Restricting Microsoft 365 Copilot from Sensitive SharePoint Sites: PowerShell & Restricted Access Control (RSA) Guide

When an enterprise rolls out Microsoft 365 Copilot, the chief concern of every Chief Information Security Officer (CISO) and M365 architect is oversharing. Copilot is designed to synthesize information across the entire Microsoft Graph, pulling from emails, Teams chats, and SharePoint document libraries.

Because Copilot strictly adheres to existing user permissions, junior administrators often assume their environment is secure. However, after years of departmental file sharing, broken permission inheritance, and “Anyone with the link” shortcuts, enterprise SharePoint environments suffer from severe permission rot. An employee in Marketing might still have inherited read access to an executive folder created five years ago. Without Copilot, that employee would never know where to find the file. With Copilot, a simple prompt—“What were the executive bonus targets for FY25?”—instantly indexes and summarizes the confidential spreadsheet.

Historically, solving this required months of tedious folder-by-folder permission audits or blunt search exclusions. Microsoft solved this enterprise dilemma by releasing SharePoint Restricted Access Control (also known as Restricted Site Access, or RSA). In this engineering guide, we dissect the architecture of RSA, demonstrate how to configure and verify it using PowerShell, and compare it against Purview Sensitivity Labels and search crawl exclusions.

---

Why Traditional SharePoint Permission Cleanups Fail Copilot

Before implementing Restricted Site Access, it is essential to understand why traditional permission remediation strategies fail during rapid Copilot deployments:

1. The Permission Inheritance Trap: A single document library can have hundreds of nested folders with unique permissions granted to ad-hoc distribution lists, external guests, and individual users. Auditing and revoking these manually before turning on Copilot licenses is operationally impossible for large organizations.
2. The Flaw of “Exclude from Search” (NoCrawl): Administrators historically used Set-PnPSite -NoCrawl $true or navigated to Site Settings → Search and offline availability → Allow this site to appear in search results = No. While this hides the site from standard SharePoint search box queries, Copilot semantic indexers and Microsoft Graph grounding can still access files if users navigate to them directly or if the document is referenced in recent activity logs.
3. Broken Link Governance: Files shared via “People in your organization” (domain-wide sharing links) remain permanently accessible to Copilot across the entire employee population unless explicitly revoked at the tenant level.

---

How SharePoint Restricted Access Control (RSA) Works

Restricted Access Control (RSA) introduces a centralized security perimeter that sits above granular site and folder permissions. Think of it as a bouncer at the front door of the site collection:

This dual-gate design allows administrators to leave underlying SharePoint folder permissions intact while instantly isolating the site from 99% of tenant users and Copilot search indexing.

---

Comparison: The 4 Copilot Containment Strategies

Organizations have four primary mechanisms to restrict Microsoft 365 Copilot from indexing sensitive enterprise content. The following decision matrix outlines when to use each approach:

Containment Method	Blocks Copilot?	Blocks Direct URL Access?	Deployment Speed	Best Used For
Restricted Site Access (RSA)	100% YES (Instant)	YES (Returns 403 Access Denied)	Seconds (1 PowerShell command)	Executive payroll, HR investigations, M&A sites, legal vaults.
Microsoft Purview Sensitivity Labels	YES (If encrypted)	YES (Cryptographic rights check)	Weeks (Requires policy & DLP rollout)	Enterprise-wide data classification across email, endpoints, and cloud.
Search Exclusion (NoCrawl)	PARTIAL / UNRELIABLE	NO (Users can browse directly)	Immediate	Legacy document archives that should not clutter standard search.
Converting Public Teams to Private	YES (For non-members)	YES	Minutes	Department channels accidentally created as Public Microsoft 365 Groups.

---

Step-by-Step PowerShell Runbook: Configuring RSA Policies

Restricted Site Access is managed through the SharePoint Online Management Shell or cross-platform PowerShell 7 using modern certificate/app authentication. Follow this end-to-end implementation procedure:

Step 1: Create the Authorized Entra ID Security Group

First, create a dedicated Microsoft Entra ID Security Group that contains only the authorized personnel who are permitted to access the sensitive site and query its content in Copilot:

# Connect to Microsoft Graph PowerShell
Connect-MgGraph -Scopes "Group.ReadWrite.All", "Directory.ReadWrite.All"

# Create the Dedicated Security Group for Site Containment
$GroupParams = @{
    DisplayName        = "SG-Executive-Payroll-Restricted-Access"
    Description        = "Authorized users permitted to access Executive Payroll SharePoint site and query via Copilot"
    MailEnabled        = $false
    MailNickname       = "sg-exec-payroll-rsa"
    SecurityEnabled    = $true
}

$SecurityGroup = New-MgGroup @GroupParams
Write-Host "Created Security Group with Object ID: $($SecurityGroup.Id)" -ForegroundColor Green

Note the generated Group Object ID (GUID). You will bind this ID to the target SharePoint site.

---

Step 2: Connect to SharePoint Online Management Shell

Launch PowerShell 7 and connect to your tenant’s SharePoint Online Admin URL:

# Connect to SharePoint Admin Center
$AdminUrl = "https://contoso-admin.sharepoint.com"
Connect-SPOService -Url $AdminUrl

---

Step 3: Enable Restricted Access Control on the Target Site

To lock down the sensitive site collection (e.g., https://contoso.sharepoint.com/sites/ExecutivePayroll), execute Set-SPOSite with the -RestrictedAccessControl switch set to $true:

# Target Sensitive Site URL
$TargetSiteUrl = "https://contoso.sharepoint.com/sites/ExecutivePayroll"
$AllowedGroupId = "7a12b489-4e2a-4311-912f-981245ab78cd" # Replace with your Group Object ID

Write-Host "[*] Activating Restricted Access Control on: $TargetSiteUrl..." -ForegroundColor Yellow

# 1. Enable RSA on the Site Collection
Set-SPOSite -Identity $TargetSiteUrl -RestrictedAccessControl $true

# 2. Assign Allowed Security Groups (Supports up to 10 Entra ID Security Groups)
Set-SPOSite -Identity $TargetSiteUrl -RestrictedAccessControlAllowedPrincipals $AllowedGroupId

Write-Host "[+] RSA Activated! Copilot and unauthorized users are now blocked from indexing this site." -ForegroundColor Green

---

Step 4: Verify RSA Policy Enforcement

To confirm that the perimeter boundary is active and inspect the bound security groups, query the site properties:

# Verify RSA Status
$Site = Get-SPOSite -Identity $TargetSiteUrl | Select-Object Url, Title, RestrictedAccessControl, RestrictedAccessControlAllowedPrincipals

$Site | Format-List

The console output will display:

Url                                   : https://contoso.sharepoint.com/sites/ExecutivePayroll
Title                                 : Executive Payroll & Leadership Vault
RestrictedAccessControl               : True
RestrictedAccessControlAllowedPrincipals : {7a12b489-4e2a-4311-912f-981245ab78cd}

---

Auditing RSA Status Across All Tenant Sites

When preparing a tenant for a 500-seat or 5,000-seat Microsoft 365 Copilot deployment, you must maintain a clear inventory of which sites have RSA perimeter protection enabled. Run this tenant-wide audit script:

<#
.SYNOPSIS
    Audits SharePoint Restricted Access Control (RSA) status across all tenant site collections.
.AUTHOR
    Satya Pathak (SkypeExchange4U.com)
#>

$ReportPath = ".\M365-Tenant-RSA-Policy-Audit-$((Get-Date).ToString('yyyyMMdd')).csv"
Write-Host "[*] Enumerating all site collections across tenant..." -ForegroundColor Cyan

$AllSites = Get-SPOSite -Limit All -IncludePersonalSite $false | Where-Object { $_.Template -ne 'SRCHCEN#0' }
$RsaAudit = [System.Collections.Generic.List[PSCustomObject]]::new()

foreach ($S in $AllSites) {
    $IsRsaEnabled = $S.RestrictedAccessControl
    $Principals   = ($S.RestrictedAccessControlAllowedPrincipals -join '; ')

    $StatusColor = if ($IsRsaEnabled) { "Green" } else { "DarkGray" }
    Write-Host "    Site: $($S.Url) | RSA: $IsRsaEnabled" -ForegroundColor $StatusColor

    $RsaAudit.Add([PSCustomObject]@{
        SiteUrl                = $S.Url
        Title                  = $S.Title
        RestrictedAccessControl = $IsRsaEnabled
        AllowedPrincipals      = if ($IsRsaEnabled) { $Principals } else { "None (Open to standard permissions)" }
        AuditDate              = (Get-Date).ToString("u")
    })
}

$RsaAudit | Export-Csv -Path $ReportPath -NoTypeInformation -Encoding utf8
Write-Host "`n[+] Tenant RSA Audit Exported Successfully to: $ReportPath" -ForegroundColor Green

---

Restricting Copilot from Personal Executive OneDrives (OneDrive RSA)

A frequently overlooked Copilot data leakage vector is OneDrive for Business. C-suite executives, legal counsel, and HR directors frequently draft sensitive strategy memos, unannounced organizational restructuring documents, and acquisition notes in their personal OneDrive accounts.

If an executive accidentally shares their entire “Documents” folder or creates an open organization link, Copilot can ingest those drafts. Microsoft allows administrators to apply Restricted Access Control to individual OneDrive for Business sites using the exact same mechanism:

# Restrict an Executive OneDrive Account to the Executive Only
$ExecutiveOneDriveUrl = "https://contoso-my.sharepoint.com/personal/ceo_contoso_com"
$CeoEntraGroupId      = "3c98d104-7a11-4011-8812-45abcdef0123"

# Enable RSA on Personal OneDrive Site
Set-SPOSite -Identity $ExecutiveOneDriveUrl -RestrictedAccessControl $true
Set-SPOSite -Identity $ExecutiveOneDriveUrl -RestrictedAccessControlAllowedPrincipals $CeoEntraGroupId

Write-Host "[+] CEO OneDrive isolated. All tenant users and external links blocked from Copilot indexing." -ForegroundColor Green

---

Licensing Prerequisites & SharePoint Advanced Management (SAM)

To use Restricted Access Control in production, administrators must understand Microsoft’s licensing model:

• Restricted Site Access (RSA) for SharePoint: Requires a SharePoint Advanced Management (SAM) license or a Microsoft 365 E5 / Microsoft 365 Copilot readiness bundle.
• Restricted Access Control for OneDrive: Included under standard SAM and Microsoft Syntex add-ons.
• Tenant Admin Configuration: The tenant must have the Restricted Access Control feature flag enabled in SharePoint Admin Center under Policies → Access control → Restricted site access.

---

Related Production Automation & Voice Guides

To establish a zero-trust Microsoft 365 and Microsoft Teams infrastructure, explore our related engineering runbooks:

• Microsoft 365 Copilot Security Audit: PowerShell Script to Detect Overshared SharePoint Sites — Detect EEEU oversharing, audit public groups, and generate executive risk registers.
• Microsoft 365 & Entra ID PowerShell Automation Runbook — Automate dormant user deprovisioning, license reclamation, and security monitoring.
• Teams Direct Routing SIP 488 Not Acceptable Here Fix — Resolve SRTP encryption mismatches, unsupported G.729 codecs, and Media Bypass errors.
• Teams Direct Routing Calls Dropping After 30 Seconds: SIP ACK Fix — Resolve asymmetric firewall routing, Contact header NAT leaks, and 15-minute session timer drops.
• Exchange Online PowerShell in 2026: The Commands You Actually Need — Master modern Exchange REST cmdlets, message tracing, and mailbox permission audits.

---

Frequently Asked Questions (FAQ)

Does SharePoint Restricted Access Control (RSA) immediately stop Copilot from answering questions about a site?

Yes. When RSA is enabled and a user who is not a member of the designated Entra ID Security Group submits a prompt, Microsoft 365 Copilot cannot retrieve or ground its response on any file, page, or list item stored within that site collection. The exclusion takes effect as soon as the Graph semantic index respects the updated perimeter permission token (typically within minutes).

How many Microsoft Entra ID Security Groups can be assigned to a single site using RSA?

Under the current Microsoft 365 SharePoint Online architecture, administrators can bind up to 10 Microsoft Entra ID Security Groups or Microsoft 365 Groups to the -RestrictedAccessControlAllowedPrincipals parameter for a single site collection.

What error does an unauthorized user see when attempting to open an RSA-protected site?

When an unauthorized user attempts to open an RSA-protected SharePoint site directly via browser or link, SharePoint immediately presents an HTTP 403 “Access Denied” message stating that their account is not in the authorized access list for this site collection, even if they historically possessed direct file-level sharing permissions.