Microsoft 365 Copilot generally uses the signed-in user’s existing permissions to Microsoft 365 content. To manage what Copilot can access, first correct who can access SharePoint and OneDrive content, then choose whether sensitive material should remain accessible but be less discoverable. Those are different goals: restricting access changes who can open content; restricting discovery affects whether it appears in Copilot and organization-wide search.
How Copilot access to organizational content works
Copilot can use Microsoft 365 information that the signed-in user is permitted to access. That means an overly broad SharePoint or OneDrive permission can also make content available to more people through Copilot. Copilot does not replace the organization’s permission model; it makes reviewing that model more urgent.
As an Amazon Associate I earn from qualifying purchases.
Start by deciding whether the problem is access or discoverability. If some people should not be able to open a site or its files at all, fix permissions or apply an access restriction. If people may retain permission but the content should not surface in Copilot or organization-wide search, use a discovery control instead.
Choose the control that matches the goal
| Control | What it changes | Scope and search behavior | Important limits |
|---|---|---|---|
| Existing SharePoint or OneDrive permissions | Who can access content under the normal permission model. | Copilot follows the signed-in user’s access. | Broad sharing remains broad access until corrected. |
| Restricted Access Control (also called restricted site access control) | Adds an access gate: users need both the normal site or content permission and membership in an allowed group. | Applies to a SharePoint site or OneDrive; Microsoft says Copilot and organization-wide search honor the policy. | Microsoft documents a limit of 10 configured groups per site. Search-index updates can take time, particularly for larger sites. |
| Restricted Content Discovery | Limits discoverability without changing the underlying site permissions. | Prevents site content from appearing in Copilot and organization-wide search; users may still access it through their existing permissions. | Not an access restriction. On a site marked for restricted discovery, Microsoft says the SharePoint agent icon is hidden and users cannot create or use agents there. |
| Restricted SharePoint Search | Temporarily limits search scope with an allow list; it does not change site permissions. | Microsoft documents an allow list of up to 100 SharePoint sites. It can reduce information available to Copilot and affect general search. | Microsoft says it is not a security boundary. Recent user access or content shared through Teams or Outlook can still affect what appears. New enablement is blocked starting July 31, 2026, according to Microsoft’s current documentation. |
Microsoft describes Restricted Content Discovery as useful when content must remain accessible but should not be broadly discoverable. By contrast, Restricted Access Control is the relevant option when the organization needs to limit access to designated groups.
Review and tighten permissions before relying on Copilot controls
- Inventory exposed content. Use SharePoint data access governance reports, site permission and sharing reports, and site-owner access reviews to identify broadly shared, unmanaged, sensitive, inactive, or ownerless sites.
- Correct source permissions. Review SharePoint and OneDrive sharing settings and remove broad access that is not intended. Check who has access through direct permissions, groups, and sharing links.
- Apply the matching site control. For an access boundary, configure Restricted Access Control with the intended Microsoft 365 or Microsoft Entra security groups. For content that should stay accessible but be less discoverable, configure Restricted Content Discovery.
- Check Teams channel sites separately. Shared and private channel sites are separate site collections from the parent team site. A restriction on the parent site does not automatically apply to those channel sites, so assess and configure them independently.
- Use information protection and monitoring. Consider Microsoft Purview sensitivity labels, DLP, auditing, and other controls according to the organization’s compliance needs and licensing. Review the resulting reports and access reviews regularly.
- Reassess the content over time. Archive or delete material that is no longer needed, and maintain site ownership and lifecycle reviews so old or ownerless content does not remain unnecessarily exposed.
With Restricted Access Control, group membership alone does not grant a user the ordinary permission to a site or file. The user needs both that permission and membership in at least one configured group. Microsoft says users outside the configured groups cannot access a restricted site or its content even if they previously had permissions or a sharing link.
For a shared Teams channel, Microsoft notes a specific external-participant qualification: participants from another tenant are not evaluated against the resource tenant’s Restricted Access Control group. Their access remains governed by shared-channel and site permissions.
Rank #2
Handle Restricted SharePoint Search as a transition measure
Restricted SharePoint Search should not be used as a substitute for fixing permissions. Microsoft’s documentation says it neither changes site permissions nor guarantees that only allow-listed content can appear. Recent user access and material shared through Teams or Outlook can still affect what a user sees.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →As of Microsoft’s documentation checked on October 4, 2026, the page says the feature is retiring and that new enablement is blocked beginning July 31, 2026. If it is already enabled in the tenant, check the live admin-center state and current Microsoft guidance before making changes. Microsoft recommends moving toward comprehensive governance, validating the replacement controls, and then disabling Restricted SharePoint Search.
Govern SharePoint agents as well as Copilot
SharePoint agents use underlying data permissions in the same way as Copilot in other Microsoft 365 apps. Admins can govern the data they draw on through site access restrictions and discovery controls, and manage agent availability through the Microsoft 365 admin center. Tenant admins and AI admins can review actively used agents and block or unblock them there.
- Access to agents can be managed through Copilot license assignment or pay-as-you-go billing-policy groups.
- Microsoft documents DLP policies as a way to exclude selected files from agent processing. A DLP policy can use a sensitivity-label condition to prevent selected content from being processed; a response citation may still identify a file without using its contents.
- A
.agentfile cannot currently receive a sensitivity label directly, according to Microsoft’s agent guidance. DLP governance for that file can instead use its file extension as a condition.
Confirm licensing and validate behavior in your tenant
Feature availability varies by license and cloud environment. Microsoft’s governance guidance distinguishes foundational controls associated with A3/E3/G3 licensing from optimized controls associated with A5/E5/G5; a separate SharePoint Advanced Management matrix lists availability across business and government clouds and identifies sensitivity labels as requiring E5 or G5 in that matrix. These are not blanket entitlements for every Purview capability. Confirm the specific control against current licensing documentation and the organization’s tenant before deployment.
After changing permissions or policies, validate the intended behavior with representative user accounts and content. Allow for search-index updates, especially on larger sites, and communicate expected changes to users. Continue monitoring reports and access reviews as sharing, group membership, site ownership, and agent use change.
Microsoft’s relevant documentation includes Get ready for Microsoft Copilot with SharePoint Advanced Management, Restrict SharePoint site access with Microsoft 365 groups and Microsoft Entra security groups, Restricted SharePoint Search, and Microsoft’s guidance on SharePoint agents and licensing. Availability and feature details can change, so check the current Microsoft Learn guidance for the tenant’s cloud and plan before operational changes.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
