SHAREPOINT - BLOCKING COPILOT STOPS GLOBAL SEARCH
- Jonathan Stuckey
- 5 hours ago
- 4 min read
Audience: Information Management Advisor, Operational Support, Solution Designers
Author: Jonathan Stuckey
With the shift from enterprise content management to AI-content platform, SharePoint has gained some ...interesting... support options to limit the immediate risk when deploying Copilot and Agents. One of those is to 'Restrict Content Discovery'.
So, why then is this not the global control the cautious organisations think it is?
Restrict Content Discovery
Restrict Content Discovery (RCD) feature is available in the SharePoint Admin Centre for organisations who have enabled SharePoint Advanced Management functionality. SAM features are typically made available as part of licensed add-on for Business or Enterprise licensed customers. More frequently organisations have accidentally inherited this when someone has purchased (or put on trial) a Microsoft 365 Copilot license on their tenancy.
RCD itself is a 'switch' on a SharePoint site, which removes the all the site's content from Copilot access and ingestion to your organisations grounding.
The control is accessible via the SharePoint Admin Centre. RCD is off by default, and you need to switch it on to block Copilot grounding.
Once you have done this the site, and associated content, is flagged as 'dirty' and will need to be reassessed by Copilot ingestion... Once it is re-checked, it is removed from the index of available content.
How does this impact Search?
If the RCD process sounds eerily similar to Search Indexing exclusion, its because it is.
The AI and ingestion process is based on the Search Index Processing service architecture. I.e. content is crawled, cracked-open, processed, indexed and made available by the request processing services. This is essentially how Enterprise Search ingestion works.
By enabling the RCD flag on a site it is dropping the whole site out of the available pool of data (index). The next effect is that site does not appear in organisation-wide search anymore - and therefore not in the Microsoft 365 Copilot experiences either ...unless a user recently interacted with the content. Or you are on the specific site/library to run local search.
Isn't that a good thing for managing AI Privacy concerns? Let's go org-wide!
Managing the scale of response
Don't get me wrong there are obvious cases where applying RCD is appropriate during early adoption of Copilot and AI e.g. limit visibility of PII or Sensitive data in Personnel Files or Contract sites etc, but at scale this poses a problem because you lose visibility of masses of content for Search results (and therefore the knowledge for LLM). That can impact across content solutions, repository roll-ups, custom Power platform apps, and user search which is index driven.
Applying RCD to SharePoint site is the information equivalent of blocking access to a whole street, to address a leaky bathroom-tap.
Scale that application up across your whole estate - now you risk crippling key apps and user experiences and suddenly your organisation loses confidence in whole M365 ECM platform.
When should you use Restricted Content Discovery
Practical examples and useful models are trickling in across industries and organisations of various sizes. RCD is a useful tool, but its only sticking-plaster while you fix the broader problems with your Information Governance health.
Implement a strong triage process based on: risk, privacy impact and breadth of use, when assessing which sites to apply it to. A good rule of thumb is this will be less than 5% of the total estate (based on broad averages and several large orgs I've delt with recently).
If from triage most of your sites are identified as requiring RCD I suggest you address your SP access and permissions before piloting Copilot and Agents.
Practical lessons learned
Use RCD sparingly over critical sites, during your initial AI and Copilot exploration.
Bring in more granular controls through permissions, and labelling.
Actively run monitoring and alerts across your AI and Copilot use.
Introduce rule-driven access using the Labels and metadata.
Invest the time in understanding the Data-loss Prevention controls being added.
DLP is nice-touch from Microsoft as they enable labelling to become the dynamic walls to information privacy and access challenges.
Preparation, preparation, preparation
The shift in the SharePoint platform to be an AI-Content platform mean you should check over your overall situation, identify your areas of risks and the big issues and then prioritise some basic clean-up prior to Copilot and Agent deployment.
Adoption of tools like RCD can be used sensibly, as intended, in correct context along with:
address the oversharing risks by clearing-out persistent sharing links
update permissions and access to address "everyone except external users"
run a clean-up of content in critical and authoritative sites
flag risky sites which need addressing for: structure, access and metadata - RCD
adjust site and library structure for consistency and usefulness on authoritative sites
apply labelling to highly curated content and to sensitive items
flag "authoritative" (curated) sites as high-priority content for Copilot / AI use
Clearing out old stuff keeps costs down; sorting out permissions reduces over-exposure, and labelling helps promote key information!
A Final Thought
Tools like RCD, Sensitivity labelling and DLP are good for long-term management and need to be planned for before use - but make sure you read the label before applying liberally.
E.g.: Restricted Content Discovery DOESN'T WORK on OneDrives
So, if you have Sharing link problem, or people hosting business content in their OD with external access or business critical to your organisation - you might want to sort that out first.
Resources
Disclaimer
Generative AI has been used for the creation of the article images, and QA review prior to publishing. No AI was used in the creation of the article copy. All content was created by the author, based on released information from Microsoft. Any errors or issues with the content in this article are entirely the author's responsibility.
About the author: Jonathan Stuckey
Comments