SharePoint Information Architecture Before Copilot: A 2026 Plan

Microsoft 365 Copilot answers from whatever a user is allowed to open, so the structure of SharePoint, who can reach which sites and how content is labeled, decides what Copilot finds before anyone writes a prompt. This EPC Group guide sets out what Microsoft documents about SharePoint information architecture, navigation, the content model and Copilot readiness, and how to plan the work in order. Every fact below comes from Microsoft Learn, read on November 7, 2026; links are in the sources list at the end.

Why information architecture decides what Copilot finds

Microsoft is explicit that Copilot only surfaces organizational data to which an individual user has at least view permission, and that the semantic index Copilot uses doesn't change access permissions. The semantic index is an organization-wide index of text-based SharePoint Online files, it can't be disabled, and it only returns results to users who already have access. Setting a site's "Allow this site to appear in search results" to No removes it from both Microsoft Search and the semantic index. In other words, oversharing and poor structure don't stay hidden once Copilot is switched on; they become answers.

Microsoft also notes that search uses your information architecture investments to help people find content when they don't know where it lives, and that Copilot can use a library's column metadata as additional signals when a user scopes a prompt to that library. Good metadata is no longer only for filters; it is grounding.

The six elements of SharePoint information architecture

Microsoft defines information architecture as how you organize and label content and how people interact with it to get work done, and names six elements: global navigation, hub structure, local site and page navigation, metadata architecture, search experiences and personalized content. It also names the people who own them: intranet owners, departmental business owners, IT admins, hub owners, site owners, content creators and content consumers.

Two structural rules follow from the guidance:

• Keep it flat. In the modern SharePoint experience, subsites aren't recommended; plan one site for each discrete topic, task or unit of work, and connect sites with hubs. Subsites remain supported as a classic feature, but policies apply to the whole site collection, which makes them harder to govern.
• Treat it as a process. Microsoft states that information architecture is a continuous process, even with a good plan.

Navigation: what Microsoft allows

Microsoft's design principles add that navigation should always be planned from the user's perspective, that most people start by browsing even when search exists, and that labels should be specific, concise, familiar and front-loaded. It names card sorting, tree testing and usability testing as ways to check a structure before you build it.

The content model: content types, columns and metadata

Columns and content types are the two most important metadata elements in Microsoft's guidance. Content types created in the SharePoint admin center are saved to the content type hub and keep sites consistent. Managed metadata provides global term sets for every site that subscribes to the term store and local term sets for a single site collection; merging terms updates every item tagged with them, and the refinement panel uses metadata to filter search results.

Microsoft warns that folder structures more than one or two levels deep create a significant discoverability burden and should be avoided; topic-specific libraries with site columns are the alternative. For version history, the automatic setting is recommended for optimized version storage, organization defaults apply to new libraries, and versioning limits are ignored for items under a retention policy or eDiscovery hold.

Copilot readiness: permissions, oversharing and lifecycle

Microsoft's deployment guidance for a secured and governed foundation is organized into three pillars: remediate oversharing, set up guardrails and meet regulations. SharePoint Advanced Management, included once at least one user in the organization has a Copilot license, supplies most of the tooling:

• Data access governance reports find sites with potentially overshared or sensitive content; Microsoft suggests running snapshot reports quarterly and activity reports, which cover the last 28 days, monthly.
• Site access reviews send the remediation to site owners, and Restricted access control limits a site to specific groups when access has to change immediately.
• Restricted Content Discovery hides specific SharePoint sites from organization-wide search and Copilot without changing permissions. Microsoft calls it a temporary governance control, warns that excessive use reduces the content available to Copilot, and notes that on sites with more than 500,000 items an update can take more than a week. It isn't available for OneDrive.
• Inactive site policies find sites that haven't been active for a set period and, after notifications, can make them read-only or archive them with Microsoft 365 Archive. Removing content with no business value, which Microsoft calls data minimization, shrinks what Copilot can reach.

Testing and measuring the structure

The SharePoint site usage report shows page views, pages visited, files, active files and storage over 7, 30, 90 or 180 days. Microsoft Search usage reports (user, query, connection and answer analytics) cover the last 28 days or the previous year and now list the Copilot app at copilot.cloud.microsoft as a covered search application; they are available to search admins, search editors, global readers and global administrators. Query analytics show what people look for and don't find, which is the most direct input to the next navigation change.

A plan, in order

1. Inventory and permissions first. Run the data access governance reports, send site access reviews, and use Restricted Content Discovery only on the sites that can't be fixed before Copilot rolls out.
2. Flatten. Map subsites and deep folder trees to one site per unit of work and connect them with hubs.
3. Model content. Define content types and site columns in the content type hub and the term store, and retire folder-only filing.
4. Design navigation from the user's side. Test with card sorting and tree testing, then build global navigation on the home site and hub navigation within the documented limits.
5. Set lifecycle rules. Turn on inactive site policies and retention so stale content leaves Copilot's reach.
6. Measure and repeat. Review site usage and search query analytics each quarter, and treat the structure as a continuous process.

How EPC Group approaches SharePoint intranet design and information architecture

EPC Group runs SharePoint intranet design and information architecture as part of SharePoint intranet consulting and Copilot readiness: permissions and oversharing first, then the flat site and hub model, the content model, navigation tested with real users, and lifecycle rules. Information architecture on Microsoft 365 also covers Teams and OneDrive, because files on a team's Files tab are stored in SharePoint. For migrations, see our answer on information architecture before a SharePoint migration; for access controls, see SharePoint and Teams access governance and the Copilot readiness assessment.

Frequently asked questions

Does Copilot change who can see SharePoint content?

No. Microsoft states that Copilot only surfaces data the user can already view and that the semantic index doesn't change permissions. That is why permissions and oversharing reviews come before rollout.

Should we use subsites or folders to organize SharePoint?

Neither as the main structure. Microsoft doesn't recommend subsites in modern SharePoint and advises against folder trees more than one or two levels deep; use one site per unit of work, hubs to connect sites, and content types and site columns to organize content.

Is Restricted Content Discovery a long-term fix for oversharing?

No. Microsoft describes it as a temporary governance control that hides sites from discovery without changing permissions. The lasting fix is correcting access through site access reviews and Restricted access control.

How many hubs and navigation links can we have?

Up to 2,000 hub sites per organization, hub navigation up to three levels, and 500 child links at each level of site, hub, global and footer navigation, with Microsoft suggesting no more than 100 links to sites in hub navigation for performance.

Does hiding a site from search also hide it from Copilot?

Yes. Microsoft states that setting a site's "Allow this site to appear in search results" to No removes it from both Microsoft Search and the semantic index Copilot uses. Restricted Content Discovery is the targeted alternative: it hides specific sites from organization-wide search and Copilot without changing permissions.

Sources

Microsoft Learn, accessed November 7, 2026: Information architecture in modern SharePoint, Information architecture principles, Planning hub sites, SharePoint app bar, Managed metadata, Content types, Version history limits, Copilot privacy, Semantic index, Secure and governed foundation, SharePoint Advanced Management, SAM prerequisites, Restricted Content Discovery, Data access governance reports, Inactive site policy, SharePoint site usage, Microsoft Search usage reports.