Delegate Restricted Content Discovery to SharePoint site admins

As posted, Microsoft plans to retire the PowerShell controls for Copilot in SharePoint in November 2026, previously known as SharePoint Knowledge Agent (or AI in SharePoint).

Microsoft recommends using Site AI settings and Restricted Content Discovery (RCD).

Restricted Content Discovery (RCD)

There are two notable points for RCD:

1. RCD is managed by a SharePoint administrator, by site collection. In the default configuration, a site collection admin cannot manage RCD for a site.
2. RCD not only restricts site content for Copilot results, but also restricts content for the org-wide search.

As Microsoft documents, RCD should be a temporary solution for oversharing issues. Site admins and owners should fix the oversharing situation so they can disable RCD later.

Organizations preparing for Microsoft Copilot often need time to review SharePoint sites, validate permissions, and implement governance controls before making content broadly discoverable. Restricted Content Discovery helps you limit discovery of content from specific SharePoint sites, including recently interacted files, in organization-wide search results and Microsoft Copilot responses while those reviews are taking place.

Restricted Content Discovery also removes AI-powered entry points from these SharePoint sites. Users don't see entry points such as the Copilot button, AI actions menus (including creating agents), or Create pages with AI. This restriction helps reduce the likelihood of accidental discovery of content while permissions and governance controls are being evaluated.

Restricted Content Discovery is designed as a temporary governance control that gives organizations time to review and right-size access while continuing their Copilot deployment.

Delegated Restricted Content Discovery (DRCD)

Meanwhile, Microsoft is also offering to delegate Restricted Content Discovery (DRCD). DRCD enables SharePoint admins to delegate the RCD setting (previously managed by SharePoint admins only) to all site collection admins.
Note: Site owners (users with Full Control permissions) can't access the RCD setting unless they are also site collection admins.

The DelegateRestrictedContentDiscoverabilityManagement property is a tenant-wide setting and is off by default. There is only one option: delegate it to all site admins or to nobody.

DelegateRestrictedContentDiscoverabilityManagement
Allows SharePoint administrators to delegate the management of Restricted content discoverability policy on sites to site admins and owners.

The valid values are:
- True - Allow site admins and owners to manage Restricted content discoverability policy
- False (default) - Do not allow site admins and owners to manage Restricted content discoverability policy

The site admin risk:
Site admins may not always understand what Restricted Content Discovery does or the full impact of enabling this setting on a site.
Someone who just wants to keep a daily lunch plan away from Copilot could make the whole site disappear from org-wide search results. Then the team can't find their content, and support tickets start: “I cannot find my important content from yesterday.”

 Set-SPOTenant -DelegateRestrictedContentDiscoverabilityManagement <$false | $true>

If delegation is enabled, site admins can find the option “Restrict content from M365 Copilot” in the site information to control RCD on their own.

An admin has to justify the setting.

The site content is now restricted from Copilot. Copilot leaves the site, and all previous Copilot entry points are removed.
Over the next few hours, the site content is also removed from the org-wide search results. Large sites can require extra processing time before changes are fully reflected. The content remains in the index and returns when users search on the site, but not in org-wide search or Copilot.

Purview Audit Logs

Microsoft Purview records the changes. Below is a KQL sample to find the changes in Sentinel logs.

OfficeActivity
| where TimeGenerated > ago(24h)
| where RecordType == "SharePoint"
| where Operation in ("RestrictContentOrgWideSearchEnabled", "RestrictContentOrgWideSearchDisabled", "SharePointRCDUpdateJustification")
| project TimeGenerated,RecordType,Operation,OfficeObjectId,UserId

Unfortunately, the Microsoft 365 connector for Sentinel does not forward the RCDJustification field, which contains the justification text entered by site admins. The Purview audit log does contain this information.

For comparison, here is the result when you collect the Purview audit log through Microsoft Graph.