Copilot answers from the content each user can already open. Before it reaches everyone, check who can open what: Anyone links, Everyone except external users, broken inheritance, sites without owners and sites without a sensitivity label.
Restricted Content Discovery hides sites from Copilot while you review them. It does not change who has access, and Restricted SharePoint Search, the older control, is retiring.
Microsoft 365 Copilot respects existing permissions. Microsoft's site permissions report documentation says so, and adds that sites where many users can open content carry a higher risk of unintended exposure through Copilot. Readiness comes down to one question: are your SharePoint permissions as narrow as you think?
According to Microsoft Learn, general availability of Copilot in SharePoint began rolling out on September 30, 2026. The preview PowerShell settings that turned it on or off for selected sites are honoured until November 1, 2026. After that date, Microsoft says to manage availability with Site AI settings and Restricted Content Discovery.
Sources: the Microsoft Learn pages linked on this page, consulted October 22, 2026. Microsoft updates these pages, so check the current version before you plan.
Anyone links. Links that open a file for anyone who has them. The site permissions report counts them per site, and the sharing links report shows where people created the most in the last 28 days.
Everyone except external users. Content shared with every internal account. The site permissions report counts these permissions, and a separate activity report lists the sites where it happened in the last 28 days.
Broken inheritance. Items with unique permissions that override the site's settings. The site permissions report counts them per site, and the content management assessment includes a broken inheritance report.
Sites without owners. The site ownership report in the content management assessment finds sites with no owner or only one. Each site needs someone accountable for reviewing its access.
Missing sensitivity labels. The site permissions report shows each site's sensitivity label, and the sensitivity label for files report shows where labelled files sit. Confidential sites with no label stand out.
Everyone and guest permissions. Content shared with all users including guests, and access granted to guest accounts. The site permissions report counts both.
A site-level setting that keeps a site's content out of organization-wide search and Copilot responses, and removes the Copilot button and AI actions from that site. Microsoft Learn calls it a temporary governance control. Permissions stay the same, people with access can still open the content directly, and the content stays in the search index. On sites with more than 500,000 items, a change can take more than a week to apply.
Microsoft Learn states that Restricted SharePoint Search is retiring and that new enablement is blocked starting July 31, 2026. It was an allow list of up to 100 sites. Microsoft states it is not a security boundary and does not change permissions. Even when it is on, users still see files they own, recently opened or had shared with them.
During the preview, admins used the KnowledgeAgentScope settings in PowerShell to turn Copilot in SharePoint on or off for selected sites. Microsoft Learn states these settings are honoured until November 1, 2026. If your tenant relies on them, move those sites to Site AI settings or Restricted Content Discovery before that date, and fix the access behind them.
Whether search results and AI answers respect who can open each document.
What must be fixed before Copilot or a custom assistant uses your content.
Duplicate, outdated and orphaned content that pollutes results and AI answers.
SharePoint, ServiceNow, file shares and CMS content: what is indexed, what is missing and how fresh it is.
Top queries, zero-result searches and abandoned searches, in French and English.
Native Microsoft search, Coveo or another platform, with a 3-year cost view and the order of work.
Yes. Copilot respects existing permissions, so it only uses content the user can already open. The risk is permissions that are broader than intended, such as Anyone links, Everyone except external users or broken inheritance. Our guide on making Copilot respect your access controls covers the steps.
No. It hides a site's content from organization-wide search and Copilot responses, but Microsoft states it does not change existing permissions. People who already have access can still open the content directly. Use it to buy time while site owners narrow access.
Microsoft is retiring it. New enablement is blocked starting July 31, 2026, and Microsoft points customers to Restricted Content Discovery. If you still use it, plan the permission review it was meant to buy time for.
According to Microsoft Learn, the preview PowerShell settings that turned Copilot in SharePoint on or off for selected sites (KnowledgeAgentScope and related settings) are honoured only until November 1, 2026. After that date, availability is managed with Site AI settings and Restricted Content Discovery.
Sengo works on intranet search across SharePoint, ServiceNow and CMS content, and our team includes former Coveo team members. Our smart intranet work starts by mapping each system's permission model, so AI answers show each person only what they can open. The free intranet search assessment is the first step.
Pilots usually stall on document permissions: either the index checks permissions too late, or identities and groups do not resolve between Entra ID, the AI platform and SharePoint. Our guide on why enterprise AI pilots stall on document permissions explains the fixes. The intranet search assessment reviews permissions, connectors and AI assistant readiness, and you can act on the report in-house, with your current partner or with Sengo.
