Who in the corporation defines what the AI deems true

15.05.2026

8 min read

Since April, Microsoft has allowed administrators to mark certain SharePoint sites as authoritative sources. Content from these sites will be prioritized in Copilot chat and Copilot search. This sounds like a search setting, but it’s a governance decision with weight. Who maintains the list determines what the AI considers true within the company. This question doesn’t belong solely in IT administration; it belongs on the management team’s agenda.

Key Takeaways

Authoritative sites prioritize responses. Admins mark SharePoint sites as official sources; Copilot prioritizes their content in chat and search. Up to 100 sites are possible.
The list is a truth definition. Whoever adds a site to the list declares its content the preferred answer source. This is a content decision, not a technical one.
Obsolete authority is the main risk. A once-marked site that isn’t maintained continues to provide preferred answers, even if its content is outdated.
An owner is needed. The list of authoritative sources belongs to a designated role, with a review cycle and a clear interface to compliance.

Related:Agent 365 organizes AI agentsWho really owns AI operations

What authoritative sources really are

Microsoft announced this feature in the March 2026 update for Copilot, and the rollout has been underway since April. Administrators can enter up to 100 SharePoint sites in the Microsoft 365 admin center under Copilot, Search, Authoritative Content. Content from these sites will be given more weight in Copilot chat responses and in Copilot search than other content.

A note on proper classification: This is not the old authoritative pages feature from classic SharePoint search. Microsoft explicitly separates the two. If you’re familiar with the term from earlier SharePoint versions, you have the wrong mental model. The new feature targets Copilot exclusively, i.e., AI-supported responses.

This is precisely the point that elevates the feature beyond a search setting. In classic search, employees receive a list of hits and decide which one to trust. Copilot provides a formulated answer. Which source is included in this answer is no longer decided by the employee but by the weighting in the background. The list of authoritative sites is this weighting. Importantly, it doesn’t filter anything out or verify facts; it only shifts the ranking. Copilot can still draw on other content; authoritative sources simply come first.

Who Curates the Truth Within the Corporation

This raises a question that didn’t exist before AI: Who decides which internal source is considered authoritative? Previously, this was implicitly regulated. The HR department knew where the valid travel expense policy was located, and the sales team knew the current price list folder. Knowledge was distributed, and responsibility for maintaining it lay with the respective departments.

The list of authoritative sites centralizes this question. Someone adds a site to the list. From that moment on, its content becomes the preferred answer source for everyone who asks Copilot. If this person is an IT administrator who technically maintains the list, a content-related decision has shifted to a department that isn’t responsible for the content.

This is the core of the governance gap. The function is technically located in IT, but the decision about authoritative content is a factual and sometimes legal one. If someone adds an outdated guideline to the list, it becomes the standard answer. If someone forgets a site, Copilot prefers a worse source. Both happen silently, without an employee noticing.

What the Marking Achieves

Prioritizes verified sources in Copilot answers
Pushes outdated drafts and duplicates to the back
Provides management with leverage over AI answers
Makes the source situation traceable for an audit

What It Doesn’t Achieve

It doesn’t check if the content is current
It doesn’t replace maintenance of the source site
It doesn’t report if a source is outdated
It doesn’t make decisions; it executes them

The Risk of Outdated Authority

The greatest risk of the function isn’t its misuse but its neglect. An authoritative site is correct at the moment of marking. It remains marked even if its content becomes outdated a year later. Copilot continues to prefer it with the same self-evidence as on the first day.

The damage is subtle because it feels good. The answer comes quickly, seems well-founded, and refers to an official source. The employee doesn’t see that this source contains an outdated version. They receive incorrect information with the full authority appearance of a verified source. This is more dangerous than a missing answer because a missing answer forces inquiry.

Concretely, this means the list of authoritative sites needs the same maintenance cycle as the content itself. A site marked as authoritative but whose source content hasn’t been touched in months is a warning sign. A review that checks the marking and content actuality against each other should be part of a fixed quarterly rhythm.

The Interface to Compliance

For regulated industries, a second level is added. If Copilot provides information based on an authoritative source, it effectively becomes an official statement of the company. An employee who asks the AI about a compliance rule and receives an answer from a marked authoritative site acts in good faith in a verified source.

This makes the list of authoritative sites a compliance-relevant object. It should receive the same care as a released policy document. Anyone marking a site with compliance content as authoritative should do so with the compliance function’s approval. And anyone removing such a site from the list should document it because this changes the preferred answer source for a regulated topic.

This isn’t an argument against the function; it’s an argument for not treating it as a pure IT setting. The authoritative list is a control instrument for what the AI deems valid within the corporation. Control instruments need an owner and control.

What Management Must Define

The authoritative list is well manageable if three definitions are in place before productive use. None of them are complex, but all three are leadership decisions.

Firstly, the owner. The list of authoritative sites gets a named responsible role, not just a technical caretaker. This role decides which site is included. For content that is technically or legally sensitive, they obtain the co-signature of the relevant department.

Secondly, the review cycle. The list is reviewed at a fixed rhythm, at least quarterly. During the review, each marked site is checked against the current state of its content. Sites whose content is no longer maintained lose their marking or receive a maintenance assignment.

Thirdly, the compliance interface. For sites with regulated content, a co-signature principle applies. Inclusion and removal are documented, as both change the preferred response source for a compliance topic.

A sober assessment: Authoritative sources are a useful tool. They give management a direct lever on what the AI in the company presents as binding for the first time. But a lever that no one consciously operates still moves, albeit uncontrolled. Those who make these three definitions utilize the function. Those who leave it to IT alone have delegated the definition of truth without realizing it.

Frequently Asked Questions

What are authoritative sources in Microsoft 365 Copilot?

It’s a feature that allows administrators to designate specific SharePoint sites as official, trusted sources. Content from these sites is prioritized in Copilot chat responses and Copilot Search. Microsoft announced the feature in March 2026, and rollout has been ongoing since April. Up to one hundred sites can be managed via the Admin Center.

Is this the same as authoritative pages in classic SharePoint Search?

No. Microsoft explicitly distinguishes between the two. The older authoritative pages feature applies only to classic search. The new feature targets Copilot exclusively–that is, AI-powered responses. Users familiar with the term from earlier SharePoint versions should not carry over their existing mental model.

What is the biggest risk of authoritative sources?

Outdated authority. Once a site is marked as authoritative, it remains a preferred source for responses–even if its content becomes outdated. Copilot may then deliver incorrect information with the full appearance of a verified source. This is more dangerous than no response at all, as it doesn’t prompt users to double-check.

Who should be responsible for the list of authoritative sites?

A designated business role, not IT administration alone. Adding a site is a content decision about which source should be prioritized. For sensitive technical or legal content, approval from the responsible department is required; for compliance content, sign-off from the compliance function is essential.

How often should the list be reviewed?

At least quarterly. Each review should verify whether the content of every listed site remains current. Sites whose source content is no longer maintained should either lose their authoritative status or be assigned a maintenance task. Without this rhythm, the list accumulates silent sources of error.