Restricted Content Discovery just got teeth in the places that matter most. Microsoft is extending it so files on RCD-enabled SharePoint sites stop appearing in both Copilot and Microsoft 365 search, even files a user recently viewed, edited, or shared (MC1427972). No new policy to configure, existing RCD settings simply start covering more ground.
For anyone who has already turned on Restricted Content Discovery to reduce oversharing risk, this closes a gap that mattered more every month Copilot adoption grew. This post covers what it now blocks, why the AI search gap was worth closing, how the rollout works, and the Paul-Take on what changes for your governance story.
What Restricted Content Discovery Now Blocks
This capability already limited where protected sites showed up in classic search results. This update pushes that protection into the AI layer, specifically Copilot and Microsoft 365 search, so the same sites get the same treatment everywhere users go looking for content.
What changes with this update
- Files on RCD-enabled sites stop appearing in Copilot and Microsoft 365 search results
- Recently accessed activity, viewing, editing, or sharing a file, no longer creates a discovery path around the policy
- AI entry points disappear from RCD-enabled sites, including the Copilot button, AI menus, and Create pages with AI
- This matches the behavior Create an agent already followed, so the policy is now consistent across AI surfaces
What stays the same
- Existing Restricted Content Discovery policies apply automatically, nothing to reconfigure
- The change only affects sites where RCD is already enabled, unrestricted sites see no difference
- No new admin center setting appears anywhere, this rides on policy you already set
Why Restricted Content Discovery Needed This Fix
The original gap was straightforward once you noticed it. A site could be locked down under Restricted Content Discovery for classic search purposes, and a user who had recently opened a file on that site could still surface it through Copilot, because Copilot’s “recent activity” signal did not check RCD status the same way search did. That is exactly the kind of quiet inconsistency that undermines an otherwise solid governance control.
AI made the gap actually matter
This capability existed well before Copilot did, built for a world where search was the only real discovery surface to worry about. Once Copilot started drawing on recent activity and grounding chat responses in files a user had touched, the same governance intent needed to apply there too. This update is Microsoft closing that gap directly rather than leaving admins to work around it. It fits the same pattern behind restricted content discovery delegation, giving admins finer control over exactly where and how RCD protection gets applied, rather than treating it as one blunt toggle.
Consistency across every AI entry point
Removing the Copilot button, AI menus, and Create pages with AI from RCD-enabled sites means users are not left wondering why a search result disappeared but the entry point to ask an AI about it was still sitting right there. Consistent absence is easier to explain to end users than a policy that half-applies depending on which surface they used. This kind of consistency work is the same instinct behind enterprise data protection commitments Microsoft has been building into Copilot broadly, treat every AI surface the same way you would treat search.
How the Restricted Content Discovery Rollout Works
Rollout timeline
| Stage | Window |
|---|---|
| General Availability (Worldwide, GCC High, DoD) | Begins late July 2026, expected to complete by late July 2026 |
| Admin action required | None immediate, policy review recommended |
What to do now
- Review your current Restricted Content Discovery policies before the rollout completes in late July
- Identify which sites have RCD enabled and confirm that is still the right set of sites
- Inform helpdesk teams that users on RCD-enabled sites will notice missing Copilot entry points and missing search results
- Update internal documentation describing what RCD does, since its scope just expanded meaningfully
- Consider whether other oversharing-prone sites should be moved under RCD now that it covers Copilot too, similar to the thinking behind adaptive scopes for SharePoint DLP
Admin Tips
- Treat this as a policy audit trigger, not a new configuration task, existing RCD settings just got stronger for free
- Brief content owners on RCD-enabled sites before users start asking why Copilot cannot see certain files
- Pair this review with your existing oversharing assessment, RCD now closes a loop that Copilot adoption had opened
License requirements
This capability requires no new license for this update. It applies to SharePoint sites already governed by RCD policy, part of standard SharePoint and Microsoft 365 Copilot licensing. Available across Worldwide, GCC High, and DoD environments with this rollout.
The Paul-Take on Restricted Content Discovery
Honest opinion. This is the kind of update that should have shipped alongside Copilot’s earliest rollout, not two years into broad adoption. Restricted Content Discovery locking down search while leaving a side door open through recent activity in Copilot was never a deliberate design choice, it was a gap that nobody had gotten around to closing until AI made ignoring it more expensive.
What I like is that Microsoft did not ask admins to redo anything. If you already invested time setting up this policy correctly, that investment just got more valuable without a single configuration change on your end. If you have not looked at RCD policy in a while, this is the moment, the sites you protected for search reasons are now protected for Copilot reasons too, and that is worth confirming still matches your actual risk picture.
My advice, do not treat this as a “nothing to do” item just because the action required section says so. Pull up your RCD-enabled site list this week and ask whether it is still the right list. Oversharing risk does not stay static, and a policy this useful deserves a periodic check rather than a one-time setup.
This should be rolling out worldwide, GCC High, and DoD from late July 2026 according to Microsoft.
Quick checklist for the Restricted Content Discovery rollout
- Reviewed current RCD-enabled site list before late July 2026
- Confirmed the site list still matches current oversharing risk
- Briefed helpdesk on missing Copilot entry points and search results for RCD sites
- Updated internal documentation to reflect the expanded RCD scope
- Evaluated additional sites for RCD given the new AI-layer coverage
Related Resources
This feature fits inside the wider SharePoint and Copilot governance picture. Pair this post with the rest:
Microsoft official references:
- Restrict discovery of SharePoint sites and content
- Enterprise data protection in Microsoft 365 Copilot
MVP Reference List
- Message Center: MC1427972
- Rollout: GA Worldwide, GCC High, DoD, late July 2026
- Microsoft Learn, Restricted Content Discovery: restricted-content-discovery
- Microsoft Learn, enterprise data protection: enterprise-data-protection