Restricted Access Control in SharePoint: Definition and Use
Restricted Access Control, or RAC, is a SharePoint Advanced Management policy that limits access to a SharePoint or OneDrive site to members of specified Microsoft 365 groups or Microsoft Entra security groups. Users outside the configured groups are blocked even if they previously had site permission or received a shared link.
What Restricted Access Control Means in SharePoint
RAC adds a group-based access condition over the site's normal permission model. A user must satisfy both layers: the user needs a SharePoint permission path and must also belong to an allowed group in the restricted-access policy. This makes RAC useful when administrators need a firm membership boundary around highly sensitive sites without rebuilding every individual permission scope first.
The policy can be used on Microsoft 365 group-connected, Teams-connected, and nongroup-connected sites according to Microsoft's current guidance. Administrators can also configure whether sharing is allowed outside the restricted groups. RAC should be planned carefully because existing links, direct permissions, service accounts, applications, and operational workflows may behave differently once the additional access condition is enforced.
Why It Matters to the Business
For a business leader, RAC can turn a policy such as 'only the transaction team may enter this deal room' into an enforceable SharePoint control. It is suited to high-impact boundaries involving legal matters, financial transactions, regulated projects, research, executive work, or partner collaboration where ordinary ad hoc sharing is too permissive.
The control should not be applied merely because a site contains confidential information. Broad use can interrupt valid work and increase support demand. The organization first needs an authoritative membership source, a process for adding and removing people, a documented exception path, and an owner who can confirm that the restricted group still represents the intended audience.
What SharePoint Administrators Need to Know
Before enabling RAC, inventory how access is granted today. Review Microsoft 365 Group membership, SharePoint groups, direct permissions, external guests, sharing links, app-only access, automation accounts, and Teams dependencies. Test the policy on a representative site and user group, including users who should be allowed, users who should be denied, and noninteractive processes that must continue to operate.
RAC does not simplify the underlying permissions automatically. A user can remain listed in a SharePoint group yet be denied by the restricted-access policy, which can confuse site owners unless support documentation explains the two-layer model. Administrators should monitor denied-access events, maintain a clear help link, periodically review the allowed groups, and remove obsolete direct permissions when appropriate.
What to Consider
Use authoritative groups
Select Microsoft 365 or Entra security groups with controlled membership, named owners, and a reliable joiner-mover-leaver process.
Test connected services
Validate Teams, Power Automate, apps, sync, external collaboration, and other dependencies before applying the policy to a production site.
Explain layered denial
Document that a SharePoint permission or old link is insufficient when the user is not in an allowed RAC group.
Practical Takeaway
RAC is a true access restriction, so success depends as much on accurate group membership and support processes as on the policy setting itself.
How This Shows Up in the Field
Confidential project site
A merger team stores diligence files in SharePoint. RAC limits entry to an Entra security group managed by the transaction owner, while the normal site permissions define what members can edit or read.
Access cleanup
An administrator applies RAC to a sensitive research site after testing, then reviews old direct permissions and sharing links so the visible SharePoint configuration matches the enforced membership boundary.
Restricted Access Control versus Restricted Content Discovery
| Restricted Access Control | Blocks site and content access for users outside designated groups, even when another permission or link exists. |
|---|---|
| Restricted Content Discovery | Limits organization-wide search and Copilot discovery but does not change site permissions or block direct access for authorized users. |
Related 6SC Services and Proof
Related SharePoint Glossary Terms
Frequently Asked Questions
Does Restricted Access Control replace SharePoint permissions?
No. RAC adds an additional group-membership requirement. A user still needs ordinary SharePoint access, and the user must also belong to a group allowed by the RAC policy. Both conditions matter.
Can a shared link bypass RAC?
Microsoft describes RAC as blocking users outside the designated groups even when they had prior permission or a shared link. Administrators should still review sharing configuration and test each link type and collaboration scenario used by the site.
Is RAC the right tool for hiding a site from Copilot?
Use RAC when the requirement is to block access based on group membership. If authorized users should retain access but the site should be selectively excluded from organization-wide search and Copilot discovery during remediation, Restricted Content Discovery addresses that different need.
Official Microsoft References
- Restrict SharePoint site access with Microsoft 365 and Entra groups
- SharePoint Advanced Management overview
- Restrict discovery of SharePoint sites and content
Editorial review date: July 13, 2026. Product status and licensing can change; confirm current Microsoft documentation before implementation.
Build a restricted-access model people can operate
6SC can assess permissions, design groups, test workloads, and introduce RAC with clear governance.
Talk with 6SC