We used Restricted SharePoint Search as our Copilot brake while we cleaned permissions. Message Centre says new enablement is already blocked and full retirement is January 2027. Does everything we held back suddenly become discoverable — and is Restricted Content Discovery a drop-in swap?

RSS retirement timeline, no auto-migration, RCD as the per-site successor — Steady Security before the allow-list vanishes.

Restricted SharePoint Search is retiring — what do we do?

You’re right to treat this as a dated obligation, not a quiet admin footnote. If Restricted SharePoint Search (RSS) was your temporary Copilot brake, the calendar now owns the risk.

Here’s what’s happening. Microsoft’s Learn guidance is blunt: Restricted SharePoint Search is retiring. New enablement has been blocked since 31 July 2026; full retirement is 31 January 2027, with PowerShell cmdlets following shortly after. RSS was always a short-term allow-list (up to 100 curated sites) for organisation-wide search and Copilot while you audited permissions — not a security boundary and not a long-term model. The successor Microsoft points to is Restricted Content Discovery (RCD): a per-site control that keeps a site out of organisation-wide search and Copilot discovery (and strips AI entry points on that site) without changing ACLs. Message Centre post MC1395311 and Learn both say Microsoft will not migrate your RSS allow-list to RCD for you. If you take no action, content RSS was holding back can become discoverable again once the feature stops.

This is Third Law meets Steady before scale: the easier it was to lean on a tenant-wide panic button, the harder the cliff when that button is retired. Pane 04 Security owns the migration — not “hope the allow-list survives.”

Practical options:

Export the allow-list now, map hotspots to RCD. While RSS PowerShell still works, capture every allowed URL. Identify sites that were excluded from the list (the ones you were protecting). Apply RCD to those high-risk sites via SharePoint admin centre (Restrict content from Microsoft Copilot) or Set-SPOSite -RestrictContentOrgWideSearch $true. Best default for most organisations still mid-cleanup.
RCD + SAM/Purview remediation with a named exit. Use Data Access Governance reports to fix Everyone / Anyone / oversized audiences; keep RCD only while owners finish. Remove RCD when permissions are credible so Copilot gets useful grounding again. Moderate effort; matches Microsoft’s recommended process.
Assume RSS retirement is someone else’s problem. Quiet until January 2027. Then Copilot and search widen overnight and you explain it under spotlight. I’d discourage this.
Try to re-enable RSS after July 2026. Already blocked for new enablement — that door is closed.

The caution: RCD is not a like-for-like swap for RSS. RSS was an allow-list of up to 100 sites; RCD is deny-discovery on chosen sites. Neither invents a security boundary — users can still reach content they own or recently opened. RCD needs SharePoint Advanced Management prerequisites and is intended for Copilot deployment scenarios (a Microsoft Copilot licence in the tenant). OneDrive sites aren’t supported. Excessive RCD reduces what Copilot can usefully answer.

I’d suggest putting a one-page Wave 0 note to leadership this week: RSS end date, no auto-migration, hotspot list with RCD applied, owners and dates for permission cleanup. That frames the work as risk control before the brake fails — not another delay story.

You’re asking the right question before the cliff. Steady before scale means the allow-list exits on purpose, not by surprise.

DIGITAL SKILL WORKS LTD / 12 PANES · You ask, we answer