Copilot oversharing is a permissions problem, not an AI problem. Microsoft 365 Copilot returns nothing a user could not already open. It simply makes years of accumulated over-permissioning findable in one sentence, at the speed of a chat prompt. The obvious response, switch on Restricted Content Discovery and move on, fails quietly, because that control hides content from discovery without changing who can reach it. What follows is what each of the available controls actually does, what it leaves untouched, and where the licence line falls.
If you are earlier in the rollout than this, the wider sequencing question is covered in rolling out enterprise Copilot without breaking your DLP posture, which is the piece this one sits underneath. This post is only about exposure through search and grounding.
Why copilot oversharing happens
Microsoft states the boundary plainly in its architecture documentation: Copilot can only summarise or reference content that the user is authorised to access. That sentence is doing a lot of work, and it is where most of the panic comes from. Authorised is not the same as intended. A finance workbook shared with Everyone except external users in 2019 is authorised content for all 4,000 people in the tenant. Nobody found it, because nobody searched for it, and the site was three clicks off anybody’s path.
Copilot removes the practical obscurity that was doing the security work. The permission was always wrong. The retrieval was the only thing protecting you.
Three patterns produce almost all copilot oversharing, and all three predate the AI entirely:
- Everyone except external users applied at site or library level, usually to make a one-off share stop generating support tickets.
- Broken permission inheritance on a subsite or library, where the exception outlived the reason for it.
- Organisation-wide sharing links, which behave as a permanent grant to anyone signed in who ever receives the URL.
If the underlying model is not familiar, the SharePoint permissions model is worth reading before you touch any of the controls below, because every one of them is layered on top of it rather than replacing it.
The controls, and what each one actually does
Four things get recommended interchangeably in vendor blog posts. They are not interchangeable. Two of them hide content, one of them scopes retrieval, and one of them actually changes access.
| Control | What it changes | What it does not change | Scope |
|---|---|---|---|
| Restricted Content Discovery (RCD) | Removes site content from organisation-wide search and Copilot responses, and strips AI entry points from the site | Permissions, direct access, the search index, Purview eDiscovery and auto-labelling | Per SharePoint site |
| Restricted SharePoint Search (RSS) | Limits Copilot and organisation-wide search to an allowed list of sites, plus what each user already touches | Permissions. Explicitly a short-term measure | Tenant, maximum 100 sites on the list |
| Restricted Access Control (RAC) | Actually blocks access to a site for anyone outside a named group, regardless of item permissions | Nothing about search behaviour on unrestricted sites | Per site |
| Sensitivity labels with encryption | Requires EXTRACT and VIEW usage rights before Copilot can interact with the content | Discovery of the file’s existence, or anything unlabelled | Per item, follows the file |
The distinction in the second column is the whole article. RCD and RSS reduce what Copilot can surface. Only RAC and label encryption change what a person can obtain once they know where to look.
Restricted Content Discovery, as it stands in August 2026
The Restricted Content Discovery documentation, updated 18 August 2026, is unusually candid about its own scope. It calls RCD a temporary governance control, and it says two things that most third-party summaries leave out:
Restricted Content Discovery doesn’t change existing permissions. Users who already have access to content can continue to access that content directly.
Restricted Content Discovery doesn’t remove content from the Microsoft 365 search index.
Read together, those mean RCD is a visibility control, not a containment control. It removes the site from SharePoint home, Office.com, Bing and Copilot responses, and it takes away the Copilot button, the AI actions menus and Create pages with AI on the site itself. A user who has the URL, or a favourite, or an email from 2022, walks straight in.
It is applied per site, either from the SharePoint admin centre under Sites, Active sites, the site, Settings, or from PowerShell.
# Set, check and delegate Restricted Content Discovery. SharePoint Online Management Shell.
Set-SPOSite -Identity https://contoso.sharepoint.com/sites/Finance -RestrictContentOrgWideSearch $true
Get-SPOSite -Identity https://contoso.sharepoint.com/sites/Finance | Select-Object RestrictContentOrgWideSearch
# Let site admins turn RCD on themselves, tenant wide.
Set-SPOTenant -DelegateRestrictedContentDiscoverabilityManagement $true
Two operational details decide whether this works on the day you need it. RCD applies to SharePoint sites only and is not supported for OneDrive, which matters because OneDrive is where a large share of real oversharing lives. And propagation is not instant: Microsoft’s own guidance is that for sites with more than 500,000 items, an update can take more than a week to be fully reflected in search and Copilot. I have not run RCD against a site of that size, so I am reporting the documented figure rather than a measured one. Plan the change window against the documentation, not against how quickly the toggle flips in the portal.
Restricted SharePoint Search is a holding pattern
RSS is the blunter instrument: an allowed list, and everything else drops out of organisation-wide search and Copilot grounding for everyone except the people already touching it. Microsoft caps the list at 100 sites, with hub subsites riding along without counting, and the allowed list documentation is direct about the intent:
It’s designed as a short-term solution to allow time for your organization’s administrators to thoroughly review and audit site and file permissions, but it’s not intended or scalable for long-term use.
That is a fair description of what it costs you. Turn RSS on and Copilot gets materially less useful across the estate, which is the outcome the licence was bought to avoid. It buys time. It is not a posture.
Find the exposure before you restrict anything
Restricting sites you have not measured is how organisations end up with 300 restricted sites and a Copilot deployment nobody trusts. Two first-party assessments exist, and they answer different questions.
The Content Management Assessment in the SharePoint admin centre, under Advanced Management, runs across all sites in the organisation and returns five reports: inactive sites at 180 days, ownerless or single-owner sites, broken inheritance, unrestricted internal sharing through Everyone except external users, and unrestricted sharing links. Microsoft’s documentation, last updated 12 May 2026, says the run takes between 2 and 72 hours depending on tenant size and recommends rerunning it every 30 days. That is the report that tells you which sites are the problem.
Purview’s data risk assessments answer the narrower question of which sensitive data is exposed. Per Microsoft’s Prevent oversharing with data risk assessments documentation, updated 1 May 2026, a default assessment runs weekly across the top 100 SharePoint sites by usage, with a 4 day delay before the first results appear. The limits are the part to read carefully: item-level scanning currently covers a maximum of 10 SharePoint sites and 200,000 items per location, and OneDrive is not supported for item-level scanning at all.
Ten sites is not an estate. Treat DSPM as a sampling tool that proves the problem exists and gives you something concrete to show a steering group, and treat the Content Management Assessment as the actual inventory.
What the licence actually buys
This is the detail that most posts on this subject get wrong, because it changed. SharePoint Advanced Management used to be a paid add-on, and a lot of published advice still assumes that. Per the SharePoint Advanced Management features in Microsoft 365 Copilot licenses page, updated 18 August 2026, assigning at least one Microsoft Copilot licence in the tenant gives SharePoint administrators access to the Advanced Management feature set. That includes the whole oversharing control group: Content Management Assessment, Restricted Content Discovery, Restricted Access Control, block download policy, EEEU insights, permission state reports and site access reviews.
Two carve-outs survive. Sensitivity labels in that feature list still require E5 or G5, and restricted site creation by apps still needs the SharePoint Advanced Management Plan 1 add-on. Advanced tenant renaming is also excluded, and is unavailable in GCC, GCC High and DoD.
The practical consequence: if your organisation has bought even a single Copilot licence, the assessment tooling is already sitting in your admin centre unused. Check before you buy anything, and before you take a vendor’s word that you need a third-party scanner. On the Copilot side, the sequencing of licence assignment and tenant preparation is covered in the deployment guide for Microsoft 365 Copilot.
The failure modes
These are the ones that produce a ticket rather than an error message, which is what makes them expensive.
RCD is enabled and the file still appears in Copilot. Almost always because the user has direct access, or has interacted with the file recently in a context RCD does not cover. RCD does not affect searches originating from site context, and it does not touch the Microsoft 365 Feed or Recommendations. Nothing is broken. The control is behaving as documented, and the documentation is the thing that was misread.
RCD is enabled and nothing changes for a week. Propagation across indexing systems is size dependent. On a large site this is the expected behaviour, not a failed change. Verify with Get-SPOSite that the property is actually set before escalating anything.
The OneDrive gap. RCD does not support OneDrive, and DSPM item-level scanning does not cover it either. Personal sites holding shared organisational content are outside both controls. If your estate grew through people saving working files to OneDrive and sharing links from there, the two headline controls do not reach the problem at all.
Sensitivity labels applied but Copilot still summarises the file. A label without encryption classifies and marks, and changes nothing about retrieval. Where encryption is applied, the user needs EXTRACT and VIEW usage rights for Copilot to interact with the content. Labelling projects that stopped at classification have not restricted anything.
The assessment ran and returned very little. Check when. The first DSPM default assessment has a 4 day delay before results display, and Microsoft advises waiting at least 48 hours after a custom assessment run. An empty dashboard on day one is a timing artefact.
What I would do differently
Every one of these copilot oversharing controls is described by Microsoft, in its own words, as temporary or short-term. That should shape the plan. The controls exist to buy a permissions remediation programme enough runway to finish, and the failure I would expect to be most common is the one where the toggle becomes the answer and the remediation never starts.
The order I would work in: run the Content Management Assessment first and get the EEEU and sharing-link numbers on paper, because they are the argument that funds everything after. Apply RCD narrowly, to the handful of sites that are genuinely sensitive and genuinely mis-permissioned, and apply it before the Copilot pilot widens rather than after somebody finds the salary file. Reach for Restricted SharePoint Search only if the assessment comes back so bad that a tenant-wide handbrake is proportionate, and treat the day you turn it on as the day a remediation deadline starts.
And keep the labelling work in a separate stream. Encryption is the only control here that follows the file out of SharePoint, which makes it the durable one, but it turns a search-visibility project into an access project with a much larger blast radius. The prompt-level behaviour that goes with it is covered in prompt patterns that respect Purview, and the retrieval path itself in the technical architecture of Microsoft 365 Copilot Chat.
None of this is a Copilot problem. It is a permissions bill that arrived with an AI logo on the envelope.
Last verified: 22 August 2026.
