Forum Discussion
What replaces the Copilot in SharePoint site exclusion list after 1 November 2026
Disclosure: I work on M365 Scouts, a vendor that makes read-only audit scripts for Microsoft 365. This post is about Microsoft's own controls and doesn't need our tools.
If you excluded SharePoint sites from Copilot using the preview cmdlets (KnowledgeAgentScope, KnowledgeAgentSelectedSitesList, KnowledgeAgentSelectedSitesListOperation), those settings are only honoured until 1 November 2026. The cmdlets are retired. Microsoft says general availability of Copilot in SharePoint begins rolling out on 30 September 2026.
What replaces them:
Site AI settings. Set by the site owner (Settings > Site AI). They hide the Copilot button on that site for visitors.
Restricted Content Discovery. Set by a SharePoint admin, for example Set-SPOSite -Identity <site-url> -RestrictContentOrgWideSearch $true. It limits discovery of the site in organization-wide search and Copilot responses, and removes the AI entry points on that site. It needs a Copilot licence and SharePoint Advanced Management, and it covers SharePoint sites only, not OneDrive. On sites over 500,000 items an update can take more than a week.
Neither control changes permissions. People who already have access can still open the files, and Microsoft describes Restricted Content Discovery as a temporary control to use selectively. Restricted SharePoint Search is also retiring, and new enablement has been blocked since 31 July 2026.
So the real work before 1 November is knowing which sites are overshared: Anyone links, Everyone except external users, broken inheritance, ownerless sites and missing sensitivity labels. Copilot in SharePoint also needs a Microsoft 365 Copilot licence for each user.
Sources: Microsoft Learn pages on Copilot in SharePoint, Restricted Content Discovery and Restricted SharePoint Search. Please check them against your tenant, because the GA page is still changing.
1 Reply
Good writeup. For anyone now trying to work out which sites are actually overshared, the data access governance reports in the SharePoint admin center are the quickest start. The site permissions report gives you the baseline (huge user counts, guests, Everyone except external users) and the EEEU and sharing links reports show what happened in the last 28 days.
From there I'd hand it to site owners with site access reviews instead of fixing everything from IT. Owners get an email about that specific issue. They know whether the finance planning site should really be open to the whole company, we usually don't.
Ownerless sites won't get reviewed by anybody, so they need their own pass. And agree on RCD being a stopgap. It hides the site from Copilot and org wide search but anyone who already has access can still open the files.
