How to Use Restricted SharePoint Search and Data Access Governance Reports

Retrospective: this article looks back at events from September 2024, written in 2026 with the benefit of hindsight.

Restricted SharePoint Search and data access governance reports help you control Copilot exposure while you fix oversharing. Here is how to use them.

Data access governance (DAG) reports

Available with SharePoint Advanced Management (included with Copilot licenses), in the SharePoint admin center under Reports → Data access governance.

1. Run sharing links reports for "Anyone," "People in your organization" and "Specific people shared externally" links.
2. Run the "Everyone except external users" (EEEU) permissions report.
3. Run reports for sensitivity-labeled files shared broadly.
4. Run oversharing baseline / permission state reports where available.
5. Export results and sort by sites with the most broad access and the most sensitive content.

From the reports, you can initiate site access reviews that ask site owners to confirm or remove access.

Restricted SharePoint Search (temporary)

Restricted SharePoint Search limits organization-wide search and Copilot to an allowed list of sites (up to a defined maximum) plus content users own or have recently accessed. Microsoft positioned it as a temporary measure while organizations remediate.

• Enable via SharePoint Online PowerShell (Set-SPOTenantRestrictedSearchMode) and add curated sites to the allowed list.
• Communicate to users that search results will be limited.

Restricted Content Discovery (targeted)

Rather than restricting everything, Restricted Content Discovery excludes specific sensitive sites from Copilot and org-wide search while leaving them accessible to members:

Set-SPOSite -Identity https://contoso.sharepoint.com/sites/hr -RestrictContentOrgWideSearch $true

Recommended approach

Use DAG reports to find problems, Restricted Content Discovery for sensitive sites, site access reviews to fix permissions, and remove interim restrictions once remediation is complete.