Restricted Content Discovery in SharePoint: RCD Guide
Restricted Content Discovery, or RCD, is a site-level SharePoint control that limits content from selected sites in organization-wide search and Microsoft 365 Copilot discovery experiences. It does not change the site's permissions: authorized users can still open content directly or find it through supported site-context experiences, subject to their existing access.
What Restricted Content Discovery Means in SharePoint
RCD is designed for selective, high-risk sites whose permissions or sharing posture need review. When enabled, the site's content is suppressed from broad discovery surfaces such as organization-wide SharePoint search and applicable Copilot experiences. Microsoft documents exceptions for content a person owns or recently interacted with, so RCD should not be described as complete concealment or as a security boundary.
Because permissions remain unchanged, RCD gives administrators time to investigate and remediate oversharing without immediately preventing authorized work. A person who already has access may still open the site through a direct link, navigate within the site, or use site-context search. The lasting fix is an accurate permission model; RCD is a risk-reduction control around discoverability while that work proceeds.
Why It Matters to the Business
For business stakeholders, the distinction between discovery and access is crucial. RCD can reduce the chance that broadly accessible content unexpectedly appears in an organization-wide search result or AI response, but it does not revoke the broad access that created the concern. Leaders should treat the setting as part of a remediation plan, not as proof that the information is secured.
Selective use can protect confidence in a Copilot rollout while owners review sensitive or poorly governed sites. Overuse creates a different problem: search and Copilot have less relevant information available, which can lead to incomplete answers and weaker findability. Each restricted site therefore needs an owner, a documented reason, a remediation deadline, and criteria for removing the restriction.
What SharePoint Administrators Need to Know
Administrators should identify candidates through data access governance reports, the SharePoint admin center, security reviews, or a documented Copilot-readiness assessment. Apply RCD to a limited set of sites, account for indexing latency, and verify behavior in tenant-wide search, Copilot, direct navigation, and site-context search. Large sites or a high volume of simultaneous changes can take longer to reflect in discovery experiences.
RCD does not remove content from the search index and does not stop Microsoft Purview capabilities such as eDiscovery or auto-labeling. It also does not apply to OneDrive sites in Microsoft's current guidance. Maintain an inventory of restricted sites, monitor audit events, review whether each site's permissions have been corrected, and remove RCD after the original risk is addressed.
What to Consider
Use RCD selectively
Target documented high-risk sites rather than suppressing large portions of the tenant and weakening search or Copilot quality.
Remediate permissions
Review broad groups, sharing links, direct grants, external guests, and inheritance because RCD does not revoke any of them.
Plan for index latency
Allow time for the site-level setting to propagate and verify results before announcing that discovery behavior has changed.
Practical Takeaway
RCD reduces broad discovery while permissions are repaired; it should never be mistaken for the repair itself.
How This Shows Up in the Field
Pre-Copilot remediation
An assessment finds a legacy executive site with overly broad membership. IT enables RCD, assigns an owner to review access, removes unnecessary grants, tests Copilot behavior, and then removes the discovery restriction.
Search-quality review
A tenant has accumulated many RCD sites. Administrators review the inventory with business owners, retire restrictions whose access issues are resolved, and restore useful content to organization-wide discovery.
Discovery restriction is not access restriction
| Restricted Content Discovery | Limits selected site content in organization-wide search and Copilot discovery while leaving permissions intact. |
|---|---|
| Restricted Access Control | Blocks users outside specified groups from accessing the site or content even when another permission path exists. |
Related 6SC Services and Proof
Related SharePoint Glossary Terms
Frequently Asked Questions
Does Restricted Content Discovery remove a user's access?
No. Microsoft explicitly states that RCD does not affect existing permissions. A user who has access can still open the site or file directly and may find it through site-context experiences. Correct the underlying permissions separately.
Will RCD completely hide every file from Copilot?
No absolute concealment should be promised. Microsoft documents exceptions for content a user owns or recently interacted with, and RCD is focused on organization-wide discovery. Test the actual user scenarios and use access controls when access itself must be blocked.
What is the difference between RCD and Restricted SharePoint Search?
RCD is applied to selected sites to suppress their broad discovery. Restricted SharePoint Search is a tenant-level, temporary allowed-list approach. Neither is a replacement for accurate permissions or a complete data-security program.
Official Microsoft References
- Restrict discovery of SharePoint sites and content
- Restricted SharePoint Search
- SharePoint Advanced Management overview
Editorial review date: July 13, 2026. Product status and licensing can change; confirm current Microsoft documentation before implementation.
Reduce discovery risk without losing sight of access
6SC can help identify overshared sites, apply selective controls, remediate permissions, and build a review path that restores useful content to search and Copilot.
Talk with 6SC