A SharePoint Advanced Management policy that only lets people in chosen Microsoft 365 or security groups into a particular SharePoint site or OneDrive, overriding permissions or links they held before. Search and Copilot respect the restriction.
Also called restricted site access control, site access restriction.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Restricted access control in context, with comparison tables and the common traps.
Terms in this definition
- SharePoint Advanced Management
An add-on for SharePoint governance, bundled with Microsoft 365 Copilot, that helps detect and cut oversharing via site access reviews, restricted content discovery, restricted access control and data access governance reports.
- Exclusions
Scopes taken out of a policy assignment; they can only narrow its coverage, never widen it.
- Microsoft 365
Formerly Office 365, Microsoft's software-as-a-service productivity suite. A Microsoft Entra tenant provides its identity, and its data is not governed by Azure RBAC.
- AMPRS
An acronym for availability, manageability, performance, recoverability and security: the five design qualities used to sort non-functional requirements and to weigh up trade-offs between design decisions.
- LSDOU
The sequence in which Group Policy is processed: the local policy first, followed by site, domain and organisational unit policies. The nearest, last-processed setting takes effect unless Enforced or Block Inheritance alters that.
- OneDrive
Every licensed Microsoft 365 user is given private cloud storage here for work files, which sync across their devices. Data for a department or the whole organisation belongs in SharePoint, not here.
- AGDLP
Nesting pattern: users go into global groups, which go into domain local groups, which receive the permissions. AGUDLP adds universal groups for forests with several domains.