7 Min. reading time

Since April, Microsoft has allowed administrators to mark certain SharePoint sites as authoritative sources. Content from these sites will be prioritized in Copilot chat and Copilot search. This sounds like a search setting, but it’s a governance decision with weight. Who maintains the list determines what the AI considers true within the company. This question doesn’t belong solely in IT administration; it belongs on the management team’s agenda.

Related:Agent 365 organizes AI agents  /  Who really owns AI operations

What authoritative sources really are

Microsoft announced this feature in the March 2026 update for Copilot, and the rollout has been underway since April. Administrators can enter up to 100 SharePoint sites in the Microsoft 365 admin center under Copilot, Search, Authoritative Content. Content from these sites will be given more weight in Copilot chat responses and in Copilot search than other content.

A note on proper classification: This is not the old authoritative pages feature from classic SharePoint search. Microsoft explicitly separates the two. If you’re familiar with the term from earlier SharePoint versions, you have the wrong mental model. The new feature targets Copilot exclusively, i.e., AI-supported responses.

This is precisely the point that elevates the feature beyond a search setting. In classic search, employees receive a list of hits and decide which one to trust. Copilot provides a formulated answer. Which source is included in this answer is no longer decided by the employee but by the weighting in the background. The list of authoritative sites is this weighting. Importantly, it doesn’t filter anything out or verify facts; it only shifts the ranking. Copilot can still draw on other content; authoritative sources simply come first.

Who Curates the Truth Within the Corporation

This raises a question that didn’t exist before AI: Who decides which internal source is considered authoritative? Previously, this was implicitly regulated. The HR department knew where the valid travel expense policy was located, and the sales team knew the current price list folder. Knowledge was distributed, and responsibility for maintaining it lay with the respective departments.

The list of authoritative sites centralizes this question. Someone adds a site to the list. From that moment on, its content becomes the preferred answer source for everyone who asks Copilot. If this person is an IT administrator who technically maintains the list, a content-related decision has shifted to a department that isn’t responsible for the content.

This is the core of the governance gap. The function is technically located in IT, but the decision about authoritative content is a factual and sometimes legal one. If someone adds an outdated guideline to the list, it becomes the standard answer. If someone forgets a site, Copilot prefers a worse source. Both happen silently, without an employee noticing.

The Risk of Outdated Authority

The greatest risk of the function isn’t its misuse but its neglect. An authoritative site is correct at the moment of marking. It remains marked even if its content becomes outdated a year later. Copilot continues to prefer it with the same self-evidence as on the first day.

The damage is subtle because it feels good. The answer comes quickly, seems well-founded, and refers to an official source. The employee doesn’t see that this source contains an outdated version. They receive incorrect information with the full authority appearance of a verified source. This is more dangerous than a missing answer because a missing answer forces inquiry.

Concretely, this means the list of authoritative sites needs the same maintenance cycle as the content itself. A site marked as authoritative but whose source content hasn’t been touched in months is a warning sign. A review that checks the marking and content actuality against each other should be part of a fixed quarterly rhythm.

The Interface to Compliance

For regulated industries, a second level is added. If Copilot provides information based on an authoritative source, it effectively becomes an official statement of the company. An employee who asks the AI about a compliance rule and receives an answer from a marked authoritative site acts in good faith in a verified source.

This makes the list of authoritative sites a compliance-relevant object. It should receive the same care as a released policy document. Anyone marking a site with compliance content as authoritative should do so with the compliance function’s approval. And anyone removing such a site from the list should document it because this changes the preferred answer source for a regulated topic.

This isn’t an argument against the function; it’s an argument for not treating it as a pure IT setting. The authoritative list is a control instrument for what the AI deems valid within the corporation. Control instruments need an owner and control.

What Management Must Define

The authoritative list is well manageable if three definitions are in place before productive use. None of them are complex, but all three are leadership decisions.

Firstly, the owner. The list of authoritative sites gets a named responsible role, not just a technical caretaker. This role decides which site is included. For content that is technically or legally sensitive, they obtain the co-signature of the relevant department.

Secondly, the review cycle. The list is reviewed at a fixed rhythm, at least quarterly. During the review, each marked site is checked against the current state of its content. Sites whose content is no longer maintained lose their marking or receive a maintenance assignment.

Thirdly, the compliance interface. For sites with regulated content, a co-signature principle applies. Inclusion and removal are documented, as both change the preferred response source for a compliance topic.

A sober assessment: Authoritative sources are a useful tool. They give management a direct lever on what the AI in the company presents as binding for the first time. But a lever that no one consciously operates still moves, albeit uncontrolled. Those who make these three definitions utilize the function. Those who leave it to IT alone have delegated the definition of truth without realizing it.

Frequently Asked Questions

Header image source: Pexels / Mahdi Bafande (px:14990059)