Control 1.4: Semantic Index Governance and Scope Control
Control ID: 1.4 Pillar: Readiness & Assessment Regulatory Reference: GLBA §501(b), FFIEC IT Handbook (Information Security Booklet), Sarbanes-Oxley §§302/404 — where applicable to ICFR Last Verified: 2026-07-26 Governance Levels: Baseline / Recommended / Regulated
Objective
Understand and govern the scope of the Microsoft 365 Semantic Index, which underpins Copilot's ability to ground responses in organizational content. This control helps organizations comprehend what the Semantic Index indexes across M365 workloads, how it interacts with Microsoft Graph to provide Copilot with contextual understanding, and what governance levers are available to control indexing scope. Proper Semantic Index governance supports compliance with data protection requirements by providing visibility into the content pipeline that feeds Copilot's AI capabilities.
Why This Matters for FSI
- GLBA §501(b): Understanding which customer data is processed by the Semantic Index is essential for maintaining safeguards over non-public personal information. The Semantic Index creates derived representations of content that must be governed alongside the source data.
- FFIEC IT Handbook (Information Security): Risk assessment for new technology deployments must include understanding the technology's data processing pipeline. The Semantic Index is a core component of Copilot's data processing architecture.
- Sarbanes-Oxley §§302/404 — where applicable to ICFR: Financial reporting data processed by the Semantic Index could be surfaced by Copilot in contexts outside normal financial controls. Understanding indexing scope supports internal control integrity where AI tools affect financial reporting processes.
- SEC Regulation S-P: The Semantic Index processes content that may include consumer financial information subject to privacy safeguards. Governance of indexing scope supports these safeguards.
- SR 11-7 / OCC Bulletin 2011-12 (Model Risk Management): The Semantic Index transforms raw content into vector embeddings that influence Copilot's responses. While not a traditional model, understanding this transformation pipeline aligns with model risk management principles.
Control Description
What Is the Semantic Index?
The Microsoft 365 Semantic Index is a content processing layer that enhances Microsoft Graph by creating vector embeddings (mathematical representations) of organizational content. These embeddings enable Copilot to understand content semantically rather than relying solely on keyword matching.
| Component | Role | Data Flow |
|---|---|---|
| Microsoft Graph | Provides structured access to M365 data (files, emails, chats, meetings) | Source of raw content and metadata |
| Semantic Index | Creates vector embeddings of Graph content for semantic understanding | Processes Graph content into searchable embeddings |
| Copilot Orchestrator | Combines user prompt with Semantic Index results and LLM capabilities | Retrieves relevant content via Semantic Index, sends to LLM for response generation |
| LLM (Large Language Model) | Generates responses grounded in retrieved content | Receives content context from orchestrator, produces response |
What Gets Indexed
Microsoft generates the semantic index at two levels. The tenant-level index is organization-wide and is generated from text-based SharePoint Online files. The user-level index covers a working set of content for users with a paid Microsoft 365 Copilot license and includes their own mailbox content. Indexing is enabled automatically by Microsoft and requires no administrative action.
Microsoft documents the following supported content and file types:
| Content / file type | User-level index | Tenant-level index |
|---|---|---|
| User mailbox | Supported | Not applicable |
| Delegated mailbox | Not supported | Not applicable |
| Shared mailbox | Not supported | Not applicable |
| Archived mailbox data | Not supported | Not applicable |
| Archived SharePoint data | Not supported | Not supported |
| Word documents (doc/docx) | Supported | Supported |
| PowerPoint (pptx) | Supported | Supported |
| PDF files | Supported | Supported |
| Web pages (aspx) | Supported | Supported |
| OneNote files (one) | Supported | Supported |
| Copilot connector data | Not applicable | Supported |
Microsoft supports files up to 512 MB for the PDF, PPTX, and DOCX file types, and states that more file types are added over time. Organizations should re-check the supported content type list in Microsoft documentation at each governance review rather than treating the table above as fixed.
Scope boundary that matters for governance: semantic indexing is one grounding input, not the entire grounding surface. Copilot also grounds responses on Microsoft Graph content the user has permission to access — for example emails, chats, and documents — which is retrieved through Microsoft Graph and governed by Graph permissions, workload controls, and retention rather than by the semantic index content-type list above. Governance documentation should describe the two paths separately so that scope statements remain accurate.
Content location also determines index eligibility. The tenant-level index is generated from SharePoint Online files, and the SharePoint Online site must remain searchable for its content to be indexed. New documents added to SharePoint Online sites that are accessible (via site inheritance) by two or more users are indexed daily, documents created by users are indexed in near real time in the user's mailbox, and updates to already-indexed documents are indexed immediately.
How Semantic Index Respects Permissions
The Semantic Index does not create a separate permission model. Access to indexed content follows the same Microsoft Graph permissions that govern direct access:
| Principle | Implementation |
|---|---|
| User-scoped access | Copilot queries the Semantic Index in the context of the calling user's permissions |
| No privilege escalation | The Semantic Index does not grant access to content the user cannot already access via Graph |
| Real-time permission evaluation | Permission checks occur at query time, not at indexing time, so permission changes take effect without re-indexing (propagation timing may vary by workload) |
| Tenant boundary | Semantic Index content is isolated per tenant with no cross-tenant access |
Governance Implications
| Governance Concern | Implication | Mitigation |
|---|---|---|
| Indexing scope is broad by default | All search-indexed SharePoint Online content is available to the tenant-level index | Use Restricted Content Discovery (RCD) to exclude specific sites from Copilot discovery; turn off site-level search indexing for content that should leave the index entirely; note that the semantic index does not expose per-item admin controls — scope governance operates at the site, workload, and policy level |
| Semantic indexing cannot be turned off | Microsoft describes semantic indexing as an improvement to Microsoft 365 Search that is enabled automatically and cannot be disabled | Govern scope through site searchability, RCD, DLP, and licensing rather than through an index on/off switch |
| Embeddings are derived data | Vector embeddings are mathematical representations of content, not copies, but they enable content retrieval | Treat embedding governance as an extension of source content governance |
| Cross-workload synthesis | Copilot can combine information retrieved from the semantic index with Microsoft Graph content across workloads | Monitor via Microsoft Purview DSPM for AI (Activity explorer) for unexpected cross-workload data surfacing |
| Indexing and propagation latency | New SharePoint Online documents accessible by two or more users are indexed daily; user-created documents are indexed in near real time in the user's mailbox; updates to already-indexed documents are indexed immediately. Scope-control settings such as RCD propagate separately and can take longer | Factor both indexing latency and control-propagation latency into content lifecycle governance |
| No selective user-level indexing opt-out | Administrators cannot exclude specific users' content from the semantic index while keeping Copilot enabled for those users | Use workload-level controls and Copilot license assignment to manage scope |
Controlling What Gets Indexed
While the semantic index does not offer granular per-item indexing controls, several governance levers affect what content enters the index or is retrievable from it:
| Control Lever | Mechanism | Scope |
|---|---|---|
| SharePoint site search indexing | Sites excluded from SharePoint search are also excluded from the semantic index. Set at Site settings > Search and offline availability > Indexing Site Content > Allow this site to appear in Search results = No. Microsoft states there is no option to exclude a site from Microsoft Search only or from semantic indexing only — the setting applies to both | Per-site |
| Restricted Content Discovery (RCD) | Excludes site content from organization-wide search and Copilot experiences while leaving permissions and direct access unchanged. Does not remove content from the Microsoft 365 search index. Requires SharePoint Advanced Management and a Microsoft 365 Copilot license; not supported for OneDrive sites | Per-site via SAM |
| Restricted SharePoint Search (RSS) | Limits Copilot grounding and organization-wide search to an allow-list of up to 100 SharePoint sites (does not prevent indexing, but limits retrieval). Retiring — Microsoft blocks new enablement starting July 31, 2026 and directs organizations to RCD instead | Tenant-wide, up to 100 sites |
| Copilot license assignment | The tenant-level index is generated for every Microsoft 365 Copilot customer; the user-level index is generated for users with a paid Microsoft 365 Copilot license. Users without a Copilot license do not query the semantic index, though their content may still be indexed at the tenant level | Per-user |
| Sensitivity labels + DLP | Microsoft Purview DLP policies can be used to exclude content from semantic indexing, including exclusions based on sensitivity label | Per-label |
| Information barriers | Segment-based restrictions filter SharePoint search results, so content outside a user's segment is not surfaced | Per-segment |
Organizations still using RSS should plan the migration to RCD and to Microsoft Purview data security controls before the RSS retirement milestone, and should verify the current retirement timeline in Microsoft documentation. See Control 1.3 for RSS configuration detail.
Metadata-Aware Query Readiness
The semantic index supports metadata-aware scoped queries at the library and folder level. When a user attaches a SharePoint document library or folder — or provides its URL — in a Copilot prompt, Copilot can use that library's column metadata as additional signals alongside file content to constrain and rank grounding results. Microsoft documents this metadata understanding for queries scoped to a specific library or folder, available on the web experience, and requires that the site or library remains searchable so that both content and column metadata are available. Organizations should assess metadata readiness as a governance lever:
| Readiness Dimension | What to Assess | Copilot Impact |
|---|---|---|
| Column/metadata population | Are SharePoint library columns (document type, department, status, classification) consistently populated across in-scope sites? | Column metadata acts as an additional relevance signal when a user scopes a query to that library or folder; empty columns reduce retrieval precision |
| Content type adoption | Are SharePoint content types used to classify documents within libraries? | Content types produce structured column metadata that can inform scoped retrieval — libraries using only the default Document content type miss this governance lever |
| Managed metadata (term store) | Is the tenant term store configured with a consistent taxonomy for key business domains? | Consistent taxonomy produces consistent column values across sites, improving the quality of the metadata signals available during scoped retrieval |
| Folder structure conventions | Do libraries use a consistent folder hierarchy with meaningful naming? | Copilot can scope retrieval to folder paths, but inconsistent or deeply nested structures reduce the effectiveness of folder-based scoping |
| Default column values | Are default column values configured at the library or folder level to support auto-classification? | Default values reduce the burden on content authors and improve metadata completeness, which in turn improves Copilot retrieval precision |
Assessment steps:
- Identify the top 20 SharePoint sites in Copilot scope by usage volume
- For each site, audit metadata population rates for key columns (target: ≥80% population for governance-relevant columns)
- Review content type usage — sites relying solely on the default Document content type should be prioritized for content type deployment
- Verify term store taxonomy covers the institution's primary business domains and regulatory categories
- Document metadata readiness gaps in the Copilot governance assessment and include in the remediation roadmap (see Control 1.8 for the full information architecture review)
Authoritative Content Management for Copilot Search
Administrators can designate SharePoint sites as authoritative sites so that Copilot Search experiences recognize their content as trusted. Content from authoritative sites carries visual signals such as the From your organization label, helping users identify official, organization-managed sources.
Configuration surface: Microsoft documents authoritative site designation through PowerShell and CSOM APIs in the current release. Using SharePoint Online Management Shell:
Connect-SPOService -Url "https://<tenant>-admin.sharepoint.com"
Set-SPOSite -Identity "https://<tenant>.sharepoint.com/sites/<siteName>" -IsAuthoritative $true
CSOM methods (GetAuthoritativeResources, SetResourceAsAuthoritative, RemoveResourceAsAuthoritative, and their bulk equivalents) support automation and bulk operations. Authoritative sites require the SharePoint Advanced Management prerequisites and a Microsoft 365 Copilot license.
| Capability | Description | Documented limit |
|---|---|---|
| Authoritative sites | SharePoint sites designated as trusted, organization-managed sources for Copilot Search | Up to 100 sites; site-level designation only; personal sites not supported; changes can take up to 72 hours to appear; multi-geo tenants manage authoritative site data per geo |
| Bookmarks | Admin-defined answers that surface prominently for specific search queries | Managed from M365 Admin Center > Copilot > Search > Bookmarks (Copilot Search admin experience), or from the Microsoft Search Search & intelligence answers experience — configuration is shared between the two |
| Acronyms | Organization-specific acronym definitions surfaced by Copilot Search and Microsoft Search | Managed from M365 Admin Center > Copilot > Search > Acronyms, with Published, Draft, and Excluded states and CSV bulk import |
FSI relevance:
- Policy documents: Designate SharePoint sites hosting compliance policies, written supervisory procedures, and regulatory guidance as authoritative so that Copilot Search signals official firm positions over informal content
- Approved product materials: Mark sites containing approved marketing materials, product disclosures, and client-facing templates as authoritative to reduce the risk of Copilot surfacing draft or unapproved content
- Regulatory guidance: Designate sites hosting internal regulatory interpretations and examination preparation materials as authoritative sources
- Bookmarks: Create bookmarks for frequently asked compliance or operational questions so Copilot Search and Microsoft Search return the approved answer consistently
- Acronyms: Define firm-specific and industry acronyms (e.g., MNPI, NPI, WSP, CRD) to help Copilot interpret user prompts accurately
Organizations should review and update authoritative site designations, bookmarks, and acronyms at least quarterly to reflect changes in content governance and organizational priorities, and should validate authoritative site behavior after site deletion or restore events. Because designation changes can take up to 72 hours to propagate, reviews should allow for propagation time before conclusions are drawn about effectiveness.
Copilot Surface Coverage
| Copilot Surface | Grounding Dependency (Semantic Index + Microsoft Graph) | Governance Focus |
|---|---|---|
| Microsoft 365 Copilot Chat | Primary | Full cross-workload grounding -- broadest governance scope |
| Word / Excel / PowerPoint | High | Document-level semantic search for reference and drafting |
| Outlook | High | Email semantic search for summarization and drafting |
| Teams | High | Chat and meeting content semantic search |
| SharePoint | High | Site-scoped semantic search for content discovery |
| OneDrive | Medium | Personal content semantic search |
| Loop | Medium | Collaborative content semantic search |
| Copilot Pages | High | Semantic search for AI-generated collaborative artifacts |
| Copilot Notebooks | High | Semantic search for AI-generated analytical notebooks |
| Viva | Medium | Organizational insights grounded in semantic understanding |
Governance Levels
| Level | Requirement | Rationale |
|---|---|---|
| Baseline | Document understanding of what the Semantic Index indexes across the organization's M365 workloads. Identify which workloads contain sensitive content that will be processed by the Semantic Index. Review SharePoint search indexing configuration for sites containing regulated data. | Minimum understanding of the Semantic Index data pipeline to inform governance decisions. |
| Recommended | All Baseline requirements plus: map Semantic Index scope against data classification inventory (from Control 1.1). Implement RCD (or RSS, where already enabled) to limit Copilot grounding scope for sensitive sites. Monitor Copilot content retrieval patterns via Microsoft Purview DSPM for AI (Activity explorer). Document Semantic Index governance posture in Copilot governance documentation. | Provides active governance of Semantic Index scope with monitoring and documented controls. |
| Regulated | All Recommended requirements plus: conduct formal risk assessment of Semantic Index data processing for regulated data types (NPI, MNPI, PII). Document Semantic Index architecture and data flow in technology risk assessment. Evaluate embedding storage and lifecycle governance. Include Semantic Index scope in periodic Copilot governance reviews. Engage information security team in Semantic Index governance decisions. | Comprehensive understanding and governance of the Semantic Index data processing pipeline that supports examination readiness and regulatory inquiries about AI data handling. |
Setup & Configuration
Step 1: Inventory Current Search Indexing Configuration
Review tenant-level Microsoft Search configuration at M365 Admin Center > Settings > Search & intelligence, then review site-level searchability for sites holding regulated content.
Site searchability is a site-level setting, not a tenant setting. For each site in scope, review Site settings > Search and offline availability > Indexing Site Content > Allow this site to appear in Search results. Setting this to No excludes the site from both Microsoft Search and the semantic index.
To inventory and manage Restricted Content Discovery across sites (requires SharePoint Advanced Management):
# Check RCD status for a single site
Get-SPOSite -Identity <site-url> | Select RestrictContentOrgWideSearch
# Generate a tenant-wide RCD report
Start-SPORestrictedContentDiscoverabilityReport
Get-SPORestrictedContentDiscoverabilityReport
See the PowerShell Setup playbook for the full walkthrough.
Step 2: Map Semantic Index Scope to Data Classification
Cross-reference the workloads and sites indexed by the Semantic Index against the data classification inventory from Control 1.1:
| Workload | Sites/Content in Index | Sensitivity Level | Governance Action Needed |
|---|---|---|---|
| SharePoint | [List sites] | [Classification] | [Action or N/A] |
| OneDrive | All user OneDrive | [Classification] | [Action or N/A] |
| Exchange | All mailboxes | [Classification] | [Action or N/A] |
| Teams | All teams/channels | [Classification] | [Action or N/A] |
Step 3: Implement Scope Controls
Based on the mapping above, implement appropriate scope controls:
- For sites with sensitive content not yet remediated: Apply Restricted Content Discovery (RCD) to exclude the site from Copilot discovery, or use RSS allow-list scoping (Control 1.3) where RSS is already enabled — noting the RSS retirement timeline
- For workloads with regulated data: Verify that DLP policies and sensitivity labels are in place
- For content that should not be in Copilot scope: Turn off site-level searchability so the content leaves both Microsoft Search and the semantic index
Step 4: Document Semantic Index Governance Posture
Create and maintain documentation that describes: - Current Semantic Index scope across workloads - Controls in place to govern indexing scope - Monitoring mechanisms for Copilot content retrieval - Decision rationale for scope inclusions and exclusions
Financial Sector Considerations
- Material Non-Public Information (MNPI): Content containing MNPI (earnings data, M&A details, trading strategies) is indexed by the Semantic Index if it resides in indexed M365 locations. Financial institutions must ensure information barriers and permission controls prevent Copilot from surfacing MNPI across restricted boundaries.
- Embedding Data Residency: The Semantic Index processes and stores embeddings within the Microsoft 365 tenant boundary. For institutions with data residency requirements, confirm that embedding processing aligns with data residency commitments in Microsoft's service agreements.
- Audit Trail for AI Processing: Regulators may inquire about what data the AI system processes. Understanding Semantic Index scope enables institutions to provide informed responses about Copilot's data processing pipeline.
- Model Risk Management Parallels: While the Semantic Index is not a model in the traditional SR 11-7 / OCC Bulletin 2011-12 sense, it transforms data in ways that affect AI outputs. Institutions with mature model risk management practices should consider whether the Semantic Index warrants inclusion in their AI/ML inventory.
- Cross-Workload Data Leakage: The Semantic Index enables Copilot to synthesize information across workloads (e.g., combining SharePoint document content with email context). This cross-workload synthesis may surface correlations that would not be apparent from any single data source, creating novel information leakage risks.
- Retention and Deletion: When source content is deleted or retention policies expire, the corresponding Semantic Index representations should be removed on Microsoft service timelines. Organizations should verify this lifecycle alignment meets regulatory retention requirements through tenant testing.
Verification Criteria
- Documentation exists describing what the Semantic Index indexes across each M365 workload in the organization
- SharePoint search indexing configuration has been reviewed and sites containing regulated data are documented
- Semantic Index scope has been mapped against the data classification inventory from Control 1.1
- Appropriate scope controls (RCD, site searchability, RSS where already enabled) are in place for sites containing sensitive or regulated content
- Microsoft Purview DSPM for AI (Activity explorer) monitoring is configured to track Copilot content retrieval patterns (Recommended and Regulated levels)
- Formal risk assessment of Semantic Index data processing has been conducted for regulated data types (Regulated level)
- Semantic Index governance posture is documented in the organization's Copilot governance documentation
- Information security team has reviewed and approved the Semantic Index governance posture (Regulated level)
- Semantic Index data flow and architecture are documented in the organization's technology risk assessment (Regulated level)
- Periodic review cadence for Semantic Index governance is established (quarterly minimum)
Additional Resources
- Microsoft Learn: Semantic indexing for Microsoft 365 Copilot
- Microsoft Learn: SharePoint authoritative sites in Copilot Search
- Microsoft Learn: Restrict discovery of SharePoint sites and content (RCD)
- Microsoft Learn: Restricted SharePoint Search
- Microsoft Learn: Enable content on a site to be searchable
- Microsoft Learn: Microsoft 365 Copilot Search admin experience
- Microsoft Learn: Microsoft Graph overview
- Microsoft Learn: How Microsoft 365 Copilot works
- Microsoft Learn: Data, Privacy, and Security for Microsoft 365 Copilot
- SR 11-7 / OCC Bulletin 2011-12: Model Risk Management
- Related Controls: 1.3 Restricted SharePoint Search, 1.1 Copilot Readiness Assessment, 1.7 SharePoint Advanced Management, 3.1 Copilot Audit Logging, 4.5 Usage Analytics
- Playbooks: Portal Walkthrough, PowerShell Setup, Verification & Testing, Troubleshooting
FSI Copilot Governance Framework v1.8.0 - July 2026