Restricted SharePoint Search Is Retiring: Planning the Move to Restricted Content Discovery

Microsoft 365 Message Center announcement MC1395311 confirms that Restricted SharePoint Search will be retired on 31 January 2027. Organisations using RSS should start planning now, particularly where it has been used as part of a Microsoft 365 Copilot readiness strategy.

The key point is not that RSS was a bad idea. It was designed as a short-term control, giving teams time to review SharePoint permissions and governance before making more content discoverable through Microsoft Search, Copilot Chat, and agentic experiences.

The next step is to move from a broad tenant-level restriction to a more targeted approach, using Restricted Content Discovery (RCD) where it is needed.

Retirement dates

There are three dates to add to the change plan.

If your organisation is not using RSS, there is nothing to migrate. For organisations that are using it, current RSS configuration will not be converted automatically to RCD.

What RSS did

Restricted SharePoint Search is a tenant-wide allow-list control. Administrators choose the SharePoint sites that are available to organisation-wide search, Copilot Chat, and agentic experiences, while other SharePoint sites are excluded from broad discovery.

RSS was useful when an organisation wanted to begin using Copilot but had not yet reviewed the permissions and sharing posture across its whole SharePoint estate.

There were always limitations. RSS was a temporary measure, not a security boundary, and it did not change existing permissions. It also limits the allowed list to 100 SharePoint sites, which becomes difficult to manage as a tenant grows.

Users could still access content they owned, had accessed recently, or had received directly through sharing. RSS reduced broad discoverability, but it was not intended to replace permissions governance.

How RCD differs

Restricted Content Discovery works from the opposite direction. Rather than approving the relatively small number of sites that can be discovered, RCD is applied to the specific sites that should not be broadly discoverable while they are reviewed.

RCD helps stop content from selected SharePoint sites appearing in organisation-wide search and Microsoft 365 Copilot experiences. However, a user who already has access can still access that content directly, and may still see content they own or have recently interacted with.

This distinction matters. RCD is a discovery control, not access control.

The positive side

RCD is more granular. It lets an organisation maintain normal discovery for the broader SharePoint environment while applying a temporary restriction only to sites that are genuinely higher risk.

Typical examples include:

• Sites with elevated oversharing risk
• Finance, HR, legal, or executive sites awaiting a permissions review
• Sites with unclear ownership
• Sites being assessed as part of a phased Copilot rollout
• Content that needs governance validation before it becomes broadly discoverable

That is a more sustainable operating model than maintaining a tenant-wide allow-list. It also avoids unnecessarily limiting Copilot’s access to content that has already been properly governed. RSS can reduce the completeness and relevance of Copilot responses because less SharePoint content is available for it to reference.

What happens if you miss it?

From 31 January 2027, RSS will stop working. If RSS is the only control keeping a SharePoint site out of Microsoft Search and Copilot, that site may become discoverable after retirement.

There is no automatic migration of the RSS allowed-site list to RCD. Administrators need to identify the sites currently covered by RSS, decide which need an ongoing restriction, and configure RCD or another appropriate control.

The practical risk is not that permissions suddenly change. The risk is that the discovery layer changes while existing permissions remain exactly as they are.

That is why the work should focus on both discovery controls and the underlying data posture.

Do not use RSS for new Copilot deployments

If you are planning a new Microsoft 365 Copilot deployment, do not build the rollout plan around RSS.

New enablement is blocked from 31 July 2026 and the feature is fully retired six months later. RSS is not a viable foundation for a new deployment.

Use RCD selectively for sites requiring additional review, then build the wider programme around durable governance controls:

• Review site ownership and lifecycle status
• Review broad access, direct permissions, and external sharing
• Apply sensitivity labels and data loss prevention where required
• Use data access governance reporting to identify oversharing risks
• Establish remediation and access-review processes
• Communicate expected changes to search and Copilot behaviour with site owners, IT teams, and Copilot agent owners

Check and disable RSS

Before planning the transition, confirm whether Restricted SharePoint Search is enabled and capture the current allowed-site list. RSS is disabled by default, and the related commands are available through the Microsoft.Online.SharePoint.PowerShell module. You must be a SharePoint Administrator, or have equivalent permissions, to run them.

Check the current RSS mode:

Get-SPOTenantRestrictedSearchMode

The result will be either Enabled or Disabled.

If RSS is enabled, retrieve the current allow-list before making changes:

Get-SPOTenantRestrictedSearchAllowedList

Use the list as an input to your review. It should help identify which sites need an ongoing discovery restriction through RCD and which can return to normal discoverability once their permissions and governance posture have been assessed.

Once RCD or another suitable control is in place for the sites that need it, disable RSS:

Set-SPOTenantRestrictedSearchMode -Mode Disabled

Disabling RSS removes the tenant-wide allow-list restriction. Validate RCD settings and communicate the expected search and Copilot impact to relevant teams before making this change.

Applying RCD

RCD can be enabled for an individual SharePoint site through the SharePoint admin centre:

1. Open the SharePoint admin centre.
2. Select Sites, then Active sites.
3. Select the site to configure.
4. Open Settings.
5. Turn on Restrict content from Microsoft 365 Copilot.
6. Select Save.

It can also be enabled with SharePoint Online PowerShell:

Set-SPOSite -Identity <site-url> -RestrictContentOrgWideSearch $true

To remove the restriction after the site has been reviewed:

Set-SPOSite -Identity <site-url> -RestrictContentOrgWideSearch $false

You can check whether RCD is enabled for a site with:

Get-SPOSite -Identity <site-url> | Select-Object RestrictContentOrgWideSearch

RCD changes can take time to propagate across search and Copilot. Larger sites, particularly those with more than 500,000 items, may take more than a week to be fully reflected in those experiences.

A practical migration plan

A useful migration is not about recreating the RSS allowed list in a new product. It is about identifying the smaller group of sites that still need temporary discovery restrictions and remediating the rest.

1. Confirm RSS is enabled. Check the current RSS mode and capture the existing allowed-site list.
2. Classify the current list. For each site, identify its owner, business purpose, data sensitivity, sharing posture, and whether it is still active.
3. Identify sites needing temporary restriction. Look for sites with broad access, uncertain ownership, sensitive information, or incomplete permission reviews.
4. Apply RCD selectively. Configure RCD for sites that need to be withheld from broad search and Copilot discovery while remediation occurs.
5. Validate the experience. Test Microsoft Search and Copilot with representative users. Remember that RCD does not prevent direct access for users who already have permission.
6. Remediate the underlying issues. Review memberships, direct permissions, external sharing links, labels, site lifecycle, and ownership.
7. Remove RCD when appropriate. Once a site has an acceptable data and permissions posture, restore normal discoverability.
8. Retire RSS before January 2027. Do not leave this until the retirement date, particularly if internal teams rely on existing PowerShell processes.

Important RCD limitations

RCD is valuable, but it should be used deliberately.

It applies only to SharePoint sites, not OneDrive. It does not remove content from the Microsoft 365 search index, change user permissions, or affect Microsoft Purview features such as eDiscovery and auto-labelling.

It also does not affect searches initiated from within the relevant SharePoint site, nor does it affect every intelligent experience, such as Microsoft 365 Feed and Recommendations.

Overusing RCD can reduce the completeness of search results and Copilot responses. Use it as a temporary control for sites that need review, not as a substitute for improving the SharePoint information architecture and access model.

Final thought

The retirement of RSS is a useful forcing function for Copilot governance. It moves the conversation away from maintaining a broad, temporary allow-list and towards targeted discovery controls backed by sound permissions, ownership, lifecycle, and information-protection practices.

For organisations already using RSS, start with the allowed-site list and determine what it tells you about the estate. For organisations beginning a Copilot deployment now, start with RCD where needed and focus the main effort on getting SharePoint governance right.