Restricted SharePoint Search Retirement and Your Copilot Risk

For the last two years, a single tenant-wide switch let cautious institutions deploy Microsoft 365 Copilot before they had finished cleaning up who can see what. Restricted SharePoint Search was that switch. It held SharePoint content back from Copilot and organization-wide search while administrators worked through their permissions, and a lot of banks, credit unions, and mortgage companies leaned on it as the thing that made an early Copilot rollout feel safe. Microsoft is now retiring it.

On June 18, 2026, the notice landed in the Microsoft 365 admin center as Message Center post MC1395311. Restricted SharePoint Search is going away on a fixed schedule, with no extensions, and Microsoft has been clear that it will not move your settings to the replacement for you. The successor control, Restricted Content Discovery, works differently enough that treating this as a like-for-like swap is the fastest way to end up exposed. For an institution that used Restricted SharePoint Search as a Copilot panic button, this is a dated obligation that has just appeared on the calendar.

This article lays out what is changing, the deadlines that matter, how the new per-site control differs from the old tenant-wide one, and the migration steps a regulated institution should run before the guardrail lapses. The productivity upside of Copilot has not changed. What has changed is that the interim shortcut is expiring, and the real governance work it was buying time for is now due. If you want the broader pre-flight picture, our guide on Copilot oversharing for financial institutions covers the full readiness path; this piece zooms in on the deadline that just got set.

What Just Changed, and Why Your Copilot Plan Depends On It

Start with what Restricted SharePoint Search actually was, because the value it provided is the value now at risk. It was a tenant-wide guardrail: switch it on, and only the SharePoint sites you placed on an allowed list could appear in organization-wide search and in Microsoft 365 Copilot. Everything else was held back from discovery. Microsoft always described it as a temporary measure, a curtain to draw while administrators reviewed and corrected permissions, not a permanent security boundary.

That temporary framing is the whole point of the retirement. Microsoft built a durable, surgical successor, Restricted Content Discovery, and is pulling the interim tool out of service to push every organization onto it. Message Center post MC1395311, published on June 18, 2026, sets the schedule and states the part that catches people off guard: Microsoft will not automatically migrate Restricted SharePoint Search configurations to Restricted Content Discovery. The audit, the site identification, and the new configuration are work the institution has to do.

For most institutions outside financial services, this is a housekeeping item. For a regulated institution that turned on Restricted SharePoint Search specifically to keep an unremediated tenant from broadcasting member account numbers and loan files to a Copilot prompt, it is a deadline with teeth.

The Retirement Timeline You Cannot Miss

Microsoft has laid out a staged retirement rather than a single cutoff, and each date matters for planning. The window to act is the second half of 2026. Mark these on the same calendar you use for examination prep and license renewals.

The Restricted SharePoint Search retirement schedule. The window to migrate to Restricted Content Discovery closes January 31, 2027.

The trap is the gap between feeling done and being done. The real work, auditing every site the allowed list was shielding and deciding what to do with each one, takes longer than flipping a switch, and the July 31 cutoff on new enablement means there is no fallback if you wait. Treat the retirement window as the time you have to finish, not the time you have to start.

What Restricted SharePoint Search Was Doing for You

To migrate well, you have to be honest about what the old control was and was not doing. Restricted SharePoint Search limited how SharePoint content appeared in Microsoft Search and Microsoft 365 Copilot during a permissions and governance review. It was a discovery control, never an access control, and that distinction is the one that trips institutions up.

Restricted SharePoint Search never changed a single permission. A site held back from Copilot was still fully openable by every person who had been granted access to it, through a direct link, a bookmark, or a saved search. The control kept content from surfacing in a Copilot answer or an organization-wide search result. It did nothing about the underlying oversharing. It was a curtain, not a wall, and Microsoft said as much every time it documented the feature.

Restricted Content Discovery Is Not a Drop-In Replacement

Restricted Content Discovery solves the same problem with a different shape, and the shape is the reason there is no automatic migration. Where Restricted SharePoint Search was tenant-wide and worked from an allow list, Restricted Content Discovery is a per-site setting you apply to specific sites you want to keep out of discovery. You are no longer drawing one curtain across the whole tenant and listing the exceptions; you are flagging the individual sites that should not surface.

The mechanics matter as much as the model. When you enable Restricted Content Discovery for a site, that site no longer surfaces in organization-wide search or in Microsoft 365 Copilot Business Chat, with one nuance: a user who had a recent interaction with the site may still see it. Like its predecessor, it changes discovery, not permissions, so anyone who already has access can still open the files directly. It cannot be applied to OneDrive, and changes propagate through the search index over time rather than instantly, so you plan for a lag. Microsoft documents the full behavior in its guidance on restricting discovery of SharePoint sites and content.

SharePoint Advanced Management is the prerequisite that matters, the management add-on that powers Restricted Content Discovery. Microsoft's documentation notes the control can be applied once at least one user in the organization is assigned a Microsoft 365 Copilot license, a bar institutions deploying Copilot already clear. Administrators can delegate Restricted Content Discovery management to site administrators, who must supply a justification when they apply it, and every change is recorded in the Microsoft 365 unified audit log. That audit trail is exactly the kind of evidence that makes the control defensible in an examination.

There is also a cost to overusing it: the more sites you wall off, the less content Copilot has to ground its answers on, and answer quality degrades. The goal is to restrict the genuinely sensitive sites and remediate the rest, which is the same data-classification discipline that drives data loss prevention for financial institutions.

The Exposure When the Guardrail Lapses

It helps to make the risk concrete, because "content may become discoverable" does not land until you picture it inside your own institution. Microsoft 365 Copilot only surfaces content the signed-in user can already open. The danger is not that Copilot breaks a rule. It is that an old oversharing problem, quietly contained by Restricted SharePoint Search, becomes a loud answer the moment the curtain lifts.

What separates those two institutions is not budget or appetite for AI. It is whether the migration was treated as a cleanup or a checkbox. An institution that does nothing inherits, on a specific date, every oversharing problem it had postponed.

The Migration Playbook for Banks, Credit Unions, and Mortgage Companies

Microsoft's own sequence is consistent across its oversharing guidance: discover what is overshared, contain the worst of it, remediate the access, then govern it going forward. Here is that path as a project a regulated institution can actually run inside the retirement window.

Start by confirming whether the control is even on, and if it is, what its allowed list contains. That allowed list, and the sites it implicitly excluded, is the scope of your migration. Do not assume you know what is on it from memory; pull the actual configuration before the cmdlets stop working.

Run the SharePoint Data Access Governance reports to produce a ranked list of the sites with the broadest access and the most live sharing links, then cross-reference that list against the Restricted SharePoint Search allowed list. The sites held back from discovery, especially the ones open to the whole organization, are where nonpublic personal information, board materials, and credit files are most likely sitting in the open. This is where you learn the real shape of your tenant. Our walkthrough of the Microsoft 365 Copilot readiness assessment covers how this discovery fits the larger readiness picture.

For the genuinely sensitive sites that should stay out of organization-wide search and Copilot, enable Restricted Content Discovery per site using Set-SPOSite -RestrictContentOrgWideSearch $true, with a justification recorded for each. This replaces the discovery protection the tenant-wide control was providing, but only where it is warranted. Resist the urge to wall off everything; over-restricting starves Copilot of the content that makes it useful.

This is the step that turns containment into a cure, and the one Restricted SharePoint Search was always buying time for. For each overshared site, remove the broad groups, kill the stale sharing links, and assign access to the people who genuinely need it. Apply Microsoft Purview sensitivity labels so that protection travels with the file, and put site access reviews in place so owners re-confirm membership on a schedule. Our walkthrough of Microsoft Purview DLP for AI and Copilot covers how those controls extend to AI specifically. A site whose permissions are correct does not need a discovery control at all.

Confirm that Restricted Content Discovery is applied where intended, that the unified audit log captured every change, and that the previously overshared sites now have correct access. Keep the artifacts: the ranked list of overshared sites, the record of what was restricted and why, and the labels applied. Then let Restricted SharePoint Search retire on schedule. The curtain comes down because the room behind it is finally in order.

Restricted SharePoint Search (retiring) versus Restricted Content Discovery (successor), with the five-step migration path for banks, credit unions, and mortgage companies.

Run those steps in order and the work stays bounded. Most of the effort lands in the discovery and the permission corrections, not in flipping controls.

This work lands differently for an institution with a managed Microsoft 365 partner. A lean credit union or mortgage company IT team is not going to track a Microsoft 365 admin center retirement notice, audit a SharePoint allowed list, and re-architect site-level discovery against a deadline on top of everything else they own. It is also where a license reseller and a specialized partner part ways: selling Copilot licenses ends the day they are provisioned, while managing the tenant they run in and absorbing changes like this retirement is the ongoing job. ABT manages Microsoft 365 tenants, including SharePoint, Microsoft Purview, and Microsoft Entra, for 750+ financial institutions through delegated administration. The audit, the per-site configuration, the labeling, and the access reviews are the work ABT already performs under the M365 Guardian operating model, which turns a one-time scramble into a standing capability.

Why This Doubles as an Access-Controls Health Check

There is a second payoff to this migration, and it is the one your examiner cares about. The cleanup you do to migrate off Restricted SharePoint Search safely is, nearly line for line, the access-controls evidence regulators already expect. The deadline simply gives you a reason to confirm a posture you should be able to demonstrate anyway.

Supervisory direction is consistent. The FTC Safeguards Rule, which governs nonbank financial institutions under the Gramm-Leach-Bliley Act, requires institutions to implement and periodically review access controls that limit access to customer information to the people who need it. The FFIEC's Information Security guidance presses the same least-privilege principle for banks, and the NCUA examines credit unions' access and authentication controls against that framework. That is exactly what a permissions remediation produces: a defensible answer to who can see customer data, and why.

Oversharing is the textbook weakness those expectations are written against, and a tenant that papered over it with a discovery control rather than fixing it is precisely the gap an examiner is trained to probe. The artifacts your migration generates, a ranked list of overshared sites, a record of what was restricted with Restricted Content Discovery, the sensitivity labels you applied, and the unified audit log of every change, are the kind of evidence that turns an examination question into a short conversation.

That is the reframe worth keeping. Migrating off Restricted SharePoint Search is not a side quest pulled away from compliance work. It is compliance work, with a safer Copilot deployment attached. You end up with a cleaner tenant, examiner-ready evidence, and an AI assistant that makes your team faster without making your members' or borrowers' data findable by the wrong person.

Frequently Asked Questions