Restricted Content Discovery Review

TL;DR: This skill reviews where Restricted Content Discovery is applied across SharePoint sites, what it does and does not change, and what to check before and after rollout. It reads status, delegation, reports and audit events only. It never changes a site setting.

What does this review do, and how is it different from Restricted SharePoint Search Readiness?

This read-only skill reviews where Restricted Content Discovery (RCD) is already applied across SharePoint sites and what to verify before and after rollout. It differs from Restricted SharePoint Search Readiness, which ranks sites by oversharing risk to pick RCD candidates. This skill audits the applied state. Neither skill changes a setting.

Use the readiness skill first to choose candidates, then use this review to confirm what is applied, who can change it, and whether the change has taken effect. Status below is stated per Microsoft Learn as at 30 September 2026. Microsoft Learn is the only authority used for product behaviour on this page.

When should you run a Restricted Content Discovery review?

Run the review before applying RCD, after any bulk change, and whenever a restricted site still appears in search. Microsoft Learn lists sites at high oversharing risk, sites undergoing permissions review, phased Microsoft 365 Copilot rollouts and governance validation as common scenarios. Learn calls RCD temporary, so each review should also ask which restrictions can now come off.

Invoke this skill when asked to:

• “Which SharePoint sites have Restricted Content Discovery applied?”
• “Can site administrators change Restricted Content Discovery?”
• “Why does a restricted site still appear in search?”
• “What should we check before we restrict more sites from Copilot?”

What does Restricted Content Discovery do, and what does it not do?

Per Microsoft Learn, RCD is a site-level setting that limits discovery of a site’s content in organisation-wide search and Microsoft Copilot. It does not change permissions, does not remove content from the Microsoft 365 search index, and is not supported for OneDrive. It also removes AI-powered entry points from the restricted site.

How is Restricted Content Discovery different from Restricted SharePoint Search?

Per Microsoft Learn, Restricted SharePoint Search is retiring: new enablement is blocked from 31 July 2026, and Learn points to RCD as an example of a data control for content discoverability. Restricted SharePoint Search uses an allow list of up to 100 sites. RCD instead restricts the sites you select. Neither changes site permissions.

Learn says Restricted SharePoint Search should be disabled once permissions and governance controls are validated. For the retirement and migration view, use Restricted SharePoint Search Readiness and do not duplicate it here.

What do you need before you start?

Microsoft Learn says you can configure RCD if your organisation is licensed for Copilot and has SharePoint Advanced Management available. Review the SharePoint Advanced Management prerequisites, including the SharePoint Online PowerShell module and role assignments, and review your catalog categories. Licence and role detail is in the table further down.

• A Microsoft Copilot licence, as Learn states RCD is intended for Copilot deployment and governance scenarios.
• SharePoint Advanced Management prerequisites met, including the SharePoint Online Management Shell (Learn says to download the latest version before running commands).
• An appropriate role in Microsoft Entra ID to reach the SharePoint admin center.
• Existing catalog categories reviewed, and added where needed, if you plan to apply RCD to groups of sites.
• A list of sites you expect to be restricted, for example from the Data Access Governance reports, Content Management Assessment or SharePoint Admin Agent that Learn suggests for identifying sites.

How does the review work, step by step?

The review has eight steps: confirm prerequisites, check delegation, generate the tenant report, download it, check individual sites, review catalog group status, review Microsoft Purview audit events, and cross-check against oversharing findings and item counts. The skill uses no Set- cmdlets, and each step produces input for a row in the output table.

1. Confirm the prerequisites above and record which roles performed the review.

2. Check whether delegation to site administrators is on:

   Get-SPOTenant | Select-Object DelegateRestrictedContentDiscoverabilityManagement

3. Generate the tenant report, then check its status:

   Start-SPORestrictedContentDiscoverabilityReport
   Get-SPORestrictedContentDiscoverabilityReport

4. Download the completed report using the report GUID from the status output:

   Get-SPORestrictedContentDiscoverabilityReport -Action Download -ReportId <ReportGUID>

5. For any site you need to confirm individually, check its setting:

   Get-SPOSite -Identity <site-url> | Select RestrictContentOrgWideSearch

6. In the SharePoint admin center, open Reports > Catalog management > Actions and record the groups with RCD applied and each status: Completed, Processing, Adding sites, Removing sites, Check site report or Error.

7. Search Microsoft Purview audit log activities for RCD events: enabling, disabling and the justifications provided when a site administrator changed the setting.

8. Cross-check each restricted site against your oversharing findings, and record the item count. Learn says updates for sites with more than 500,000 items could take more than a week to reflect in search and Copilot.

Learn documents the report commands as a way to identify sites where RCD is enabled.

What should you check before and after rollout?

Before rollout, confirm the prerequisites, the candidate list, who holds change rights and what users will lose on each site. After rollout, confirm status, propagation, audit events and whether each restriction is still needed. The table below turns that into a checklist.

Output format

Produce a Markdown table with one row per site or catalog group reviewed:

Follow the table with a summary:

• Sites reviewed: N
• Sites with RCD applied: N
• Catalog groups with Error or Processing status: N
• Changes made by site administrators with justification recorded: N
• Sites still needed under RCD versus ready for removal: N and N

Scope and safety

This skill is read-only by default. It reads settings, reports and audit events and recommends actions for an administrator to take separately. It does NOT:

• Run Set-SPOSite with -RestrictContentOrgWideSearch to enable or remove RCD on any site
• Run Set-SPOTenant to turn delegation on or off
• Apply or remove RCD through catalog groups
• Change site permissions, ownership or content
• Change Microsoft Copilot licensing or access

Licensing and permissions

Licences and add-ons

Roles

• SharePoint Administrator: per Learn, by default only SharePoint administrators can manage RCD. Learn’s prerequisites page lists this role for SharePoint admin center access.
• SharePoint Advanced Management Administrator: listed on the prerequisites page with all SharePoint Administrator capabilities plus advanced governance capabilities.
• Site administrators: can manage RCD for their own sites only when delegation is enabled, and must give a justification for any change.
• The cited pages do not state which role is needed for the report cmdlets, for catalog management or for searching Purview audit log activities. Confirm these in your tenant before relying on them.

Frequently asked questions

Does Restricted Content Discovery change who can open a file?

No. Microsoft Learn states that RCD affects discoverability, not access permissions. Users who already have access to content can continue to access it directly. To change who has access, fix permissions separately, for example with the SharePoint Oversharing Audit findings.

Why does a restricted site still show in search?

Learn says index propagation takes time and depends on site size, file count and concurrent updates, and that a site with more than 500,000 items could take more than a week. Learn also says users can still discover content they own or have recently interacted with.

Can I apply Restricted Content Discovery to many sites at once?

Yes. Learn says catalog management lets you apply RCD to a catalog group, up to 20,000 SharePoint sites. Sites that already have RCD enabled are not modified. A group is added as a snapshot, so later membership changes need the group removed and re-added.

Related skills

• Restricted SharePoint Search Readiness: run first to rank sites and pick RCD candidates as Restricted SharePoint Search retires.
• SharePoint Oversharing Audit: run first to find the Anyone links and external access that justify a restriction.
• Data Access Governance Report Review: run alongside to turn the reports into an owner-assigned remediation plan.
• SharePoint Advanced Management Site Governance: run alongside to audit the wider Advanced Management configuration.
• SharePoint Copilot Readiness Guide: the pillar guide that places interim restrictions in the ordered readiness path.

Sources

Reviewed 2026-09-30. Feature behaviour, cmdlets, limits, licensing, roles and dates were checked against the Microsoft Learn pages below. Microsoft Learn does not label RCD as preview or generally available on these pages, so this skill makes no claim on that. The step order, output columns and checklist are this skill’s own design, not Microsoft guidance.

• Restrict discovery of SharePoint sites and content (Restricted Content Discovery) 
• Restricted SharePoint Search 
• Catalog management in SharePoint Advanced Management 
• Prerequisites for SharePoint Advanced Management 
• Get ready for Microsoft Copilot and agents with SharePoint Advanced Management 

Licensed under CC BY 4.0  by EDUC4TE .

Last reviewed 2026-09-30