SharePoint deadline

Restricted SharePoint Search retirement: what resurfaces on January 31, 2027

By the MMM team — November 5, 2026

The Restricted SharePoint Search retirement removes the tenant-wide allow list that some organizations switched on as a stopgap before giving people Microsoft 365 Copilot. Microsoft’s message center post MC1395311 says Restricted SharePoint Search (RSS) is fully retired on January 31, 2027, with no extensions, and that its PowerShell cmdlets stop working on February 28, 2027. Microsoft will not carry your allow list over to anything else. Every site you kept out of organization-wide search and Copilot simply by leaving it off the list becomes discoverable again to everyone who already has permission to open it. This guide shows how to tell whether that applies to you, what replaces RSS, and how to move the sites that should stay hidden before the date arrives.

It is written for tenants that already run RSS and now face a dated switch-off. If you are still preparing a first Copilot rollout, our checklist of Copilot data governance essentials covers the full set of controls to put in place before enablement, of which restricting discovery is only one. Every Microsoft rule below was checked against Microsoft’s documentation on November 5, 2026.

What is retiring, and on which dates?

Restricted SharePoint Search, the tenant-wide allow list that limits which SharePoint sites organization-wide search and Copilot can draw on, is being retired in stages. New enablement was blocked on July 31, 2026. The feature is fully retired on January 31, 2027, with no extensions, and its PowerShell cmdlets stop working on February 28, 2027.

Microsoft’s Restricted SharePoint Search documentation (opens in new tab) now opens with the retirement notice and has always described the feature as a short-term measure, meant to give admins time to review site and file permissions rather than to stay switched on for good.

What becomes discoverable again when the allow list goes away?

Any site that was left off your allow list. While RSS is on, organization-wide search and Copilot only draw on up to 100 listed sites, plus content each user owns, visited, or had shared with them. After retirement, results fall back to plain permissions, so an overshared site nobody listed can surface for everyone who can open it.

That is the usual reason for turning RSS on in the first place. Microsoft’s own example is a budgeting site that nobody had reviewed, open to more people than it should have been, until Copilot started answering questions from it. RSS never fixed the permissions on a site like that; it only kept the site out of tenant-wide results. Microsoft is explicit that RSS is not a security boundary and does not change permissions, so whatever was overshared when you switched it on is still overshared today unless someone has cleaned it up since.

The change is also wider than Copilot. RSS limits organization-wide search for every user, including people with no Copilot license, so when it goes, ordinary SharePoint and Microsoft 365 search results get broader too. Sites on the allow list are unaffected: they were already discoverable.

How do you check whether your tenant still uses it?

Run Get-SPOTenantRestrictedSearchMode in the SharePoint Online Management Shell as a SharePoint Administrator. It returns Enabled or Disabled. If it says Enabled, run Get-SPOTenantRestrictedSearchAllowedList and save the output: that list of up to 100 sites, and any hub sites on it, is your record of what the tenant was hiding by omission.

Hub sites need a second look. A hub on the allow list counts as one of the 100, but its associated sites are covered too, so the real list of discoverable sites is longer than the export suggests. Because the cmdlets stop working on February 28, 2027, and the allow list stops mattering on January 31, export it now rather than when the date is close.

What replaces Restricted SharePoint Search?

Microsoft points tenants to Restricted Content Discovery, a per-site setting in SharePoint Advanced Management that keeps a site’s content out of organization-wide search and Copilot responses without changing permissions. It works the other way round from RSS: instead of listing the sites that may appear, you flag the specific sites that should stay hidden.

Microsoft’s guide to restricting discovery of SharePoint sites and content (opens in new tab) lists the prerequisites: a Microsoft Copilot license and SharePoint Advanced Management. It does not apply to OneDrive. For a tenant without them, the per-site Allow this site to appear in Search results setting is the blunter alternative, and Microsoft notes it hides the site from site-level search as well.

How do you move from the allow list to Restricted Content Discovery?

Invert the list. Export the RSS allow list, compare it with every active site, and treat each site that was not on it as a candidate. Apply Restricted Content Discovery to the ones holding sensitive or overshared content, check them, and only then disable RSS. Allow time: large sites can take over a week to update.

1. Export both lists. Save the output of Get-SPOTenantRestrictedSearchAllowedList, and export Active sites from the SharePoint admin center.
2. Find the sites hidden by omission. Everything on Active sites that is not on the allow list, and not associated with a listed hub, has been out of tenant-wide results until now.
3. Rank them by risk. Microsoft suggests Data Access Governance reports and the content management assessment to find broadly shared sites. Finance, HR, legal and leadership sites usually come first.
4. Apply Restricted Content Discovery to the sites that should stay hidden. In the SharePoint admin center, open the site under Active sites, go to Settings and turn on Restrict content from Microsoft Copilot, or run Set-SPOSite -Identity <site-url> -RestrictContentOrgWideSearch $true. Start with the largest sites: Microsoft says a site with more than 500,000 items can take more than a week to process.
5. Verify. Check single sites with Get-SPOSite -Identity <site-url> | Select RestrictContentOrgWideSearch, and run Start-SPORestrictedContentDiscoverabilityReport for a tenant-wide list.
6. Disable RSS and tell people. Run Set-SPOTenantRestrictedSearchMode -Mode Disabled, then let agent owners and the service desk know that search and Copilot results will widen, as Microsoft’s recommended process advises.
7. Retire the old scripts. Remove any automation that calls the RSS cmdlets before they stop working on February 28, 2027.

Disabling RSS yourself, once the replacement is in place, is the better order. Waiting for January 31 means the switch happens on Microsoft’s schedule, possibly while restricted sites are still propagating.

Is Restricted Content Discovery the end of the job?

No. Microsoft describes Restricted Content Discovery, like RSS before it, as a temporary control that buys time to review and right-size access. It hides a site from discovery but leaves every permission in place, so the overshared site is still overshared. The lasting fix is cleaning up who can open each site, then lifting the restriction.

That cleanup is site by site: broken inheritance, Everyone and company-wide groups, old sharing links, owners who left. It is the work our SharePoint permissions cleanup services do, and it is what lets you turn the restrictions off again with confidence. RSS is also not the only SharePoint default to disappear this year; the SharePoint Alerts retirement and the SharePoint one-time passcode retirement each changed something admins had relied on for years.

For the RSS retirement on its own, we also handle the narrower job as a fixed-fee project: export and compare the lists, rank the unlisted sites, apply and verify Restricted Content Discovery where it is needed, disable RSS and brief your teams. Like all our work, it is scoped and priced before anything starts, delivered by senior US-based Microsoft engineers, typically within 2–4 weeks, with 30 days of hypercare afterwards. We are based in Orange County, California, and work with businesses across the US remotely.