Restrict SharePoint Access with Entra Groups

SharePoint permissions determine which users can access a site, library, folder, or file. However, environments with complex permissions, shared links, and years of collaboration can sometimes end up with broader access than originally intended.

SharePoint Restricted Access Control (RAC) provides an additional security boundary by limiting access to users who are members of specified Microsoft Entra security groups or Microsoft 365 groups.

Users who aren’t members of an approved group cannot access the protected SharePoint site or its content, even if they previously had permissions or received a sharing link.

This can be especially useful for sensitive SharePoint sites containing information for departments such as:

Finance
Human Resources
Legal
Executive Leadership
Security
Mergers and Acquisitions
Sensitive Projects

How Restricted Access Control Works

Restricted Access Control acts as an additional authorization check on top of existing SharePoint permissions.

For example, assume a user already has Read permission to a Finance SharePoint site.

You then configure Restricted Access Control using an Entra security group named:

SG-SharePoint-Finance-Allowed

If the user isn’t a member of that group, the user will no longer be able to access the site.

For access to succeed, both conditions must be true:

1. The user has SharePoint permission to the site or content.

2. The user belongs to one of the groups configured in the Restricted Access Control policy.

Adding a user to the Restricted Access Control group does not automatically give the user SharePoint permissions. The group acts as an additional access boundary rather than replacing the existing SharePoint permissions model.

Requirements

Restricted Access Control is part of SharePoint Advanced Management.

Organizations must meet Microsoft’s SharePoint Advanced Management licensing requirements. Microsoft currently makes SharePoint Advanced Management capabilities available through qualifying Microsoft 365 environments with either Microsoft Copilot licensing, the SharePoint Advanced Management Plan 1 add-on, or other qualifying subscriptions such as Microsoft 365 E7.

Administrative access requires an appropriate role such as:

SharePoint Administrator
SharePoint Advanced Management Administrator

The latest SharePoint Online Management Shell should also be installed if PowerShell will be used.

Create an Entra Security Group

Before configuring the SharePoint site, create or identify the Microsoft Entra security group that will contain the users who should be allowed to access it.

From the Microsoft Entra Admin Center, navigate to:

Entra ID → Groups → All groups

Select: New group

Create a security group such as: SG-SharePoint-Finance-Allowed

Add the users who should be permitted to access the protected SharePoint site.

Restricted Access Control also supports dynamic Microsoft Entra security groups, which can be useful when group membership should be based on user attributes such as department or another directory property.

For example, an organization could dynamically populate a security group based on users whose department is Finance and then use that group as the Restricted Access Control group for a Finance SharePoint site.

Enable Restricted Access Control

Restricted Access Control must first be enabled at the tenant level before it can be configured for individual SharePoint sites.

Open the SharePoint Admin Center.

Navigate to: Policies → Access control

Select: Site-level access restriction

Enable: Allow access restriction

Select Save.

Microsoft notes that it may take up to one hour for the configuration to take effect.

Enable Restricted Access Control with PowerShell

The feature can also be enabled using the SharePoint Online Management Shell.

Run:

Set-SPOTenant -EnableRestrictedAccessControl $true

To verify the tenant configuration:

Get-SPOTenant | Select EnableRestrictedAccessControl

Restrict Access to a SharePoint Site

Once Restricted Access Control is enabled for the organization, select the SharePoint site you want to protect.

From the SharePoint Admin Center, navigate to: Sites → Active sites

Select the desired SharePoint site.

Open the: Settings tab.

Locate: Restricted site access and select Edit.

Enable: Restrict SharePoint site access to only users in specified groups

Search for and select the Microsoft Entra security group or Microsoft 365 group that should be allowed access.

For example: SG-SharePoint-Finance-Allowed

Select Save.

SharePoint supports up to 10 Microsoft Entra security groups or Microsoft 365 groups per site for Restricted Access Control.

Configure Restricted Access Control with PowerShell

Restricted Access Control can also be configured using the SharePoint Online Management Shell.

First, enable Restricted Access Control for the site:

Set-SPOSite `
 -Identity https://YourTenantName.sharepoint.com/sites/Finance `
 -RestrictedAccessControl $true

Next, add the Entra security group.

The command requires the Object ID / GUID of the Entra security group.

Set-SPOSite `
 -Identity https://YourTenantName.sharepoint.com/sites/Finance `
 -AddRestrictedAccessControlGroups "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

Replace the GUID with the Object ID of your Entra security group.

Multiple groups can also be specified.

View the Current Restricted Access Groups

To verify the configuration:

Get-SPOSite `
 -Identity https://YourTenantName.sharepoint.com/sites/Finance |
 Select RestrictedAccessControl,RestrictedAccessControlGroups

This displays whether Restricted Access Control is enabled and which groups are currently assigned to the site.

Add Another Security Group

Additional Entra security groups can be added without replacing the existing groups.

Use:

Set-SPOSite `
 -Identity https://YourTenantName.sharepoint.com/sites/Finance `
 -AddRestrictedAccessControlGroups "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

Up to 10 Microsoft Entra security groups or Microsoft 365 groups can be associated with a site.

Remove a Security Group

To remove a group from the site’s Restricted Access Control policy:

Set-SPOSite `
 -Identity https://YourTenantName.sharepoint.com/sites/Finance `
 -RemoveRestrictedAccessControlGroups "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

Be careful when removing groups because users relying on that group for Restricted Access Control authorization may immediately lose access to the site.

Remove Restricted Access Control

If the additional access restriction is no longer required, reset the configuration using:

Set-SPOSite `
 -Identity https://YourTenantName.sharepoint.com/sites/Finance `
 -ClearRestrictedAccessControl

This removes the Restricted Access Control configuration from the site.

Normal SharePoint permissions continue to determine access after the restriction is removed.

Test the Configuration

Restricted Access Control should be tested with at least two accounts.

Test User 1: Authorized User

The first user should:

Have SharePoint permission to the site
Be a member of the configured Entra security group

This user should successfully access the SharePoint site.

Test User 2: Unauthorized User

The second user should:

Have SharePoint permission to the site
Not be a member of the configured Entra security group

Even though the second user has SharePoint permission, Restricted Access Control should prevent the user from accessing the site.

This test demonstrates the security benefit of Restricted Access Control.

Existing SharePoint permissions alone are no longer sufficient to access the protected site.

Microsoft 365 Group-Connected Sites

Restricted Access Control can also be applied to SharePoint sites connected to Microsoft 365 Groups and Microsoft Teams.

For Microsoft 365 Group-connected sites, the Microsoft 365 Group associated with the site is automatically presented as the default Restricted Access Control group.

Administrators can keep the connected Microsoft 365 Group and add additional Entra security groups or Microsoft 365 groups if required.

Teams Private and Shared Channels

Be careful when applying Restricted Access Control to SharePoint sites associated with Microsoft Teams.

Standard Teams channels store their files within the primary SharePoint site associated with the Team.

However, private and shared channels use separate SharePoint site collections.

A Restricted Access Control policy applied to the main Team-connected SharePoint site does not automatically apply to private or shared channel sites. Those sites must be configured separately.

This is an important consideration when using Restricted Access Control as a security boundary for Teams-based collaboration.

Restrict Sharing Outside the Approved Groups

By default, Restricted Access Control prevents unauthorized users from accessing protected content, but SharePoint sharing behavior can still allow users to attempt to share content outside the Restricted Access Control groups.

Administrators can optionally restrict sharing so content can only be shared with users and groups permitted by the Restricted Access Control configuration.

Run:

Set-SPOTenant -AllowSharingOutsideRestrictedAccessControlGroups $false

With this setting configured, SharePoint prevents sharing with users who aren’t members of the approved Restricted Access Control groups.

For highly sensitive sites, this provides an additional layer of protection against accidental oversharing.

Search and Microsoft Copilot

Restricted Access Control is also honored by organization-wide Microsoft search and Microsoft Copilot experiences.

Users denied access by the policy cannot view protected content from the site through those experiences.

This makes Restricted Access Control particularly useful when preparing SharePoint environments for Microsoft 365 Copilot.

Without appropriate governance, older SharePoint permissions and broadly shared sites can expose more organizational content through search and AI-assisted experiences than administrators initially expect.

Restricted Access Control allows administrators to establish a stronger identity-based boundary around sensitive sites.

Changes may take some time to fully propagate through search and Copilot indexes, particularly for sites containing a large amount of content.

Audit Restricted Access Control Changes

Restricted Access Control configuration changes are recorded in the Microsoft Purview audit log.

Microsoft currently records events for activities including:

Applying site access restrictions
Removing site access restrictions
Changing Restricted Access Control groups
Justifications submitted by site administrators when delegated administration is enabled

These audit events can help security and compliance teams identify when access boundaries were modified and by whom.

Using Dynamic Entra Groups

One of the more powerful ways to use Restricted Access Control is with dynamic Microsoft Entra security groups.

For example, consider a SharePoint site containing Finance department information.

Instead of manually maintaining a group such as:

SG-SharePoint-Finance-Allowed

an organization could potentially use a dynamic group whose membership is based on an Entra user attribute.

Conceptually: Department = Finance

When users join or leave the Finance department and their Entra attributes are updated, membership in the security group can change automatically.

SharePoint Restricted Access Control supports dynamic Microsoft Entra security groups as control groups.

This can reduce manual access administration and align SharePoint access more closely with identity lifecycle processes.

Recommended Approach

For sensitive SharePoint sites, consider creating dedicated Entra security groups specifically for access control.

For example:

SG-SharePoint-HR-Allowed

SG-SharePoint-Finance-Allowed

SG-SharePoint-Legal-Allowed

SG-SharePoint-Executive-Allowed

The Restricted Access Control group should represent the population that is permitted to access the site.

Continue managing the actual SharePoint permissions separately.

This maintains two distinct controls:

SharePoint permissions

Determine what an authorized user can do.

Restricted Access Control

Determines whether the user is allowed through the site’s identity-based access boundary in the first place.

Summary

SharePoint Restricted Access Control provides an additional security boundary for sensitive SharePoint sites by integrating site access with Microsoft Entra identity groups.

A user must have:

Existing permission to the SharePoint content.
Membership in one of the approved Restricted Access Control groups.

Having only one of these conditions isn’t sufficient.

Restricted Access Control can be configured using:

Microsoft Entra security groups
Dynamic Entra security groups
Microsoft 365 groups

Administrators can assign up to 10 groups to each protected site.

For organizations with sensitive SharePoint content, Restricted Access Control provides a useful additional layer of identity-based security and can help reduce the impact of stale permissions, inappropriate sharing, and oversharing.