Configuring Restricted Access Control for SharePoint Sites

The core challenge is to enforce a specific access policy on a single SharePoint site (Site1) that requires users to satisfy two conditions simultaneously: membership in Group1 AND existing SharePoint permissions. This scenario tests the precise boundary between standard SharePoint permission management and Microsoft 365's Restricted Access Control (RAC) feature.

Restricted Access Control for Sites allows administrators to restrict access to a site so that only members of a specified security group can access it, while still respecting the underlying SharePoint permissions assigned to those members. This perfectly matches the requirement to "preserve existing SharePoint permissions" and apply the rule "only to Site1." It minimizes administrative effort by leveraging an existing security group rather than requiring complex individual permission assignments.

Option A (Sharing restrictions) applies globally or at the tenant level and does not allow for the nuanced combination of group membership plus existing content-level permissions in this manner. Option B (Restricted Content Discovery) is related but focuses on discovery rather than access enforcement. Option D (Site permissions) would require manually adding every user to the site, violating the "minimize administrative effort" and "preserve existing... permissions" constraints if done individually, or failing to enforce the group condition dynamically.

As noted in community feedback, RAC ensures users can access Site1 only if they belong to Group1 and hold existing SharePoint permissions. This confirms that C is the correct architectural choice for applying group-based access gating without disrupting granular content permissions.