Organizations using Restricted Access Control (RAC) for SharePoint Online and OneDrive will soon benefit from a more consistent security experience. Microsoft is extending RAC enforcement beyond site access to Microsoft 365 Search, ensuring that users can only discover content they are authorized to access.
Beginning in late July 2026, this change will be applied automatically to both existing and newly configured RAC-enabled SharePoint sites and OneDrive accounts. No configuration changes are required. However, administrators should understand how this update affects content discoverability across Microsoft 365 search experiences.
What is SharePoint Restricted Access Control (RAC)?
Restricted Access Control (RAC) is designed to provide an additional security boundary for SharePoint sites and OneDrive accounts that contain highly sensitive or regulated information.
While SharePoint permissions determine whether a user can access a site or document, RAC adds another layer of protection by restricting an entire SharePoint site or OneDrive account to members of designated Microsoft Entra security groups or Microsoft 365 groups. Users outside these groups cannot access the protected content, regardless of any broader organizational permissions they may have.
Organizations commonly implement RAC for workloads such as, executive leadership portals, human Resources and payroll documentation, finance, and budgeting sites, legal and compliance repositories, merger and acquisition workspaces, research and intellectual property projects
These environments often require stricter access controls than those provided by standard SharePoint permissions.
How Microsoft 365 Search Will Enforce SharePoint RAC
With this update, Microsoft is extending RAC enforcement to Microsoft 365 Search.
After the rollout, search experiences across Microsoft 365—including SharePoint Search, organization-wide Microsoft 365 Search, and Microsoft 365 experiences such as Office.com—will evaluate RAC policies before returning search results.
If a user is not a member of the security group permitted by a site’s RAC policy, content from that SharePoint site or OneDrive account will no longer appear in their search results.
This behavior applies to:
- Existing RAC-enabled SharePoint sites
- Existing RAC-enabled OneDrive accounts
- All newly configured RAC-enabled locations
The change is delivered automatically as a service update and does not require administrators to modify existing RAC configurations.
Why SharePoint RAC Enforcement in Microsoft 365 Search
Search plays a critical role in how users discover information across Microsoft 365. While controlling access to content is essential, controlling whether that content is discoverable is equally important for protecting sensitive information.
Consider a finance team managing documents related to a confidential acquisition. Without search-level enforcement, users outside the authorized group could potentially discover references to those documents through search, even if they were ultimately prevented from opening them. Although the content remained protected, its visibility could reveal information that organizations intended to keep confidential.
By enforcing RAC during the search process, Microsoft ensures that protected content is filtered before search results are presented. This reduces unnecessary exposure to sensitive information and aligns content discovery with existing access controls.
How RAC Improves Microsoft 365 Search Security
A key benefit of this update is the consistency it brings to Microsoft 365’s security model.
Previously, organizations relied on RAC to protect access to SharePoint sites and OneDrive accounts, while search experiences followed existing indexing and permission evaluation processes. Extending RAC enforcement to Microsoft 365 Search eliminates this inconsistency by applying the same access policies during content discovery.
After the rollout, users will only see search results for content they are authorized to discover, regardless of whether they are searching from:
- SharePoint Online
- Microsoft 365 Search
- Office.com
- Other Microsoft 365 experiences powered by Microsoft Search
For end users, this reduces confusion caused by inaccessible search results. For administrators, it ensures that search visibility accurately reflects the organization’s access control policies.
How to Prepare for SharePoint RAC Search Enforcement
Microsoft plans to begin rolling out this update in late July 2026 for Worldwide, GCC High, and DoD environments. As this is a service-side update, it will be enabled automatically without requiring tenant-level configuration changes.
Organizations should use this opportunity to review their existing RAC deployments before the update reaches their tenant.
- Validate Group Memberships: Search visibility will now depend directly on RAC group membership. Verify that Microsoft Entra security groups and Microsoft 365 groups accurately represent users who require access to protected SharePoint sites and OneDrive accounts.
- Review Protected Sites: Confirm that RAC is enabled only on sites and OneDrive accounts that require additional protection. Since search will now honor these policies, any incorrectly configured RAC assignment could unintentionally prevent legitimate users from discovering business-critical content.
When troubleshooting search visibility, administrators should first verify RAC group membership before investigating Microsoft Search health or indexing status.
For organizations using RAC to secure executive, legal, financial, or other regulated workloads, this enhancement delivers stronger protection, more predictable search behavior, and a more consistent security experience across Microsoft 365.
