Copilot answers from the content each user can already open. Before it reaches everyone, check who can open what: Anyone links, Everyone except external users, broken inheritance, sites without owners and sites without a sensitivity label.
Restricted Content Discovery hides sites from Copilot while you review them. It does not change who has access, and Restricted SharePoint Search, the older control, retires on January 31, 2027.
Microsoft 365 Copilot respects existing permissions. Microsoft's site permissions report documentation says so, and adds that sites where many users can open content carry a higher risk of unintended exposure through Copilot. Readiness comes down to one question: are your SharePoint permissions as narrow as you think?
According to Microsoft Learn, general availability of Copilot in SharePoint began rolling out on September 30, 2026. The preview PowerShell settings that turned it on or off for selected sites are honoured until November 1, 2026. After that date, Microsoft says to manage availability with Site AI settings and Restricted Content Discovery.
Sources: the Microsoft Learn pages linked on this page, consulted October 22, 2026. Microsoft updates these pages, so check the current version before you plan.
Anyone links. Links that open a file for anyone who has them. The site permissions report counts them per site, and the sharing links report shows where people created the most in the last 28 days.
Everyone except external users. Content shared with every internal account. The site permissions report counts these permissions, and a separate activity report lists the sites where it happened in the last 28 days.
Broken inheritance. Items with unique permissions that override the site's settings. The site permissions report counts them per site, and the content management assessment includes a broken inheritance report.
Sites without owners. The site ownership report in the content management assessment finds sites with no owner or only one. Each site needs someone accountable for reviewing its access.
Missing sensitivity labels. The site permissions report shows each site's sensitivity label, and the sensitivity label for files report shows where labelled files sit. Confidential sites with no label stand out.
Everyone and guest permissions. Content shared with all users including guests, and access granted to guest accounts. The site permissions report counts both.
A site-level setting that keeps a site's content out of organization-wide search and Copilot responses, and removes the Copilot button and AI actions from that site. Microsoft Learn calls it a temporary governance control. Permissions stay the same, people with access can still open the content directly, and the content stays in the search index. On sites with more than 500,000 items, a change can take more than a week to apply.
Microsoft Learn states that Restricted SharePoint Search is retiring and that new enablement is blocked starting July 31, 2026. Microsoft's message center post MC1395311 (June 18, 2026) sets full retirement for January 31, 2027, with no extensions. It was an allow list of up to 100 sites. Microsoft states it is not a security boundary and does not change permissions. Even when it is on, users still see files they own, recently opened or had shared with them. See the retirement checklist.
During the preview, admins used the KnowledgeAgentScope settings in PowerShell to turn Copilot in SharePoint on or off for selected sites. Microsoft Learn states these settings are honoured until November 1, 2026. If your tenant relies on them, move those sites to Site AI settings or Restricted Content Discovery before that date, and fix the access behind them.
Restricted SharePoint Search (RSS) is the allow list that limited which SharePoint sites appear in organization-wide search and Copilot. According to Microsoft's message center post MC1395311 (June 18, 2026), RSS stops working on January 31, 2027, with no extensions or exceptions. Its PowerShell cmdlets stop working on February 28, 2027. New enablement has been blocked since July 31, 2026.
Nothing moves automatically. Microsoft states it will not migrate RSS configurations to Restricted Content Discovery (RCD). It recommends moving to RCD or other governance controls to manage what content people can discover.
What happens if you do nothing. Microsoft warns that restricted content may become discoverable after RSS retires. Microsoft Learn explains that without RSS, search and Copilot rely on standard SharePoint permissions, so sites left off the allow list can appear for anyone who already has access to them.
Who it affects. Organizations that use RSS in Worldwide, GCC, GCC High and DoD tenants. If your tenant does not use RSS, Microsoft says no action is required.
Sources: Microsoft 365 message center post MC1395311 (June 18, 2026) and the Microsoft Learn page on Restricted SharePoint Search, both consulted November 5, 2026. Microsoft Learn confirms the July 31, 2026 block; the 2027 dates come from MC1395311.
Check whether RSS is on. Get your tenant's current Restricted Search mode with PowerShell. If it is off, Microsoft says no action is required.
Export the allowed site list. Get the full list of site URLs on the allow list and keep a copy. It records which sites were cleared for organization-wide search and which were held back.
Plan Restricted Content Discovery or other controls. Decide which sites need RCD and which need other controls. Microsoft points to SharePoint Advanced Management to find and fix oversharing, and to Microsoft Purview for sensitivity labels, data loss prevention and auditing.
Apply the new controls and validate them. Turn on RCD where needed and check what search and Copilot return for test accounts. On sites with more than 500,000 items, an RCD change can take more than a week to apply.
Disable RSS, then tell people. Turn RSS off once the new controls work, before January 31, 2027. Microsoft also says to update internal documentation and tell admins, support teams and Copilot agent owners that search and Copilot answers can change.
From December 1, 2026, new Microsoft 365 Copilot Business licences bought through a Cloud Solution Provider (CSP) partner come with usage-based billing turned on by default. That is the date in Microsoft's Partner Center announcement, which first gave November 2, 2026. The default spending limit is 4,000 Copilot Credits per user per month, and admins can change it.
Who it applies to. New purchases of Copilot Business, including standalone offers and bundles. Microsoft's usage-based billing documentation adds that seats added through the Partner Center portal also turn it on. It does not apply to Microsoft 365 Copilot (Enterprise), to education, nonprofit or GCC Low offers, or to existing subscriptions without a new purchase. Upgrades do not turn it on automatically.
Where it starts later. Microsoft says the change will not be available at first in Australia, Belgium, Brazil, France, Germany, India, Italy, Korea, the Netherlands, Poland and Spain. Canada is not on that list, and Microsoft makes no separate statement about Canada.
What credits pay for. Usage-based services. Microsoft names Copilot Cowork, Work IQ APIs and GitHub Copilot Harness, and expects to add more. Charges follow actual use and appear separately from the Copilot Business seat licence.
Who sets the limit. Your organization does. Your own Microsoft 365 admin manages spending policies in the Microsoft 365 admin center, under Copilot > Cost management. Your CSP partner can also change the default limits in Partner Center, so agree who owns these settings. Our readiness work covers your SharePoint content and permissions. Copilot licences, credits and billing stay between you, your CSP partner and Microsoft.
Sources: Microsoft's Partner Center announcement (dated October 1, 2026, updated October 14, 2026) and its Microsoft Learn page on usage-based billing for Copilot Business, both consulted November 3, 2026. Microsoft notes that this documentation describes features not yet released and may change before general availability.
Name who owns the meter. Decide who in your organization watches Copilot Credits spending, and who at your CSP partner is allowed to change the limits.
Set your own limit, or zero. The default allows up to 4,000 credits per user per month. Microsoft states usage-based billing cannot be fully turned off once configured, but a limit of zero or deleting the spending policy stops future spend. Usage already accrued is still billed.
Choose who and what the policy covers. A spending policy can apply to all users, to specific users or to specific services, such as Copilot Cowork or Work IQ. Policies for specific users or groups are set in the Microsoft 365 admin center.
Check for overlapping policies. When several policies apply to the same person, the least restrictive one wins, and an unlimited policy always applies.
Review usage every month. Compare this month's and last month's consumption with your limit, and adjust the limit as adoption grows.
For agents that mainly answer questions about one site's content. Set Copilot as the site's main agent, then delete the .agent file. Each user needs a Microsoft 365 Copilot licence.
For agents that run a repeatable task on one site. The convert-agent-file-to-skill skill in Copilot in SharePoint does this from mid-November 2026. Skills run only on that site, not in Teams or the Copilot app, and each user needs a Microsoft 365 Copilot licence.
For a named question-and-answer or analysis agent people use beyond one site, including in Teams and the Copilot app. Edit the .agent file and select Upgrade to Microsoft 365 agent. Later changes happen in Agent Builder.
For agents with no recent use or no clear owner. Microsoft suggests archiving or deleting them instead of upgrading. Deleted files go to the recycle bin.
Find every .agent file. Search for *.agent in SharePoint to list the agents you can open, and run the Agent Insights report in the SharePoint admin center for a view across sites. Note who owns each agent and where people use it.
Pick a path for each agent. Upgrade, convert to a skill, rely on Copilot in SharePoint, or retire. Start with agents that are business-critical, widely shared, on SharePoint pages or added to Teams.
Review who can use each agent. Upgraded agents are shared from Agent Builder, not through SharePoint site permissions, and SharePoint groups are not supported. Unless the original was shared with everyone in the organization, the upgraded agent stays private to its creator until it is shared again.
Review what content each agent reaches. Access to an agent does not grant access to its SharePoint content. Confirm that the intended users can open both the agent and every site, library or file it draws on.
Re-add upgraded agents to Teams. In each Teams chat or channel that used the old agent, remove it and post the upgraded agent's sharing link.
Save usage history first. Usage history from the .agent file does not carry over, and analytics for the upgraded agent start fresh. Export any reports you need for records or adoption before you finish.
Whether search results and AI answers respect who can open each document.
What must be fixed before Copilot or a custom assistant uses your content.
Duplicate, outdated and orphaned content that pollutes results and AI answers.
SharePoint, ServiceNow, file shares and CMS content: what is indexed, what is missing and how fresh it is.
Top queries, zero-result searches and abandoned searches, in French and English.
Native Microsoft search, Coveo or another platform, with a 3-year cost view and the order of work.
Yes. Copilot respects existing permissions, so it only uses content the user can already open. The risk is permissions that are broader than intended, such as Anyone links, Everyone except external users or broken inheritance. Our guide on making Copilot respect your access controls covers the steps.
No. It hides a site's content from organization-wide search and Copilot responses, but Microsoft states it does not change existing permissions. People who already have access can still open the content directly. Use it to buy time while site owners narrow access.
Microsoft is retiring it. New enablement has been blocked since July 31, 2026, and Microsoft's message center post MC1395311 (June 18, 2026) says RSS stops working on January 31, 2027, with no extensions. Microsoft will not move RSS settings to Restricted Content Discovery automatically, and warns that restricted content may become discoverable if you take no action. Neither control changes permissions, so plan the permission review RSS was meant to buy time for. The retirement section lists Microsoft's steps for admins.
According to Microsoft Learn, the preview PowerShell settings that turned Copilot in SharePoint on or off for selected sites (KnowledgeAgentScope and related settings) are honoured only until November 1, 2026. After that date, availability is managed with Site AI settings and Restricted Content Discovery.
New Microsoft 365 Copilot Business licences bought through a CSP partner come with usage-based billing on by default, with a limit of 4,000 Copilot Credits per user per month that admins can change, including to zero. Microsoft 365 Copilot (Enterprise) and existing subscriptions without a new purchase are not in scope. The December 1 section lists what credits pay for and a checklist for your admin.
Microsoft expects agents saved as .agent files to keep working through the end of March 2027, then stop working in SharePoint, Teams and the Copilot app during April 2027. From mid-November 2026, new agents are created in Microsoft Copilot Agent Builder, and nothing is upgraded automatically. Each existing agent needs a decision: use Copilot in SharePoint, convert it to a skill, upgrade it to a Microsoft 365 agent, or retire it. The SharePoint agents section includes a checklist for agent owners and admins.
Sengo works on intranet search across SharePoint, ServiceNow and CMS content, and our team includes former Coveo team members. Our smart intranet work starts by mapping each system's permission model, so AI answers show each person only what they can open. The free intranet search assessment is the first step.
Pilots usually stall on document permissions: either the index checks permissions too late, or identities and groups do not resolve between Entra ID, the AI platform and SharePoint. Our guide on why enterprise AI pilots stall on document permissions explains the fixes. The intranet search assessment reviews permissions, connectors and AI assistant readiness, and you can act on the report in-house, with your current partner or with Sengo.
