a Copilot oversharing review with our team before Restricted SharePoint Search retires.

No hype. Just practical, governed AI that actually gets adopted.