A Restricted Access Control (RAC) policy—available through the SharePoint Advanced Management (SAM) add-on—lets an admin specify a single Microsoft Entra security group that exclusively controls access to selected SharePoint sites. When a RAC policy is applied, any user who is not a member of the designated group is blocked, regardless of other SharePoint permissions or sharing links, perfectly aligning with leadership’s requirement to confine access to the high-risk M&A sites while leaving the rest of the tenant unchanged.

B. Breaking inheritance and manually editing permissions can still be bypassed by existing or future sharing links and must be maintained per site.

C. Setting “Only people in your organization” still allows every licensed internal user, not just the specific security group.

D. Moving content to a new tenant is heavy-weight, disrupts search/co-authoring, and exceeds the stated “leave the rest of the tenant unchanged” directive.

1. Microsoft Learn – “Apply a Restricted Access Control (RAC) policy to a SharePoint site” (https://learn.microsoft.com/sharepoint/restricted-access-control)

Section: “How RAC policies work”.

2. Microsoft Learn – “SharePoint Advanced Management add-on capabilities” (https://learn.microsoft.com/sharepoint/sharepoint-advanced-management)

Sub-section “Restricted access control policies”.