Manage Copilot Chat

Ensure users can access Microsoft Copilot Chat

Users can sign in to the Microsoft Copilot app with a work or school account or a personal Microsoft account. Chats, files, permissions, available experiences, and protections remain separate based on the account used to sign in.

• To help ensure users receive enterprise protections, instruct them to sign in with their work or school account when using Microsoft Copilot Chat. Users see updated visual cues in the app that help identify whether they are in the Microsoft Entra ID (work or school) experience, or the Microsoft account (personal) experience. These include a different background color for each account type, "Work" label under the user profile in the navigation pane, and the green data protection shield in their Microsoft Entra ID experience.
• To manage whether users can sign in with personal accounts, see Tenant Restrictions v2.
• To help ensure that the current and future Copilot experiences for enterprise tenants aren't affected:
  • Add *.cloud.microsoft to your organization's allow lists. Don't block individual domains and URLs under *.cloud.microsoft. Microsoft doesn't support allowing partial or only selected Microsoft 365 application URLs within the *.cloud.microsoft domain. Allow the entire *.cloud.microsoft domain to maintain service reliability and avoid disruptions.
  • Verify that rules, URL category filters, Conditional Access, or app control policies aren't blocking copilot.cloud.microsoft or the Copilot app. You can test connectivity to endpoints in the *.cloud.microsoft domain by using the Microsoft 365 Connectivity test tool.
  • Confirm that your environment aligns with the Microsoft 365 and Copilot network requirements.

Manage Copilot Chat in Edge

Users can access Copilot Chat through the Copilot icon in Microsoft Edge when they're signed in with their Entra account. Users signed in with a Microsoft Entra account have enterprise data protection.

Manage Copilot Chat behaviour in Edge with group policy settings

Admins can use multiple group policy settings to manage the behavior of Copilot Chat in Edge sidebar:

Show the Coplot button in the toolbar

You can choose to show the Copilot button on the tool bar.

To turn on or off the Copilot button on the toolbar:

1. Go to Microsoft Edge > Settings > Appearance > Copilot and Sidebar.
2. Under App specific settings, select Copilot.
3. Toggle on or off Show Copilot button on the toolbar.

Allow or block Copilot from using browser content

You can choose to allow Copilot to use browser content.

To allow or block Copilot from using browser content:

1. Go to Microsoft Edge > Settings > Appearance > Copilot and Sidebar.
2. Under App specific settings, select Copilot.
3. Toggle on or off Allow Copilot to use browser content.

Manage Data Loss Prevention in Edge

Microsoft Edge for Business supports built-in Data Loss Prevention (DLP) capabilities that extend your organization's data protection controls to Copilot Chat in Edge. You can configure DLP policies using Microsoft Purview, Microsoft Intune Mobile Application Management (MAM), and Microsoft Defender for Cloud Apps (MDA) to help prevent unauthorized data exposure within Copilot Chat responses.

Use DLP to prevent items with specific sensitivity labels from being used in the response summarization to prompts in Microsoft Copilot and Copilot Chat. For more information on the document types that Edge has access to, see Microsoft Edge and access to page content.

Map the Copilot key

Users can access Copilot Chat for work and education in the Microsoft Copilot app. To support this experience, IT admins should remap the Copilot key to open the Microsoft Copilot app. For more information, see Remap the Copilot key.

Manage Copilot Chat on the web and in Outlook

The Copilot app is an integrated app that provides Copilot Chat via web, in the Microsoft Copilot app (web, desktop, mobile) and in Outlook (web, desktop, mobile).

Admins can deploy the Copilot app or manage its availability. For more information, see How to manage the availability of an app in your organization.

For more information on how Teams apps can be extended to Outlook and the Microsoft 365 app and managed, see Integrated Apps in the Microsoft 365 admin center.

Block users from using Copilot Chat

Blocking Copilot through Integrated Apps is a tenant-wide control that you can scope to specific users or groups, including licensed users. This setting blocks Copilot in the Microsoft Copilot app, Teams, Outlook, and Copilot Chat on the web for all users. To remove access to the Copilot app only for unlicensed users while retaining access for licensed users, see Removing access to Copilot Chat.

Users blocked through Integrated Apps see the Copilot Chat was turned off for your organization experience when opening Copilot Chat in the Copilot app.

Provide a company policy URL

Organizations can provide a URL to the company policy or internal guidance page. This link appears on the Copilot Chat was turned off for your organization page for users who are blocked from accessing Copilot through the Integrated Apps control.

1. Sign in to the Microsoft 365 admin center with an administrator account.
2. Select Copilot and then select Settings.
3. Select View all.
4. Select Custom link for blocked Microsoft Copilot app.
5. Enter a URL to your internal guidance page. Users see the link text View info from your organization, which directs them to the URL you configured.

Manage Copilot Chat in Microsoft Teams

You can manage Copilot Chat in Teams through the Copilot app in the Teams admin center. As with other Teams apps, a single Copilot app is managed for all users, regardless of license.

To manage Microsoft Copilot Chat, configure access for users without a Microsoft 365 Copilot license, and ensure licensed users are assigned access to the app, see manage access and pinning Microsoft Copilot Chat.

Remove access to Copilot Chat

If you want to prevent access to Copilot Chat for your users, use the following steps:

Step 1: Unpin Copilot Chat and block web access

To unpin Copilot Chat, see Pinning options.

Users can still access Copilot Chat from m365.cloud.microsoft/chat even if Do not pin Copilot Chat in Microsoft 365 apps is selected. You can manage access to the Copilot app through the Integrated Apps portal in the Microsoft 365 admin center (MAC) as described in Step 2.

Step 2: Manage Copilot Chat in Copilot app and Outlook

The Copilot app provides Copilot Chat in the Microsoft Copilot app and Outlook across web, desktop, and mobile, and on the web at m365.cloud.microsoft/chat. You manage the app through the Integrated Apps portal in the Microsoft 365 admin center.

To prevent access to the Copilot app for unlicensed users, including US government customers, don't deploy the Copilot app to these users. To prevent the Copilot app from being available in the App store for unlicensed users, select Specific users/group in the organization can install and assign a group that includes only licensed users. The app is only available to licensed users.

Step 3: Only allow Copilot Chat in Teams for licensed users

Only allow Copilot Chat in Teams for users with a Microsoft 365 Copilot license.

Don't allow access to Copilot Chat and don't pin the Copilot app in app setup policies for unlicensed users. You need to do this even if you selected Do not pin Microsoft Copilot Chat to the navigation bar setting in the Copilot page in the Microsoft 365 admin center.

Step 4: Use the EdgeMicrosoft365CopilotChatIconEnabled policy

Use the EdgeMicrosoft365CopilotChatIconEnabled policy to control which sidebar apps, including Copilot Chat, are blocked (except the Search app).

You can find these URLs using edge://sidebar-internals. The sidebar internals JSON file includes a manifest for built-in sidebar apps, including a "target": {"url": "xyz"} parameter for each app. You can use these values to configure the policy.