AI Enterprise Search: A Buyer's Guide to Internal Knowledge Search

Most companies already have search. What they lack is an answer: the current version of a policy, the reason a decision was made, the customer contract clause that applies. Atlassian's 2025 State of Teams report, based on a survey of 12,000 knowledge workers and 200 executives, says leaders and teams waste 25% of their time just searching for answers. Even if your number is half that, it is the largest line in the business case.

AI enterprise search combines a search index over company content with a language model that writes an answer and cites the documents it used. The model is rarely the hard part. The hard parts are connecting the right sources, respecting who may see what, and proving the answers are correct often enough to trust.

The first decision is not which vendor, but which of three shapes fits your content. Pick the one that covers most of your important documents with the least new plumbing.

A quick way to decide is to take the last 20 questions your team struggled to answer and note where each answer finally came from. If 15 of them point to the same suite, a suite assistant is the obvious starting point. If they point to five different systems, connector coverage matters more than model quality. If they all point to one document set that changes often, a focused custom system may be worth the build. The options also combine: many companies switch on the suite assistant for everyone and build one custom assistant for a single team.

AI search does not create new access, but it removes the obscurity that used to hide bad access. Microsoft states that Microsoft 365 Copilot only surfaces organizational data to which individual users have at least view permissions, and that its Semantic Index only grounds answers in content the current user is authorized to access. That is the right design, and it means a budget folder shared with "everyone" years ago will now answer anyone who asks about salaries.

Microsoft's own guidance on Restricted SharePoint Search walks through exactly this case: a budgeting site that most people did not know about, with permissions nobody reviewed, surfacing in a marketing employee's Copilot answers. Treat a permission review as a project phase with an owner and a deadline, not a checkbox.

Many Copilot rollout plans written in 2024 and 2025 relied on Restricted SharePoint Search, an allow list of up to 100 sites that limits what organization-wide search and Copilot can draw from. Microsoft now says the feature is retiring and that new enablement has been blocked since July 31, 2026. Microsoft also notes it was never a security boundary and does not change permissions: a site the user recently visited, or that was shared with them in Teams or Outlook, still appears.

The replacement is Restricted Content Discovery, a site-level setting that keeps a site out of organization-wide search and Copilot responses while its permissions are reviewed. It requires a Copilot licence with SharePoint Advanced Management, it does not change who can open the files, and Microsoft warns that for sites with more than 500,000 items the change can take more than a week to take effect. Plan that lag into your pilot timeline.

A custom system has to rebuild what a suite gives you for free. The common mistake is to load every document into one vector database and filter answers afterwards. OWASP's 2025 Top 10 for LLM applications lists vector and embedding weaknesses (LLM08) and recommends fine-grained access controls, permission-aware vector stores and strict logical partitioning of datasets so one group cannot retrieve another group's content.

Packaged tools are priced per user. As a reference point, Microsoft lists Microsoft 365 Copilot for enterprise at US$30.00 per user per month paid yearly, on top of a qualifying Microsoft 365 plan. Standalone search vendors often quote by seat and connector volume through sales, so ask for a price that includes the connectors you actually need.

The licence is rarely the whole cost. Budget for the permission review, connector setup, an evaluation set and someone who owns answer quality after launch. A custom RAG system swaps licence fees for build and hosting costs, and it only pays off when a focused use case has enough volume to justify it. Do not license every employee on day one: pilot with the teams that search the most.

Vendor demos use clean demo data. Your evaluation should use your own questions, your own messy documents and real users with different permissions.

Agree on the pass mark before you see results. A sensible bar for an internal pilot is that most answers are correct and cite the right document, that the tool says it does not know rather than inventing an answer, and that no test account ever sees content outside its permissions. That last condition has no tolerance: one leak is a reason to stop and fix permissions, not a score to average out.

These questions separate a tool that fits your environment from one that only fits the demo. Ask for written answers.