SharePoint · Copilot in SharePoint

Your Copilot in SharePoint site exclusion list stops working on 1 November 2026

Published 1 October 2026 · 8 min read · Every date, limit and cmdlet from Microsoft Learn, linked at the end

During the public preview, keeping Copilot in SharePoint off a site took one line of PowerShell: put the site's URL on a tenant list. General availability began rolling out on 30 September 2026, and with it Microsoft is retiring those cmdlets. Whatever you set is honoured until 1 November 2026. After that the list means nothing, and the two controls that replace it do different jobs, sit with different people, and one of them has a side effect the list never had. This article covers what goes away, what each replacement really does, and the month of work in between.

What is being retired

Three parameters of Set-SPOTenant carried the preview. The parameter names still say "Knowledge Agent", the feature's earlier name:

ParameterWhat it did
KnowledgeAgentScopeAllSites, IncludeSelectedSites, ExcludeSelectedSites or NoSites. NoSites was the default: nothing on until an admin opted in
KnowledgeAgentSelectedSitesListThe site URLs to include or exclude, depending on the scope. At most 100 sites
KnowledgeAgentSelectedSitesListOperationOverwrite (default), Append or Remove against that list

Learn's wording is short. The commands used "to opt tenants and sites in or out during preview" are being retired, "existing PowerShell settings continue to be honored until November 1, 2026", and after that date you "manage availability using Site AI settings and Restricted Content Discovery".

What Learn does not spell out is what a tenant that left the scope at NoSites, or opted in a handful of sites, looks like on 2 November. The plain reading is that every user with a Microsoft 365 Copilot licence gets Copilot in SharePoint on every site that is not under Restricted Content Discovery. That is our reading, not a quote. Plan for it; if Microsoft publishes something gentler, you have lost nothing.

Who this touchesCopilot in SharePoint needs a Microsoft 365 Copilot licence per user, and everyday use is included in that licence. A tenant with no Copilot licences has nothing to do on 1 November. A tenant with Copilot licences and an include or exclude list has a month.

Read your current settings first

Connect-SPOService -Url https://TENANT-admin.sharepoint.com

Get-SPOTenant | Select-Object KnowledgeAgentScope, KnowledgeAgentSelectedSitesList

Save the output somewhere that is not a terminal window. It is the only record of which sites somebody decided should not have Copilot, and you should not count on being able to read it back once the parameters are gone. In a multi-geo tenant, run it in each geo: Learn says the setting is managed per geo.

The two replacements are not a list

Site AI settingsRestricted Content Discovery
Who sets itThe site owner, under Settings > Site AIA SharePoint administrator; site administrators too if you delegate it
What it doesChooses which agent opens from the agent icon (Copilot in SharePoint or a custom agent). Hides the Copilot button on site pages, for site visitors only. Turns on advanced document processing for the siteCopilot in SharePoint and AI actions do not appear on the site: no Copilot button, no AI actions menus (including creating agents), no "Create pages with AI". The site's content also drops out of organisation-wide search and Microsoft 365 Copilot responses
What it does not doHide anything from members or owners. Touch search, Copilot Chat or permissionsChange permissions. People with access still open the files, still find what they own or recently used, and search from inside the site still works
NeedsNothing beyond the Copilot licence is documentedA Copilot licence in the tenant plus SharePoint Advanced Management
WherePer siteSharePoint sites only. Not OneDrive
How fastNot documentedNot instant. For a site with more than 500,000 items, Learn says the change "could take more than a week" to show up in search and Copilot

The exclusion list was narrow. It switched Copilot in SharePoint off on a site and left everything else alone. Restricted Content Discovery is broad: it was built to keep a site's content out of tenant-wide search and Copilot answers while its permissions are reviewed, and Copilot in SharePoint simply respects it. Move a 60-site exclusion list onto it and you have also taken 60 sites out of organisation-wide search for everyone, including the people who work in them.

Microsoft says as much. Learn calls it "a temporary governance control" and carries this caution: "Use Restricted Content Discovery selectively. Excessive use can reduce the amount of content available to organization-wide search and Microsoft Copilot experiences."

Site AI settings go the other way: narrow, and in the owner's hands. They hide a button from visitors. That is a tidy answer to "this site doesn't need a Copilot button on its pages" and no answer at all to "this site holds things most people should not be reading".

Restricted SharePoint Search is not the fallback

The older tenant-wide brake, Restricted SharePoint Search with its allow list of up to 100 sites, is retiring as well. New enablement has been blocked since 31 July 2026 and Learn points to Restricted Content Discovery instead. By Microsoft's own description it "isn't a security boundary and doesn't change any permissions". If it is still switched on in your tenant, that is a second exit to plan, and the same question applies to it as to the exclusion list.

Why was the site on the list?

None of these controls, old or new, changes who can open a file. Copilot works with what the signed-in user can already reach; Learn's phrasing is that Copilot and agents "respect existing permissions, sharing settings, and policies". So the useful question about every site on your list is why it was put there. The answers fall into three groups, and each has a different destination.

Why it was excludedWhere it goes now
The owner did not want the button there (a publishing site, a noisy intranet page)Site AI settings. It is the owner's call and they can make it themselves
The content is sensitive and too many people can get inFix the access. Restricted Content Discovery while you do, then take it off again
Nobody remembersCheck its access as in the row above. If it is clean, let it go

The second row is where the month goes. A site that needed hiding from Copilot because of who can reach it has an access problem with or without Copilot: the same people can open the same files from search, from a shared link, or by browsing to the site.

Finding the sites that are actually overshared

Microsoft's readiness guidance lists the signals: broad sharing through Anyone, Everyone and organisation-wide links; large audiences with excessive permissions; broken permission inheritance; sensitive content with weak protection; unlabelled or public sites; ownerless, inactive or unreviewed sites. Sites where several overlap are the high-risk ones. Learn's own examples are sensitive data behind Anyone links, public sites with no owner, and large audiences on top of broken inheritance.

There are three ways to get that picture.

If you do use Restricted Content Discovery

# Turn it on for one site
Set-SPOSite -Identity https://TENANT.sharepoint.com/sites/finance -RestrictContentOrgWideSearch $true

# Check a site
Get-SPOSite -Identity https://TENANT.sharepoint.com/sites/finance | Select-Object RestrictContentOrgWideSearch

# Let site administrators manage it on their own sites (they must give a justification)
Set-SPOTenant -DelegateRestrictedContentDiscoverabilityManagement $true

# Tenant-wide report of sites under the restriction
Start-SPORestrictedContentDiscoverabilityReport
Get-SPORestrictedContentDiscoverabilityReport

In the admin centre the same switch is under Active sites > the site > Settings > "Restrict content from Microsoft Copilot". Turning it on, turning it off and the justification text are all written to the Purview audit log. The content stays in the search index, so eDiscovery and auto-labelling keep working.

The calendarThe setting has to propagate through the index, and how long that takes depends on the number of items in the site and how many sites are being updated at once. If a site with several hundred thousand items has to be covered when the list lapses, make the change in mid-October, not on the 31st.

One more thing that arrived with general availability: Copilot Credits

General availability also split Copilot in SharePoint in two. Everyday use (asking questions, creating files, pages and lists, simple rules, autofill) stays inside the Copilot licence. "Advanced work" (large content sets, building whole sites, multistep AI workflows, real-time autofill, image generation, analytics) spends Copilot Credits through usage-based billing. For most organisations that is off until an admin adds a spending policy under Copilot > Cost management in the Microsoft 365 admin centre.

The catch is for tenants that already have a policy. Learn notes that existing policies "might automatically include newly available services" if the option "Allow new agents and services as they become available" is turned on. Look at your existing policies this week, before anyone finds out from an invoice.

Checklist for October

  1. Export KnowledgeAgentScope and the sites list today, in every geo.
  2. For each listed site, write down why it was excluded. Where the answer is owner preference, show the owner Site AI settings.
  3. For sites excluded because of who can reach them, review Anyone links, Everyone and Everyone except external users in the site's groups, unique permissions, owners and labels. Fix what you find.
  4. Where the fix will not land before 1 November, apply Restricted Content Discovery, in mid-October for large sites, and tell the people who use the site that search will change.
  5. If the scope was NoSites or IncludeSelectedSites, assume Copilot in SharePoint reaches every site for licensed users after 1 November, and run step 3 across the tenant, not just the list.
  6. Check Copilot cost-management policies for the "allow new agents and services" option.
  7. Put a date on removing each restriction. It is documented as temporary, and every site left under it is a site missing from search.

One scope note: Learn lists GCC, GCC High, DoD, air-gapped clouds and Microsoft 365 operated by 21Vianet as not currently supporting Copilot in SharePoint, so none of this applies there yet.

Free: every Anyone link and every site open to all employees, as two CSVs

ShareScout Lite is a read-only PowerShell audit. It prints a tenant summary and writes one CSV of every Anyone link (path, type, expiry) and one of every site where Everyone or Everyone except external users has access. It runs on any plan, with or without a Copilot licence, and nothing leaves your tenant. The paid tiers add guests, broken inheritance, ownership gaps, label gaps and a per-site exposure score in a single HTML report.

Download ShareScout Lite — free See what Solo adds

Disclosure: ShareScout is our product. Dates, limits and cmdlets are from Microsoft Learn as read on 1 October 2026; the general-availability page is changing as the rollout proceeds, so check it before you act. Where this article reads between Learn's lines, it says so. ShareScout is independent and not affiliated with or endorsed by Microsoft.

Sources