How to Control Microsoft 365 Copilot Data Sources and Discovery

Official documentation checked October 14, 2026.

Microsoft 365 Copilot can use information available to the signed-in user, but there is no single administrator page with universal on/off switches for SharePoint, OneDrive, Exchange and Teams data. To control what Copilot can discover, first identify whether you need to change access permissions, reduce broad discovery, manage an external connector or control public web search.

This guide covers organizational Microsoft 365 Copilot. The personal Microsoft Copilot app and Copilot Studio agents have different configuration paths.

Choose the control that matches the problem

If a person must not read a document, fix that person’s access at the source. Copilot’s grounding is subject to the user’s permissions; it is not a replacement for a permissions review. Check direct sharing, group membership and sharing links on a representative item. A file being unexpectedly discoverable may reveal an existing oversharing problem. See Microsoft’s Copilot architecture.

• Overexposed SharePoint site: review permissions and, where appropriate, temporarily restrict broad discovery while remediation proceeds.
• External business repository: review its connector, source access rules and Copilot visibility.
• Public internet results: review web-search policy, separately from work-data access.
• A focused departmental assistant: assess an agent with the intended knowledge sources. Do not describe that agent’s configuration as changing every user’s general Copilot experience.

Record the intended outcome before changing anything. “Do not suggest this site across the organization” and “revoke access to this confidential file” require different tests.

Restrict broad discovery of a SharePoint site

For eligible organizations, SharePoint Restricted Content Discovery offers a site-level discovery restriction. Check the current Copilot and SharePoint Advanced Management prerequisites and administrator permissions in Microsoft’s Restricted Content Discovery guidance.

1. Open the SharePoint admin center and go to Sites > Active sites.
2. Select the site, open Settings, and locate Restrict content from Microsoft Copilot.
3. Turn the restriction on, save it and record the site URL and change time.
4. Retest broad discovery after the change has propagated. Larger sites can take substantially longer; do not assume a fixed 15-minute interval.

This is not an access revocation. It does not replace permissions, remove the content from the search index or cover OneDrive. Site-context search and Copilot working with a document that a user has opened are important exceptions. Continue fixing excessive sharing rather than treating reduced discovery as a confidentiality guarantee.

Manage external connector exposure separately

For a supported partner connection, Microsoft’s documented path is Copilot > Connectors > Your connections in the Microsoft 365 admin center. Select the connection, review its Copilot visibility setting and save the intended value. Use the appropriate administrative role and the connector provider’s instructions.

Turning this visibility off excludes that connection from Copilot Search and Chat, but it can continue crawling. The switch does not control declarative agents and their data. Review those agents separately. Likewise, pausing a connector is not the same as removing already indexed information: existing content can remain searchable when a connection is paused or failed. These distinctions are documented in Manage your connections.

Before rollout, compare an authorized test user with a user who must not see the external content. A successful connection or a plausible answer proves neither correct access control nor complete indexing.

Verify results without assuming instant refresh

Keep a short test record: affected account, application, source URL, exact question, returned citation and time. Reopen the cited source as the affected user to distinguish a permission problem from a discovery or indexing problem. Do not use an administrator account as the only security test.

For internet grounding, use the separately documented Allow web search in Copilot policy. Disabling web search does not revoke access to work files.

If results remain unexpected, inspect the relevant service’s status and configuration rather than repeatedly signing out or running unrelated Teams commands. Sign-out is not a guaranteed way to force tenant policy propagation. Change one scoped control at a time, retain the previous setting, and validate the precise outcome you intended.