| Service | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| SharePoint | Manage Site Creation | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/manage-site-creation.md | Previously updated : 07/11/2018 Last updated : 04/17/2024 Title: "Manage site creation in SharePoint" Admins in the <a href="https://go.microsoft.com/fwlink/?linkid=2185219" target=" > [!NOTE] > Creating a subsite in OneDrive is not supported. You will see an error, ΓÇ£New subsites are not available in this site. Create a new site instead.ΓÇ¥ -> [!NOTE] -> Currently, the following site templates are considered "modern". -> -> - GROUP#0 -> - STS#3 -> - SITEPAGEPUBLISHING#0 -> - TEAMCHANNEL#0 -> - TEAMCHANNEL#1 -- > [!TIP] > Instead of using subsites, we recommend that you use hub sites. [SharePoint hub sites](https://support.microsoft.com/office/what-is-a-sharepoint-hub-site-fe26ae84-14b7-45b6-a6d1-948b3966427f) allow you to group similar topics and content together using modern architecture design. Plan to [create hub sites.](create-hub-site.md) |
| SharePoint | Restricted Sharepoint Search Admin Scripts | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/restricted-sharepoint-search-admin-scripts.md | + Last updated : 4/14/2024 + Title: "Restricted SharePoint Search Admin PowerShell Scripts" +++++recommendations: true +audience: administrator +++ms.localizationpriority: medium ++- Ent_O365_Hybrid +- M365-collaboration +description: "Learn how to use PowerShell scripts as a global admin to get current mode of Restricted SharePoint Search, enable/disable Restricted SharePoint search, add to or remove from the allowed list, and get the list of current sites in the allowed list." +++# Use PowerShell Scripts for Restricted SharePoint Search +> +> [!IMPORTANT] +> Restricted SharePoint Search is designed for customers of Copilot for Microsoft 365. Visit [here](https://go.microsoft.com/fwlink/p/?linkid=2260808) and the overview of Restricted SharePoint Search for more information. ++By default, **Restricted SharePoint Search** is not enabled. To enable and set up Restricted SharePoint Search, you need to have Global and SharePoint admin roles. Depending on the scenario, some actions you need to take are: ++- Get the current mode that is set for Restricted Search ++- Enable and disable restricted SharePoint search ++- Add sites to the allowed list by providing URL ++- Remove sites from the allowed list by providing URL ++- Get the existing list of URLs that are added in allow list ++ This article covers how to use admin scripts in PowerShell for these actions. ++## Before you start ++You must be a SharePoint Online or global administrator to run the following admin scripts. +Before you use the PowerShell scripts in this article, you need to do the following: ++1. If you haven’t, [download the latest SharePoint Online Management Shell](https://go.microsoft.com/fwlink/p/?LinkId=255251). ++ > [!NOTE] + > If you installed a previous version of the SharePoint Online Management Shell, go to Add or remove programs and uninstall "SharePoint Online Management Shell." ++1. Connect to SharePoint as a [Global Administrator or SharePoint Administrator](/sharepoint/sharepoint-admin-role) in Microsoft 365. To learn how, see [Getting started with SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/connect-sharepoint-online). ++## Get the current mode that is set for Restricted Search ++Restricted SharePoint Search is disabled by default. To verify this feature’s current mode, you can run the following script: ++**Get-SPOTenantRestrictedSearchMode** ++ **Module**: [Microsoft.Online.SharePoint.PowerShell](/powershell/module/sharepoint-online) ++ **Applies to:** SharePoint Online ++ **Syntax** ++```powershell +Get-SPOTenantRestrictedSearchMode +``` ++**Example** ++```powershell +Get-SPOTenantRestrictedSearchMode +``` ++This example lets the admin get the existing allowed list in the tenant. Result can be ‘Enabled’ or ‘Disabled’ based on the current setting. ++## Enable or disable the Restricted Search setting ++Enable or disabled the Restricted Search setting with the default being disabled. The first time when the setting is enabled the allow list is empty. To enable or disable the Restricted SharePoint Search, you can run: ++ **Set-SPOTenantRestrictedSearchMode** ++ Module: [Microsoft.Online.SharePoint.PowerShell](/powershell/module/sharepoint-online) ++Applies to: SharePoint Online ++**Syntax** ++```powershell +Set-SPOTenantRestrictedSearchMode  +[-Mode] {Disabled | Enabled} + [<CommonParameters>] +``` ++ **Example 1** ++```powershell +Set-SPOTenantRestrictedSearchMode -Mode Enabled   +``` ++Example 1 sets or enables the Restricted Tenant Search mode for the tenant. ++ **Example 2** ++```powershell +Set-SPOTenantRestrictedSearchMode – Mode Disabled   +``` ++Example 2 disables the Restricted Tenant Search mode for the tenant. +++ **Parameters** ++ **-Mode** ++ Sets the mode for the Restricted Tenant Search. ++| Type   | String   | +||--| +| Position:  | 0  | +| Default Value:  | Disabled  | +| Required:  | True  | +| Accept Pipeline input:  | False  | +| Accept wildcard characters:  | False  | ++## Add sites to the allowed list ++When Restricted SharePoint Search is enabled, you can add site URLs to the allowed list in string or csv file: ++**Add-SPOTenantRestrictedSearchAllowedList** ++ **Module:** [Microsoft.Online.SharePoint.PowerShell](/powershell/module/sharepoint-online) ++ **Applies to:** SharePoint Online ++ **Syntax** ++```powershell +Add-SPOTenantRestrictedSearchAllowedList -SitesList <List[string]> [<CommonParameters>] +``` ++```powershell +Add-SPOTenantRestrictedSearchAllowedList -SitesListFileUrl <string> [-ContainsHeader <bool>]   + [<CommonParameters>] +``` ++ **Example 1** ++```powershell +Add-SPOTenantRestrictedSearchAllowedList -SitesList @(“[https://contoso.sharepoint.com/sites/Marketing](https://contoso.sharepoint.com/sites/Marketing)”, “[https://contoso.sharepoint.com/sites/Benefits](https://contoso.sharepoint.com/sites/Benefits)”) +``` ++This example lets the admin add the sites to the allowed list. ++ **Example 2** ++```powershell +Add-SPOTenantRestrictedSearchAllowedList  -SitesListFileUrl C:\Users\admin\Downloads\UrlList.csv +``` +   + This example lets the admin add the sites to the allowed list by giving a CSV file. Add the list of site URL’s in URL column. ++ **Parameters** ++ **-SitesList** ++ Site list for allowed list. ++| Type  | String  | +||-| +| Position:  | 0  | +| Default Value:  | None  | +| Required:  | True  | +| Accept Pipeline input:  | False  | +| Accept wildcard characters:  | False  | ++ **-SitesListFileURL** ++ File that has list of sites URLs that can be added to an allowed list when the tenant is set to Restricted Tenant Search Mode. ++| Type  | String  | +||-| +| Position:  | 0  | +| Default Value:  | None  | +| Required:  | True  | +| Accept Pipeline input:  | False  | +| Accept wildcard characters:  | False  | ++## Remove sites from the allow list ++You can remove sites from the allowed list by providing the Site URL in string or csv file using PowerShell script: ++ **Remove-SPOTenantRestrictedSearchAllowedList** ++ **Module:** [Microsoft.Online.SharePoint.PowerShell](/powershell/module/sharepoint-online) ++ **Applies to:** SharePoint Online ++ **Syntax** ++```powershell +Remove-SPOTenantRestrictedSearchAllowedList -SitesList <List[string]> [<CommonParameters>] +``` ++```powershell +Remove-SPOTenantRestrictedSearchAllowedList -SitesListFileUrl <string> [-ContainsHeader <bool>] + [<CommonParameters>] +``` ++**Example 1** ++```powershell +Remove-SPOTenantRestrictedSearchAllowedList -SitesList @(“[https://contoso.sharepoint.com/sites/Marketing](https://contoso.sharepoint.com/sites/Marketing)”, “[https://contoso.sharepoint.com/sites/HR](https://contoso.sharepoint.com/sites/HR)”) +``` ++Example 1 lets the admin remove the sites to the allowed list. ++ **Example 2** ++```powershell +Remove-SPOTenantRestrictedSearchAllowedList -SitesListFileUrl C:\Users\admin\Downloads\UrlList.csv +``` ++Example 2 lets the admin add the sites to the allowed list by giving a CSV file. ++ **Parameters** ++ **-SitesList** ++ Site list that will be removed from allowed list. ++| Type  | String  | +||-| +| Position:  | 0  | +| Default Value:  | None  | +| Required:  | True  | +| Accept Pipeline input:  | False  | +| Accept wildcard characters:  | False  | ++ **-SitesListFileURL** ++ File that has list of sites that can be removed from an allowed list when the tenant is set to Restricted Tenant Search Mode. ++| Type   | String   | +||-| +| Position:  | 0  | +| Default Value:  | None  | +| Required:  | True  | +| Accept Pipeline input:  | False  | +| Accept wildcard characters:  | False  | ++## Get the existing list of URLs in the allowed list ++You can get the existing list of URLs in the allowed list by running the following PowerShell script: ++ **Get-SPOTenantRestrictedSearchAllowedList** ++ **Module:** [Microsoft.Online.SharePoint.PowerShell](/powershell/module/sharepoint-online) ++ **Applies to:** SharePoint Online ++ **Syntax** ++```powershell + Get-SPOTenantRestrictedSearchAllowedList +```   ++**Example** ++```powershell + Get-SPOTenantRestrictedSearchAllowedList +``` ++This example lets the admin get the existing allowed list in the tenant. |
| SharePoint | Restricted Sharepoint Search Allowed List | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/restricted-sharepoint-search-allowed-list.md | + Last updated : 04/12/2024 + Title: "Curate the allowed list for Restricted SharePoint Search" +++++recommendations: true +audience: administrator +++ms.localizationpriority: medium ++- Ent_O365_Hybrid +- M365-collaboration +description: "Learn how to use SharePoint Admin Center active sites report and SharePoint Advanced Management Data Access Governance report to find the most active and shared sites for the Restricted SharePoint Search allowed list. " +++# Curate the allowed list for Restricted SharePoint Search +> [!IMPORTANT] +> Restricted SharePoint Search is designed for customers of Copilot for Microsoft 365. Visit [here](https://go.microsoft.com/fwlink/p/?linkid=2260808) and the overview of Restricted SharePoint Search for more information. ++As a Global and SharePoint admin, you can set up an allowed list of Restricted SharePoint Search with a maximum of 100 selected SharePoint sites. For Copilot and organization-wide search, besides the contents that they already have access to, either by direct sharing, visiting, or owning, your organization’s users will only be able to reach the sites on the allowed list, honoring these sites’ current permissions. ++Setting up the allowed list in Restricted SharePoint Search gives you time to review and audit site permissions. But which sites should be included in the allowed list? This article introduces strategies and techniques for curating the allowed list. ++## Steps to create the curated allowed list +To create a curated allowed list for Restricted SharePoint Search, we recommend you start by creating an initial list of sites. Then you work with your site admins and stakeholders to assess permissions and review the sites. Finally, you can [apply the list with PowerShell scripts as a Global admin](restricted-sharepoint-search-admin-scripts.md). ++### Step 1: Get an initial list of sites ++Every organization might have different criteria on what sites you choose to be searched across your organization and discoverable by Copilot. You can use SharePoint Admin Center (SPAC) features to identify sites that can be part of the allowed list based on your own criteria. To keep the list manageable, we recommend starting with the following two types of sites when for the allowed list: ++- **The “Known” sites**: You and your SharePoint site admins already know set of sites from your organization that are safe to participate in organization wide search and the Copilot experience. These sites can be included in the allowed list. ++- **The top active and shared sites**: the allowed list affects what users can see in their organization-wide search results and their Copilot experience. To optimize users’ search and Copilot experience, the hypothesis is that those top active and shared sites need to be included in the allowed list. Depending on your license, you can use either the SharePoint Admin Center (SPAC) or the SharePoint Admin Center Data access governance (SPAC DAG) Activity(sharing) report to identify the most active and shared sites. ++### Step 2: Review site permissions ++Once you have the list of sites (up to 100), make sure the site permissions and content controls are implemented well enough to make them visible for search and Copilot experience. You can work with your site admins and stakeholders to assess permissions and review the sites. ++>[!NOTE] +>The limit of up to 100 SharePoint sites includes Hub sites, but not their sub-sites. When you enable Hub sites, the sub-sites under a Hub site are included in the allowed-list but do not count towards the 100-site limit. So if you are picking Hub sites, make sure all the child sites have proper permissions. ++### Step 3: Use PowerShell Scripts to apply the allowed list ++After you review permissions in your curated sites, you can use PowerShell Scripts to turn on Restricted SharePoint Search, add, and remove sites. You can also use PowerShell Scripts to get the list of all sites in your allowed list. ++## Find the most active and shared sites ++You can find the most active sites using the SharePoint Admin Center (SPAC). If you have [either Microsoft 365 E5 licensing or Microsoft Syntex - SharePoint Advanced Management](/SharePoint/data-access-governance-reports#requirements), you can also use SPAC DAG to find the most shared sites. ++- **Using SharePoint Admin Center (SPAC):** If your organization has SharePoint, you have access to SPAC. You can get this list of sites using SPAC Active sites feature that had most page views and files in the last 30 days. This can be an indicator to get to the list of sites interested by the broadest possible audience in the organization. ++- **Using SPAC DAG Activity(sharing) report** to [identify sites](/SharePoint/data-access-governance-reports) that have been shared most in the last 28 days. ++### Use SharePoint Admin Center (SPAC) to find the most active sites ++Admins can use SharePoint Admin Center (SPAC) features to identify sites that can be part of the allowed list based on their criteria. The [Active sites page in the SharePoint admin center](https://go.microsoft.com/fwlink/?linkid=2185220) lets you view the SharePoint sites in your organization. Based on your organization’s needs, you can [sort and filter sites](/sharepoint/customize-admin-center-site-list#sort-and-filter-the-site-list) based on columns such as Last activity, Page views, Page visits. You can search for sites, and [customize the columns and views](/sharepoint/customize-admin-center-site-list#customize-columns). ++**Step 1:** In SPAC left pane, select “Active Sites.” ++ ++**Step 2:** Using the sorting and filtering functionality of the Active sites you can curate top 100 sites based on your organization needs and create a custom view. ++ ++**Step 3:** First move the columns by scrolling to right and clicking the “Customize columns”.   ++ ++Use up and down arrows next to each column's name to move up the Page Views and Files next to the URL, so it's easy for you to see the important columns together for analysis.   ++ ++**Step 4:** To create custom view of the top 100 sites sorted by “page views” for last 30 days do the following:   ++1. Select the arrow next to the column header of **Page views** and select **Large to Small**. ++1. Select the arrow next to the column header of **Last activity** select on the **Filter by last activity**> **Last 30 days**. ++1. You can use the other columns to sort, or filter based on your needs. ++ ++**Step 5:** Once you are done with your sorting and filtering, you can create a custom view based on your current setting, and save it for future use. To create a custom view, select **All sites** > **Save view as**. ++ +Enter a name for your custom view: + ++Your saved custom view is now available for you to choose from the drop down menu next time. + ++  **Step #6:** Export the sites and manage the list in CSV file that you can use to add to the list by selecting the **Export** tab. ++ +Your exported CSV file looks similar to the following CSV file: + ++### Use SPAC DAG Activity (sharing) report to find most shared sites ++The SPAC DAG report (Data access governance reports for SharePoint sites) is part of [SharePoint admin center](https://go.microsoft.com/fwlink/?linkid=2185219). Admins with Microsoft 365 E5 licensing or Microsoft Syntex - SharePoint Advanced Management can access this report. This report helps you identify potential sites that are active and shared in the last 28 days.   ++**Step 1:** In the left pane, select **Reports** > **Data access governance**. Select the **Sharing links** report. + ++**Step #2:** In the right pane **Sharing Links** page, select on the **Anyone links** report. ++ ++**Step #3:** **"Anyone" links** report gives you a list of sites in which the highest number of Anyone links were created. These links let anyone access files and folders without signing in. These sites might be great candidates to allow in tenant/org wide search. ++ ++## Resources ++[Microsoft Copilot for Microsoft 365 - best practices with SharePoint](/sharepoint/sharepoint-copilot-best-practices) |
| SharePoint | Restricted Sharepoint Search | https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/restricted-sharepoint-search.md | + Last updated : 4/12/2024 + Title: "Restricted SharePoint Search" +++++recommendations: true +audience: administrator +++ms.localizationpriority: medium ++- Ent_O365_Hybrid +- M365-collaboration +description: "Helps you prevent certain content on SharePoint sites from being shared too widely. This feature lets you as the administrator decide which SharePoint sites appear in the search across your organization and the initial Copilot experiences." ++# Restricted SharePoint Search ++> [!IMPORTANT] +> Restricted SharePoint Search is designed for customers of Copilot for Microsoft 365. ++## What is Restricted SharePoint Search? ++Restricted SharePoint Search is a setting that helps you as Global and SharePoint administrator to maintain a list of SharePoint sites ("allowed list") that you have checked the permissions and applied data governance for. The allowed list defines which SharePoint sites can participate in organization-wide search and Copilot experiences. By default, the Restricted SharePoint Search setting is turned off and the allowed list is empty. This feature is currently available as Public Preview for customers who have Microsoft 365 and Copilot licenses. ++Restricted SharePoint Search allows you to restrict both organization-wide search and Copilot experiences to a curated set of SharePoint sites of your choice. Additionally, whether you have enabled Restricted SharePoint Search, users in your organization are still able to interact with files and content they own or that they have previously accessed in Copilot. ++## Why should you use Restricted SharePoint Search? ++Restricted SharePoint Search gives you time to review and audit site permissions. We provide Restricted SharePoint Search to help you maintain momentum with your Copilot deployment while you're implementing comprehensive data security with [SharePoint Advanced Management](/sharepoint/advanced-management), and [Microsoft Purview](/purview/ai-microsoft-purview). Combined, these solutions offer a complete solution for data discovery, protection, and governance, ensuring a secure and managed data lifecycle. ++Restricted SharePoint Search addresses oversharing concerns by allowing organizations to: ++- Prevent sites from showing up in organization-wide search results and Copilot experiences until your admins or site owners can check the permissions on the site content; +- Honor existing site permissions, and let site owners manage individual site permissions. ++If Restricted SharePoint Search is enabled, the customer's experience is impacted in the following ways: ++- Search results are limited to sites on the allowed list, usersΓÇÖ frequently visited sites, sites that users already have permissions to, and usersΓÇÖ recently accessed files. Turning on this feature impacts the overall search experience, even for non-Copilot users. +- Copilot has less information available to reference, which may impact its ability to provide accurate and comprehensive responses. ++Remember, whether you have enabled Restricted SharePoint Search, users in your organization are always able to interact with files and content they own or that they have previously accessed in Copilot . ++## How does Restricted SharePoint Search work? ++As the Global/Tenant and SharePoint administrator, you're able to: ++- Check the current status of Restricted SharePoint Search (enabled or disabled) +- Enable or disable Restricted SharePoint Search +- [Curate the allowed list](restricted-sharepoint-search-allowed-list.md) by identifying the top 100 widely used sites +- Add or remove sites from the allowed list by providing the site URL +- Get the full list of sites in the allowed list ++Restricted SharePoint Search is off by default. If you decide to enable it, Copilot and non-Copilot users are able to find and use content from: ++- An allowed list of curated SharePoint sites set up by admins (with *up to 100 SharePoint sites*), honoring sitesΓÇÖ existing permissions. +- Content from their frequently visited SharePoint sites. +- UsersΓÇÖ OneDrive files, chats, emails, calendars they have access to. +- Files that were shared directly with the users. +- Files that the users viewed, edited, or created. ++> [!NOTE] +> The limit of up to 100 SharePoint sites includes Hub sites, but not their sub-sites. When you enable Hub sites, the sub-sites under a Hub site are included in the allowed-list but do not count towards the 100-site limit. This approach allows for greater flexibility while still adhering to the existing constraints. When you are picking Hub sites, make sure all the child sites have proper permissions. ++The following diagram shows an example of an HR Hub site with eight sub-sites: + ++Among these eight sub-sites: ++- Five sub-sites Diversity and Inclusion, Education Credits, Talent Acquisition, Training, and Employee Benefits inherit the HR Hub site permission settings. These five sites have the same permissions the HR Hub site has. +- Two (HR Team site and Benefits site) are private Teams channel sites. Their corresponding Teams channel owners are sites owners in SharePoint and channel members are site members. +- One (Manager Portal) is restricted. Users not in a specified group can't access this site or its content, even if they have permissions to the HR Hub site. ++Let's consider Alex Wilber, a marketing specialist at Contoso Electronics. Before the organization uses Restricted SharePoint Search, Alex can see not only his own personal contents, like his OneDrive files, chats, emails, contents that he owns or visited, but also content from some sites that hasn't undergone access permission review or Access Control Lists (ACL) hygiene, and doesn't have data governance applied. For example, Contoso Electronics has a budgeting site with important business information. Most people don't know about this site, so the site owner hasn't set up proper permissions and hasn't followed correct data governance process. The site might be open to some users who are not allowed to see it, such as Alex. When Alex asks Copilot for some budgeting information, Copilot gets information from the budgeting site. ++The IT admin at Contoso Electronics uses Restricted SharePoint Search to limit what sites can be searched through the allowed list. They check SPAC and SPAC DAG reports and decide to exclude this budgeting site from the allowed list. After RSS is turned on, Alex can still access things that he owns or has recently visited, or that are directly shared with him, but he canΓÇÖt access any other sites, unless the site is in the allowed list and he has permission to it. When Alex asks Copilot the same question about budgeting now, Copilot wonΓÇÖt show them any information from that site. ++> [!NOTE] +> Site scoped searches arenΓÇÖt affected by this control. This control impacts [modern search](/microsoftsearch/get-started-search-in-sharepoint-online) and copilot experiences. ++## Frequently asked questions ++### Can I use RSS for creating a "deny list" instead? ++No, this capability isn't part of Restricted SharePoint Search. However, SharePoint Advanced Management offers a similar feature called [Restricted Access Control for SharePoint sites](/sharepoint/restricted-access-control). If your customer isn't ready to use SharePoint Advanced Management, then they can alternatively evaluate to disable the following setting in SharePoint. To learn more information, review [Allow this site to appear in Search results](/sharepoint/make-site-content-searchable#show-content-on-a-site-in-search-results). ++> [!NOTE] +> When you turn off ΓÇ£Allow this site to appear in Search resultsΓÇ¥, you block the site content from showing up in both the organization-wide search and the site specific search. ++### Does Restricted SharePoint Search impact other services that don't depend on SharePoint? For example, Exchange, To-do, Planner, Loop, etc.? ++Yes, any product where Enterprise Search is enabled and could have SharePoint content and/or files as search results will be impacted. ++### After enabling RSS how long does it take to take place? ++RSS will go into effect within an hour after it's enabled. ++### If I give the URL of a hub site, will it also include all of the child sites or sites associated hub sites with it? Do these other sites count towards the 100 sites in the allowed lists? ++Only the hub site (the URL in the Allowed list) is included in the 100. The sub sites under the hub site are not counted against the 100 limit but RSS is effective on the sub sites. ++## What to do next? ++After setting up Restricted SharePoint Search and enabling Microsoft Copilot for Microsoft 365 for your organization, you should evaluate the SharePoint sites [activities](/microsoft-365/admin/activity-reports/sharepoint-activity) and [usage](/microsoft-365/admin/activity-reports/sharepoint-site-usage) to adjust the allowed list. You can use [Microsoft SharePoint Admin Center](/sharepoint/advanced-management) and [Microsoft Purview](/purview/ai-microsoft-purview) to gradually increase the scope of search and Copilot experience for your organization. Restricted SharePoint Search honors existing site permissions, so you can work with site owners and admins to add [advanced access policies](/sharepoint/advanced-management#advanced-access-policies-for-secure-content-collaboration) and [advanced site content lifecycle management](/sharepoint/advanced-management#advanced-sites-content-lifecycle-management) for specific users and groups through Microsoft SharePoint Advanced Management. Moreover, Microsoft Purview enhances your organizationΓÇÖs data security and compliance for Copilot. |