Use PowerShell scripts for restricted SharePoint Search

Restricted SharePoint Search is designed for customers of Microsoft 365 Copilot chat and agentic experiences. It's designed as a short-term solution to allow time for your organization's administrators to thoroughly review and audit site and file permissions, but it's not intended or scalable for long-term use. Comprehensive data security solutions are available, including SharePoint Advanced Management and Microsoft Purview.

How to enable and manage restricted SharePoint Search by using PowerShell scripts

By default, Restricted SharePoint Search isn't enabled. To enable and set up restricted SharePoint Search, you need to have at least the permissions of a SharePoint Administrator in Microsoft 365. Depending on the scenario, some actions you need to take are:

• Get the current mode of restricted Search
• Enable and disable restricted Search
• Add sites to the allowed list by providing URL
• Remove sites from the allowed list by providing URL
• Get the existing list of URLs that are added in allow list

This article covers how to use admin scripts in PowerShell for these actions.

Before you begin

You must be a SharePoint Administrator or have equivalent permissions in Microsoft 365 to run the PowerShell admin scripts.

See Prerequisites for SharePoint Advanced Management.

Before you use the PowerShell scripts in this article, see SharePoint Online PowerShell module requirements.

Get the current mode of Restricted SharePoint Search

Restricted SharePoint Search is disabled by default. To verify this feature's current mode, you can run the following command:

Get-SPOTenantRestrictedSearchMode

Module: Microsoft.Online.SharePoint.PowerShell

Applies to: SharePoint Online

Syntax

Get-SPOTenantRestrictedSearchMode

Example

Get-SPOTenantRestrictedSearchMode

This example lets the admin get the existing allowed list in the tenant. Result can be "Enabled" or "Disabled" based on the current setting.

Enable or disable Restricted Search

Enable or disable the Restricted Search setting. The default is disabled. The first time you enable the setting, the allow list is empty. To enable or disable the Restricted SharePoint Search, run this command:

Set-SPOTenantRestrictedSearchMode

Module: Microsoft.Online.SharePoint.PowerShell

Applies to: SharePoint Online

Syntax

Set-SPOTenantRestrictedSearchMode 
[-Mode] {Disabled | Enabled}
 [<CommonParameters>]

Example 1

Set-SPOTenantRestrictedSearchMode -Mode Enabled  

Example 1 sets or enables the Restricted Tenant Search mode for the tenant.

Example 2

Set-SPOTenantRestrictedSearchMode – Mode Disabled  

Example 2 disables the Restricted Tenant Search mode for the tenant.

Parameters

-Mode

Sets the mode for the Restricted Tenant Search.

Add sites to the allow list

When you enable Restricted SharePoint Search, add site URLs to the allow list in a string or CSV file by using this command:

Add-SPOTenantRestrictedSearchAllowedList

Module: Microsoft.Online.SharePoint.PowerShell

Applies to: SharePoint Online

Syntax

Add-SPOTenantRestrictedSearchAllowedList -SitesList <List[string]> [<CommonParameters>]

Add-SPOTenantRestrictedSearchAllowedList -SitesListFileUrl <string> [-ContainsHeader <bool>]  
 [<CommonParameters>]

Example 1

Add-SPOTenantRestrictedSearchAllowedList -SitesList @("[https://contoso.sharepoint.com/sites/Marketing](https://contoso.sharepoint.com/sites/Marketing)", "[https://contoso.sharepoint.com/sites/Benefits](https://contoso.sharepoint.com/sites/Benefits)")

This example shows the admin how to add the sites to the allow list.

Example 2

Add-SPOTenantRestrictedSearchAllowedList  -SitesListFileUrl C:\Users\admin\Downloads\UrlList.csv

This example shows the admin how to add the sites to the allow list by providing a CSV file. Add the list of site URLs in the URL column.

Parameters

-SitesList

Site list for allow list.

-SitesListFileURL

File that has list of site URLs that you can add to an allow list when the tenant is set to Restricted Tenant Search Mode.

Remove sites from the allow list

Remove sites from the allow list by providing the site URL in a string or CSV file by using the following PowerShell command:

Remove-SPOTenantRestrictedSearchAllowedList

Module: Microsoft.Online.SharePoint.PowerShell

Applies to: SharePoint Online

Syntax

Remove-SPOTenantRestrictedSearchAllowedList -SitesList <List[string]> [<CommonParameters>]

Remove-SPOTenantRestrictedSearchAllowedList -SitesListFileUrl <string> [-ContainsHeader <bool>]
 [<CommonParameters>]

Example 1

Remove-SPOTenantRestrictedSearchAllowedList -SitesList @("[https://contoso.sharepoint.com/sites/Marketing](https://contoso.sharepoint.com/sites/Marketing)", "[https://contoso.sharepoint.com/sites/HR](https://contoso.sharepoint.com/sites/HR)")

Example 1 shows how the admin removes the sites from the allow list.

Example 2

Remove-SPOTenantRestrictedSearchAllowedList -SitesListFileUrl C:\Users\admin\Downloads\UrlList.csv

Example 2 shows how the admin adds the sites to the allow list by providing a CSV file.

Parameters

-SitesList

Site list that you want to remove from the allow list.

-SitesListFileURL

File that has list of sites that you can remove from an allow list when the tenant is set to Restricted Tenant Search Mode.

Get the existing list of URLs in the allow list

To get the existing list of URLs in the allow list, run the following PowerShell command:

Get-SPOTenantRestrictedSearchAllowedList

Module: Microsoft.Online.SharePoint.PowerShell

Applies to: SharePoint Online

Syntax

Get-SPOTenantRestrictedSearchAllowedList

Example

Get-SPOTenantRestrictedSearchAllowedList

This example shows how the admin gets the existing allow list in the tenant.