---
name: Restricted Content Discovery Review
description: Review where Restricted Content Discovery is applied in SharePoint, what it does and does not change, and what to check before and after rollout.
lastReviewed: 2026-09-30
---

# Restricted Content Discovery Review

> **TL;DR:** This skill reviews where Restricted Content Discovery is applied across SharePoint sites, what it does and does not change, and what to check before and after rollout. It reads status, delegation, reports and audit events only. It never changes a site setting.

## What does this review do, and how is it different from Restricted SharePoint Search Readiness?

This read-only skill reviews where Restricted Content Discovery (RCD) is already applied across SharePoint sites and what to verify before and after rollout. It differs from [Restricted SharePoint Search Readiness](/sharepoint/restricted-sharepoint-search-readiness), which ranks sites by oversharing risk to pick RCD candidates. This skill audits the applied state. Neither skill changes a setting.

Use the readiness skill first to choose candidates, then use this review to confirm what is applied, who can change it, and whether the change has taken effect. Status below is stated per Microsoft Learn as at 30 September 2026. Microsoft Learn is the only authority used for product behaviour on this page.

## When should you run a Restricted Content Discovery review?

Run the review before applying RCD, after any bulk change, and whenever a restricted site still appears in search. Microsoft Learn lists sites at high oversharing risk, sites undergoing permissions review, phased Microsoft 365 Copilot rollouts and governance validation as common scenarios. Learn calls RCD temporary, so each review should also ask which restrictions can now come off.

Invoke this skill when asked to:

- "Which SharePoint sites have Restricted Content Discovery applied?"
- "Can site administrators change Restricted Content Discovery?"
- "Why does a restricted site still appear in search?"
- "What should we check before we restrict more sites from Copilot?"

## What does Restricted Content Discovery do, and what does it not do?

Per Microsoft Learn, RCD is a site-level setting that limits discovery of a site's content in organisation-wide search and Microsoft Copilot. It does not change permissions, does not remove content from the Microsoft 365 search index, and is not supported for OneDrive. It also removes AI-powered entry points from the restricted site.

| Question | What Microsoft Learn states |
| --- | --- |
| Does it change permissions? | No. Users who already have access can continue to access the content directly |
| Is content removed from the search index? | No. Microsoft Purview capabilities such as eDiscovery and auto-labelling continue to function |
| Which search experiences are affected? | Organisation-wide search (SharePoint home, Office.com, Bing) and Microsoft Copilot discovery, including experiences that rely on tenant-wide content discovery |
| Which experiences are not affected? | Searches that start from site context, other intelligent experiences such as Microsoft 365 Feed and Recommendations, and experiences on content already in use, such as summarising an open document |
| Can users still find some content? | Yes. Users can still discover content they own or have recently interacted with |
| What changes for users on the site? | The Copilot button, AI actions menus (including creating agents) and **Create pages with AI** are not shown. A Restricted tag is visible on the site |
| Which sites are supported? | SharePoint sites only, not OneDrive |
| Is it meant to be permanent? | No. Learn describes it as a temporary governance control and cautions that excessive use reduces the content available to search and Copilot |

## How is Restricted Content Discovery different from Restricted SharePoint Search?

Per Microsoft Learn, Restricted SharePoint Search is retiring: new enablement is blocked from 31 July 2026, and Learn points to RCD as an example of a data control for content discoverability. Restricted SharePoint Search uses an allow list of up to 100 sites. RCD instead restricts the sites you select. Neither changes site permissions.

| Aspect | Restricted Content Discovery | Restricted SharePoint Search |
| --- | --- | --- |
| Status per Learn | Named by Learn as an example of a data control to use for content discoverability | Retiring; new enablement blocked from 31 July 2026 |
| Model | Restricts discovery of the selected sites | Allow list of sites that can appear in organisation-wide search |
| Site numbers | Up to 20,000 sites through catalog groups | Allow list limited to 100 sites (hub sites count once) |
| Permissions | Unchanged | Not a security boundary; does not change permissions |
| Content users can still find | Content they own or have recently interacted with | Content they own, previously accessed, or had shared in Teams or Outlook |
| Site-scoped search | Not affected | Not affected |
| Time to take effect | Depends on site size and concurrent updates; more than a week is possible above 500,000 items | Learn states it takes effect within an hour |
| Other Microsoft index features | Purview eDiscovery and auto-labelling continue to work | Learn states other features based on the Microsoft Index are not affected |
| Licensing stated on its page | Microsoft Copilot licence and SharePoint Advanced Management available | The Learn page does not state a licence requirement |

Learn says Restricted SharePoint Search should be disabled once permissions and governance controls are validated. For the retirement and migration view, use [Restricted SharePoint Search Readiness](/sharepoint/restricted-sharepoint-search-readiness) and do not duplicate it here.

## What do you need before you start?

Microsoft Learn says you can configure RCD if your organisation is licensed for Copilot and has SharePoint Advanced Management available. Review the SharePoint Advanced Management prerequisites, including the SharePoint Online PowerShell module and role assignments, and review your catalog categories. Licence and role detail is in the table further down.

- A Microsoft Copilot licence, as Learn states RCD is intended for Copilot deployment and governance scenarios.
- SharePoint Advanced Management prerequisites met, including the SharePoint Online Management Shell (Learn says to download the latest version before running commands).
- An appropriate role in Microsoft Entra ID to reach the SharePoint admin center.
- Existing catalog categories reviewed, and added where needed, if you plan to apply RCD to groups of sites.
- A list of sites you expect to be restricted, for example from the Data Access Governance reports, Content Management Assessment or SharePoint Admin Agent that Learn suggests for identifying sites.

## How does the review work, step by step?

The review has eight steps: confirm prerequisites, check delegation, generate the tenant report, download it, check individual sites, review catalog group status, review Microsoft Purview audit events, and cross-check against oversharing findings and item counts. The skill uses no `Set-` cmdlets, and each step produces input for a row in the output table.

1. Confirm the prerequisites above and record which roles performed the review.
2. Check whether delegation to site administrators is on:

    ```powershell
    Get-SPOTenant | Select-Object DelegateRestrictedContentDiscoverabilityManagement
    ```

3. Generate the tenant report, then check its status:

    ```powershell
    Start-SPORestrictedContentDiscoverabilityReport
    Get-SPORestrictedContentDiscoverabilityReport
    ```

4. Download the completed report using the report GUID from the status output:

    ```powershell
    Get-SPORestrictedContentDiscoverabilityReport -Action Download -ReportId <ReportGUID>
    ```

5. For any site you need to confirm individually, check its setting:

    ```powershell
    Get-SPOSite -Identity <site-url> | Select RestrictContentOrgWideSearch
    ```

6. In the SharePoint admin center, open **Reports** > **Catalog management** > **Actions** and record the groups with RCD applied and each status: Completed, Processing, Adding sites, Removing sites, Check site report or Error.
7. Search Microsoft Purview audit log activities for RCD events: enabling, disabling and the justifications provided when a site administrator changed the setting.
8. Cross-check each restricted site against your oversharing findings, and record the item count. Learn says updates for sites with more than 500,000 items could take more than a week to reflect in search and Copilot.

Learn documents the report commands as a way to identify sites where RCD is enabled.

## What should you check before and after rollout?

Before rollout, confirm the prerequisites, the candidate list, who holds change rights and what users will lose on each site. After rollout, confirm status, propagation, audit events and whether each restriction is still needed. The table below turns that into a checklist.

| When | Check | Why, per Microsoft Learn |
| --- | --- | --- |
| Before | Candidate sites come from oversharing evidence | Learn lists high-risk, permissions-review and phased Copilot sites as the scenarios |
| Before | Delegation status is recorded | By default only SharePoint administrators manage RCD; delegation is optional |
| Before | Site owners know AI entry points will be removed | The Copilot button, AI actions and **Create pages with AI** are not shown |
| Before | The number of restricted sites is kept deliberate | Excessive use reduces content available to search and Copilot |
| Before | Large sites are identified | Sites above 500,000 items could take more than a week to fully process |
| After | Status confirmed per site or per catalog group | Learn documents `Get-SPOSite` and the catalog management status column |
| After | Restricted sites still appearing in search are investigated | Learn advises allowing for propagation and reviewing the site's item count |
| After | Audit events reviewed | Enable, disable and justification events are available in Purview audit |
| After | Catalog group snapshots rechecked | A group added to RCD is a snapshot; sites added to the group later are not restricted until you remove and re-add the group |
| After | Expiry of need reviewed | Learn calls RCD temporary; after the review is complete you can remove the restriction |

## Output format

Produce a Markdown table with one row per site or catalog group reviewed:

| Site or group | RCD status | Applied via | Delegation | Last audit event | Items | Propagation note | Recommended action |
| --- | --- | --- | --- | --- | --- | --- | --- |

Follow the table with a summary:

- Sites reviewed: N
- Sites with RCD applied: N
- Catalog groups with Error or Processing status: N
- Changes made by site administrators with justification recorded: N
- Sites still needed under RCD versus ready for removal: N and N

## Scope and safety

This skill is read-only by default. It reads settings, reports and audit events and recommends actions for an administrator to take separately. It does NOT:

- Run `Set-SPOSite` with `-RestrictContentOrgWideSearch` to enable or remove RCD on any site
- Run `Set-SPOTenant` to turn delegation on or off
- Apply or remove RCD through catalog groups
- Change site permissions, ownership or content
- Change Microsoft Copilot licensing or access

## Licensing and permissions

### Licences and add-ons

| Capability used | Requirement per Microsoft Learn |
| --- | --- |
| Restricted Content Discovery | Your organisation is licensed for Copilot and has SharePoint Advanced Management available. Learn says a Microsoft Copilot licence is needed because RCD is intended for Copilot deployment and governance scenarios |
| SharePoint Advanced Management base subscription | Office 365 E3, E5 or A5; Microsoft 365 E1, E3, E5 or A5; or Microsoft 365 GCC, GCC-High or DoD |
| SharePoint Advanced Management access | At least one user assigned a Microsoft Copilot licence; or SharePoint K, P1 or P2 plus the SharePoint Advanced Management Plan 1 add-on; or Microsoft 365 E7 |
| Catalog management and Purview audit | The cited pages do not state a separate licence requirement |

### Roles

- SharePoint Administrator: per Learn, by default only SharePoint administrators can manage RCD. Learn's prerequisites page lists this role for SharePoint admin center access.
- SharePoint Advanced Management Administrator: listed on the prerequisites page with all SharePoint Administrator capabilities plus advanced governance capabilities.
- Site administrators: can manage RCD for their own sites only when delegation is enabled, and must give a justification for any change.
- The cited pages do not state which role is needed for the report cmdlets, for catalog management or for searching Purview audit log activities. Confirm these in your tenant before relying on them.

## Frequently asked questions

### Does Restricted Content Discovery change who can open a file?

No. Microsoft Learn states that RCD affects discoverability, not access permissions. Users who already have access to content can continue to access it directly. To change who has access, fix permissions separately, for example with the [SharePoint Oversharing Audit](/sharepoint/sharepoint-oversharing-audit) findings.

### Why does a restricted site still show in search?

Learn says index propagation takes time and depends on site size, file count and concurrent updates, and that a site with more than 500,000 items could take more than a week. Learn also says users can still discover content they own or have recently interacted with.

### Can I apply Restricted Content Discovery to many sites at once?

Yes. Learn says catalog management lets you apply RCD to a catalog group, up to 20,000 SharePoint sites. Sites that already have RCD enabled are not modified. A group is added as a snapshot, so later membership changes need the group removed and re-added.

## Related skills

- [Restricted SharePoint Search Readiness](/sharepoint/restricted-sharepoint-search-readiness): run first to rank sites and pick RCD candidates as Restricted SharePoint Search retires.
- [SharePoint Oversharing Audit](/sharepoint/sharepoint-oversharing-audit): run first to find the Anyone links and external access that justify a restriction.
- [Data Access Governance Report Review](/sharepoint/data-access-governance-report-review): run alongside to turn the reports into an owner-assigned remediation plan.
- [SharePoint Advanced Management Site Governance](/sharepoint/sharepoint-advanced-management): run alongside to audit the wider Advanced Management configuration.
- [SharePoint Copilot Readiness Guide](/sharepoint/copilot-readiness-guide): the pillar guide that places interim restrictions in the ordered readiness path.

## Sources

Reviewed 2026-09-30. Feature behaviour, cmdlets, limits, licensing, roles and dates were checked against the Microsoft Learn pages below. Microsoft Learn does not label RCD as preview or generally available on these pages, so this skill makes no claim on that. The step order, output columns and checklist are this skill's own design, not Microsoft guidance.

- [Restrict discovery of SharePoint sites and content (Restricted Content Discovery)](https://learn.microsoft.com/en-us/sharepoint/restricted-content-discovery)
- [Restricted SharePoint Search](https://learn.microsoft.com/en-us/sharepoint/restricted-sharepoint-search)
- [Catalog management in SharePoint Advanced Management](https://learn.microsoft.com/en-us/sharepoint/catalog-management)
- [Prerequisites for SharePoint Advanced Management](https://learn.microsoft.com/en-us/sharepoint/sharepoint-advanced-management-prerequisites)
- [Get ready for Microsoft Copilot and agents with SharePoint Advanced Management](https://learn.microsoft.com/en-us/microsoft-365/copilot/get-ready-copilot-sharepoint-advanced-management)