Restricted Access Control and Overshared Sites: Preparing SharePoint for Microsoft 365 Copilot

Copilot does not bypass SharePoint permissions. It makes them visible. A site opened to "Everyone except external users" years ago, a sharing link sent to the whole company, or a team site nobody owns anymore can all feed Copilot answers for people who were never meant to see that content. Fixing every permission before a rollout is the right goal, but it takes time. SharePoint gives you three controls to contain the riskiest sites while that work happens.

For the full rollout order, see our Copilot data readiness checklist.

The three SharePoint restriction controls compared

Restricted Access Control and Restricted Content Discovery are part of SharePoint Advanced Management, which is included once at least one Copilot license is assigned in your tenant. Check Microsoft Learn for the current licensing rules before you plan around them.

Step 1: Find the overshared sites first

Containment only works if you know which sites need it. Start with the broadest access: content shared with Everyone except external users, organization-wide sharing links, and sites without an active owner. Microsoft's data access governance reports in the SharePoint admin center list these. To see exactly who has access to each site, library, folder and file, run SharePoint Smart Permissions, our free, read-only permissions report, and export the result to Excel for site owners to review. Our guide to auditing Everyone except external users walks through that check.

Step 2: Lock sensitive sites with Restricted Access Control

Use Restricted Access Control for sites such as HR, legal, finance or executive content, where only a known group should ever have access. Members outside the chosen groups lose access even if a file was shared with them directly. With SharePoint Online Management Shell, turn the feature on for the tenant, then apply it to a site:

Set-SPOTenant -EnableRestrictedAccessControl $true

Set-SPOSite -Identity https://contoso.sharepoint.com/sites/HR -RestrictedAccessControl $true

Set-SPOSite -Identity https://contoso.sharepoint.com/sites/HR -AddRestrictedAccessControlGroups <group-object-id>

For sites connected to a Microsoft 365 group, Microsoft applies the policy using the group's membership. Check the current steps and limits on Microsoft Learn before you change production sites, and tell site owners first: people outside the groups will start seeing access denied.

Step 3: Hide overshared sites from Copilot with Restricted Content Discovery

Some sites are overshared but still used by many people, so cutting access would break work. Restricted Content Discovery keeps access as it is and stops the site from being surfaced in org-wide search and Copilot results:

Set-SPOSite -Identity https://contoso.sharepoint.com/sites/Projects -RestrictContentOrgWideSearch $true

People who already use the site can still open it. Microsoft describes this as a governance guardrail while you fix permissions, not a security boundary.

Step 4: Use Restricted SharePoint Search only for a short pilot

Restricted SharePoint Search works the other way around: org-wide search and Copilot only draw on sites on an allowed list, plus content people own or have used. It is useful for a tightly scoped first pilot, but it also hides good content, and Microsoft calls it temporary. Plan to turn it off once your reviews are done.

Step 5: Fix the underlying permissions

• Remove Everyone and Everyone except external users from sites that do not need them.
• Replace organization-wide links with links for specific people.
• Give every site an active owner and run site access reviews.
• Rerun your permissions report and compare it with the first one.

Once a site is clean, you can lift Restricted Content Discovery for it. Keep Restricted Access Control on sites that should always be limited to one team.

More on the admin tools behind these steps: what SharePoint Advanced Management includes with a Copilot license, how to find overshared sites with the Data Access Governance reports and whether Copilot can see files you can't open.

Want help preparing for Copilot?

Our team runs SharePoint permissions and oversharing reviews, sets up these controls with your admins, and hands site owners a clear list of fixes. Tell us about your tenant.