You spent last month turning Restricted Content Discovery on, site by site, to keep the messy ones out of Copilot. Now someone asks a fair question: which sites did we actually restrict? Clicking through Active sites one at a time is not the answer. PowerShell gives you two clean ways to get it, one site at a time and the whole tenant at once, and the tenant one is a command almost nobody knows exists.
First, licensing, so you do not chase an error: Restricted Content Discovery is a SharePoint Advanced Management feature, so these commands need SAM, which you have if anyone in the tenant holds a Microsoft 365 Copilot licence. You also need the SharePoint Online Management Shell and the SharePoint Administrator role.
Check one site
The setting lives on the site as a property called RestrictContentOrgWideSearch. For a single site, read it straight off:
Get-SPOSite -Identity "https://contoso.sharepoint.com/sites/Finance" |
Select-Object Url, RestrictContentOrgWideSearch
[LAB: paste the real one-line output here, showing True/False for a restricted site]
True means the site is restricted from Copilot and organisation-wide search. False means it is not. Simple enough for one site. The problem is the other four hundred.
Check the whole tenant
You might reach for Get-SPOSite -Limit All and try to select the property across every site in one go. [LAB: confirm whether Get-SPOSite -Limit All | Select Url, RestrictContentOrgWideSearch actually returns the value, or comes back blank in list mode. If blank, say so here, because that is the gotcha worth documenting.]
Either way, Microsoft gives you a purpose-built report for this, and it is the right tool. It runs in three steps, because the report is generated asynchronously. Kick it off:
Start-SPORestrictedContentDiscoverabilityReport
Check on it, and grab the report id once it is ready:
Get-SPORestrictedContentDiscoverabilityReport
Then download it:
Get-SPORestrictedContentDiscoverabilityReport -Action Download -ReportId <ReportGUID>
[LAB: describe what the downloaded report actually contains – the columns, one row per restricted site – and paste a small, sanitised sample. Never real tenant site names; use the demo site.]
The report lands in the folder you ran the command from. That is your list: every site currently restricted from Copilot, in one file, without touching the admin center.
The half this does not answer
This tells you what you have hidden. It does not tell you what you should have hidden, which is a different question entirely: which sites are actually overshared. Restricted Content Discovery is the cover you throw over a site while you sort the access out; the report above just confirms where the cover is.
Working out which sites need it in the first place, the who-can-reach-what, is the harder half. That is the part I built User Access Explorer to show.
