Gokan's Studio

A Microsoft MVP Perspective on Microsoft’s Restricted Content Discovery – The good, bad, and future –

1 –The phenomenon no one cared in enterprise (until Drew came to me with the question)

When Microsoft quietly announced that Restricted Content Discovery (RCD) would disable Copilot features in SharePoint,  I had the same reaction many of you probably will: wait, why?

The feature makes sense on the surface. Your organization has a highly sensitive site-maybe it’s due to diligence materials for an acquisition, healthcare data, or legal documents. You don’t want AI Solutions (like Copilot or agents) to crawl through that content, so you enable RCD. Problem solved, right?

Except it’s not. And that’s what I want to talk about today.

2 – What RCD actually does?

Let me be clear about the current behavior, because this matters:

When RCD is enabled on a SharePoint site, it prevents the site’s content from surfacing in org-wide search and M365 Copilot interactions, as expected. RCD is not a compliance or DLP control, and RCD does not impact existing Purview features. RCD also does not actually affect permissions on your site and was built to give companies time to clean up their permissions to a state that they trust. RCD should not always be used as a permanent solution in its current state.

When enabling RCD, though, the following AI features will also completely disappear:

• The Floating Action Button (FAB) — which typically offers summarization, autofill, and quick AI actions.
• The Create an Agent entry point.
• Copilot access from the SharePoint interface.
• AI-driven skills and content transformation features.

Justification? Microsoft’s product group explained it this way: RCD is meant to restrict AI access to content on highly confidential sites where organizations want to limit all AI capabilities. That sounds reasonable. But here’s the problem.

3 – The real issue: All-or-Nothing thinking

When you dig deeper, you realize RCD conflates two entirely different concepts:

• Discoverability — Whether AI systems can discover and access your site’s content
• Usability — Whether you, as a user, can use AI tools on content you’re directly working with

These are not the same things. They shouldn’t be treated the same way. Let me illustrate with a real-world scenario that you’re absolutely going to hear from your my businesses:

I don’t want Copilot or agents to access my sensitive compliance documents without my knowledge. But I still want to use AI to make my data more intelligent. I want to extract information from documents, summarize lengthy reports, or compare multiple contracts—all as deliberate, intentional operations under my control.

This is a legitimate question. It’s not “all or nothing.” It’s surgical precision.

4 – Where Microsoft got it right

To be fair, the product team isn’t completely off base. They’re addressing a real customer request:

• Some organizations genuinely want to lock down AI completely on sensitive sites
• The current behavior does prevent discovery of content through AI features
• Users can still access Copilot in the immersive file view (when working directly with documents)

The intent is solid. The execution is blunt, but that’s why we – as avid community warriors are here – and here’s what I believe needs to change.

4.1 – RCD should control discovery, not usage

RCD’s primary purpose should be to prevent AI systems from discovering and accessing your site without authorization. It should not prevent you from using AI tools on content you’re actively working with right in SharePoint.

Think of it like file permissions — RCD should be about who can access your data, not which tools you’re allowed to use on it.

4.2 – We Need Granular Controls

The SharePoint Admin Center should have separate toggles:

• RCD for Discovery: Prevents external AI systems from crawling/accessing your site (current behavior, but better named)
• “RCD” for Actions: Separately controls whether AI-driven features like Skills, summarization, and autofill are available (Similar behavior but a better name)
• Copilot in SharePoint Feature Toggle: A simple per-site switch to enable/disable Copilot and AI capabilities, independent of RCD 

This way, organizations can choose their own balance between security and productivity. This also should continue down the path of delegation to site owners, like RCD recently added, to allow the data owners themselves to decide what they want or do not want on their site.

4.3 – Communication Needs Work

The current admin center messaging only addresses discoverability. MVPs and leaders who communicate with customers need clarity on what’s happening under the hood. The “why” matters for customer conversations, and right now it’s murky. The communication in the Admin Center is unclear and poorly written, as it does not explicitly state that AI functionality will no longer be available in SharePoint.

The Learn documentation does include this caution, but it is not detailed enough for the impact:

5 – The bigger picture

This debate touches on something fundamental about how we’re implementing AI in enterprise environments: Are we building tools that serve users, or are we building restrictions that assume users can’t make smart decisions about their own data?

When your organization enables RCD to protect sensitive content, that’s a legitimate security choice. But that choice shouldn’t automatically prevent you from using AI as an intelligence and productivity layer on top of that same content.

The scenarios aren’t mutually exclusive:

• Scenario A: “I want to prevent external discovery.” ✓ RCD handles this
• Scenario B: “I want to prevent AI access entirely.” ✓ RCD could handle this with a separate toggle
• Scenario C: “I want to prevent AI solutions from discovering, but still use AI myself on my SharePoint sites.” ✗ Currently impossible

Right now, organizations choosing Scenario C are out of luck. They get Scenarios A and B whether they want them or not.

If you’re listening, Product Team:

• Decouple discovery controls from usage controls. Let RCD do what it does best (protect against external discovery) without gutting internal productivity features.
• Add a Copilot/AI toggle in the SharePoint Admin Center that’s separate from RCD, so organizations can independently decide “do we want AI capabilities on this site?”
• Improve transparency. Update the admin center UI and documentation to make it crystal clear what happens when you enable RCD and why.
• Listen to customer feedback. The compliance and regulatory teams asking for this control aren’t anti-AI. They’re asking for intelligent restrictions, not blanket restrictions.

RCD itself isn’t the problem. The current approach hasn’t evolved to keep pace with the latest Copilot features in SharePoint.

Microsoft’s current implementation treats organizations with strict compliance requirements the same way as organizations that simply don’t want any AI in SharePoint. Those are different problems that deserve different solutions.

The good news? This can be fixed. And I suspect the product team knows it — the conversation around these controls is clearly still evolving. Until then, if you’re caught between wanting to protect sensitive content and wanting to use AI as a productivity tool, you’ve got a problem. And you’re probably not alone.

What do you think? Is RCD’s all-or-nothing approach a dealbreaker for your organization, or am I overthinking this? Drop a comment or reach out — I’d love to hear from others who are wrestling with this trade-off.

Hope this helps!

Renewed Revolution!