Manage Microsoft 365 Copilot Chat

Microsoft 365 Copilot Chat eligibility

Copilot Chat is available at no additional cost for Entra account users with one of the following licenses:

• Microsoft 365 A1/A3/A5 (including MA3/MA5 for students, MA3/MA5 for faculty, and MA3/MA5 student-use benefit)
• Microsoft 365 Business Basic/Business Standard/Business Premium
• Microsoft 365 E3/E5
• Microsoft 365 F1/F3
• Microsoft Teams/Teams Enterprise/Teams Essentials/Teams Rooms
• Office 365 A1/A1 Plus/A3/A5
• Office 365 E1/E1 Plus/E3/E5
• Office 365 F3

License versions above that are designated "(no Teams)" and "EEA (no Teams)" are also included.

Copilot Chat is available for students aged 13 and older. To help ensure appropriate access, admins must take additional steps to manage deployment: Microsoft 365 Copilot Chat for Students 13+ | Microsoft Community Hub.

If you're an admin authorized to modify the EDU classification for your tenant members, you can do so using a PowerShell script. In the Microsoft Download Center, get the Copilot for Education Control.

Pinning settings for Copilot Chat

Copilot Chat is pinned by default for most users who are eligible for Copilot Chat. If pinned, Copilot Chat is available in the Microsoft 365 Copilot app, Outlook, Teams, Word, Excel, PowerPoint, and OneNote.

Copilot Chat is not pinned by default for users in the European Economic Area (EEA) and Switzerland.

Get more details on how to manage the pinning settings of Microsoft 365 Copilot Chat for your users.

Copilot Chat is available in select apps for US government GCC M and DoD customers as of mid-2025. The pinning control is not available for US government cloud environments—please refer to Remove access to Copilot Chat for information on how to manage.

Manage web search queries in Copilot Chat

To help improve the quality of responses, Copilot Chat can use web search queries sent to the Bing search service to ground responses in the latest information from the web. Learn more about how generated web search queries work in Copilot Chat.

You can manage web search in Copilot Chat by using the Allow web search in Copilot policy, which is available in Cloud Policy service for Microsoft 365. The Allow web search in Copilot policy is also available in the settings section of the Copilot Control System page in the Microsoft 365 admin center. The policy allows web search to be managed at the tenant level and provides flexibility to modify for specific groups and users if the tenant has special requirements. The Allow web search in Copilot policy also allows you to manage web search for users with a Microsoft 365 Copilot license.

If you don't configure the Allow web search in Copilot policy, web search is available to users by default in both Microsoft 365 Copilot and Copilot Chat, unless you set the Allow the use of additional optional connected experiences in Office policy to Disabled. But turning off optional connected experiences restricts Microsoft 365 Copilot Chat, Microsoft 365 Copilot, and multiple experiences across Microsoft 365.

For more information on the Allow web search in Copilot policy, see Data, privacy, and security for web queries in Microsoft 365 Copilot and Microsoft 365 Copilot Chat.

Network requirements

Microsoft 365 Copilot Chat adds generative AI capabilities to many Microsoft 365 applications by extending existing in-app features and introducing new ones. Admins can most effectively manage Microsoft 365 Copilot Chat experiences using in-service controls provided through the Microsoft 365 admin center (MAC) and individual applications.

Microsoft doesn't recommend and cannot support attempts to manage Microsoft 365 Copilot Chat and related settings through network-level restrictions such as selective domain, URL, IP blocking, or network-protocol filtering. Because Microsoft 365 Copilot Chat is deeply integrated with applications, such network-level restrictions can lead to unpredictable results and may cause failures or block access to those applications.

For the full list of Microsoft 365 required endpoints (which includes Microsoft 365 Copilot and Copilot Chat), please refer to Microsoft 365 URLs and IP address ranges.

Copilot Chat usage report

The Microsoft 365 Copilot Chat usage dashboard provides insights into active usage of Microsoft 365 Copilot Chat. Admins can generate reports on total active users, average daily active users, total prompts submitted and average prompts per user, and active users of Copilot Chat in specific apps. Learn how to get the Microsoft 365 Copilot Chat usage dashboard and how to use it in the documentation for Microsoft 365 reports in the admin center.

How to ensure users access Copilot Chat

Since January 2025, the Copilot experience for work and education no longer shares the same name as the Copilot experience for personal use:

• Microsoft 365 Copilot Chat (grounded in the web) and Microsoft 365 Copilot (grounded in the web and work data) are for work and education
• Microsoft Copilot is for personal use

These experiences are accessed by their own unique entry points (except for Microsoft Edge).

To ensure your users access Copilot Chat (work and education), instruct them to access it from the locations indicated under "Work and education" in the table.

To prevent access to Microsoft Copilot (personal use), block access to Copilot.microsoft.com and Bing.com/chat. Additionally, you can manage whether your users can sign in to Microsoft 365 apps using a personal account (MSA). To manage user sign-in to Microsoft 365 apps using a personal account (MSA), use tenant restriction V2.

Manage Copilot Chat in Edge

Users can access Copilot Chat through the Copilot icon in the Edge browser UI when they're signed in with their Entra account.

Users can modify this permission by going to Microsoft Edge > Settings > Appearance > Copilot and Sidebar > Copilot and then turning on or off the 'Show Copilot button on the toolbar' and 'Allow Microsoft to access page content' toggles. An additional entry point to the Copilot in Edge policies is available in the settings section of the Copilot Control System page in the Microsoft 365 admin center, where group policies can be managed.

Admins can use multiple group policy settings to manage the behavior of the Copilot Chat in Edge sidebar:

• To allow or block Copilot Chat in Edge from using browsing context, use the EdgeEntraCopilotPageContext policy. This policy can prevent Copilot Chat from using webpage or PDF content when it formulates responses to prompts.
• To disable Copilot Chat in Edge entirely, use the HubsSidebarEnabled policy. Blocking Copilot Chat in Edge automatically blocks all Edge sidebar apps from being enabled.
• To allow or block Copilot Chat in Edge from using browsing context when users are signed in with their personal MSA Bing account while in the Edge work profile, use the CopilotPageContext policy. This policy prevents Microsoft Copilot (personal use) from using webpage or PDF content when it formulates responses to prompts.

Mapping the Copilot key

The Copilot key was introduced to some PC keyboards in 2024. It was originally intended to invoke Copilot in Windows, but this use shifted as we evolved Microsoft Copilot experiences on Windows to better address your feedback and needs.

As we previously shared, Copilot in Windows was removed, and the Microsoft Copilot app is now only available to personal users authenticating with a Microsoft account. The Microsoft Copilot app does not work for commercial users authenticating with a Microsoft Entra account. Users who wish to use Copilot for work or education can access Copilot Chat in the Microsoft 365 Copilot app. With this change, IT admins may need to take steps to ensure employees authenticating with a Microsoft Entra account can access Copilot Chat in the Microsoft 365 Copilot app via the Copilot key.

We recommend that managed commercial and educational organizations remap the Copilot key to invoke the Microsoft 365 Copilot app for simplified access to Copilot Chat experiences designed for work and education. Find detailed instructions on how to remap the Copilot key here.

Manage Copilot Chat on the web, in the Microsoft 365 Copilot app, and in Outlook

The Copilot app is an integrated app that provides Copilot Chat in the Microsoft 365 Copilot app (web, desktop, mobile) and Outlook (web, desktop, mobile). It also supports Copilot Chat on the web. Admins can deploy the Copilot app or manage its availability in the app store for users or user groups from Integrated Apps in the Microsoft 365 admin center (MAC).

Learn more about how Teams apps can be extended to Outlook and the Microsoft 365 app and managed from Integrated Apps in the Microsoft 365 admin center.

To manage availability for the Copilot app, select Copilot from Integrated Apps in the Microsoft 365 admin center. Then, select "All users in the organization can install" or select "Specific users/group in the organization can install" and specify users or user groups who should have access.

Manage Copilot Chat in Teams

Admins can manage Copilot Chat in Teams through the Copilot app in the Teams admin center. Like all other Teams apps, admins manage a single Copilot app in Teams for users with and without a license. To manage Microsoft 365 Copilot Chat, you should manage the users who don't have a Microsoft 365 Copilot license. For users who do have a Microsoft 365 Copilot license, you should confirm that they're assigned access to the app.

Admins can manage access and pinning for Microsoft 365 Copilot Chat. See how to manage app access and how to pin Microsoft 365 Copilot Chat to the navigation bar.

Remove access to Copilot Chat

If you wish to prevent access to Microsoft 365 Copilot Chat for your users, follow these steps:

1. Unpin Copilot Chat and block web access: Most users have Copilot Chat pinned by default in Microsoft 365 apps unless their admin has taken specific action. To change the pinning setting, use the control found under Settings on the Copilot Control System page in the Microsoft 365 admin center (MAC). Select 'Do not pin Copilot Chat in Microsoft 365 apps.' Learn more about pinning Microsoft 365 Copilot Chat for your entire tenant or for specific users or groups. (Note for US government GCC M and DoD customers: When Copilot Chat is made available for your users, it's available by default. Use the Integrated Apps controls as described in Step 2 to manage Copilot Chat availability—modifying the Cloud Policy service for Microsoft 365 does not impact the visibility of Copilot in the navigation bars.)

   Copilot Chat users can still access it from copilot.cloud.microsoft even if ‘Do not pin Copilot Chat in Microsoft 365 apps’ is selected. To block access to Copilot Chat from copilot.cloud.microsoft, use a corporate proxy. This step is unnecessary if you manage the Copilot app through the Integrated Apps portal in the Microsoft 365 admin center (MAC) as described in Step 2.

2. Microsoft 365 Copilot app and Outlook: The Copilot app is an integrated app that provides Copilot Chat in the Microsoft 365 Copilot app (web, desktop) and Outlook (web, desktop). It also supports Copilot Chat on the web at copilot.cloud.microsoft. You can manage the Copilot app for these surfaces through the Integrated Apps portal in the Microsoft 365 admin center (MAC).

   Note

   Admins can manage the Microsoft 365 Copilot app on web and desktop through the Integrated Apps portal in the Microsoft 365 admin center (MAC). The rollout of Integrated Apps controls to block Copilot Chat on mobile will be complete later in 2025.

   To prevent access to the Copilot app for unlicensed users, including US government customers, don't deploy the Copilot app to these users. To prevent the Copilot app from being available in the App store for unlicensed users, select "Specific users/group in the organization can install." Then create a user group, or apply an existing group, with only Microsoft 365 Copilot licensed users. This will make the Copilot app unavailable for unlicensed users while keeping it available for licensed users. Learn more about these Controls for managing Teams apps that work on Outlook and the Microsoft 365 Copilot app.

   Note

   If you block the Copilot app using the Integrated app control, you will block the Copilot app tenant-wide across the Microsoft 365 Copilot app, Outlook, and the web, including for users assigned a Microsoft 365 Copilot license.

3. Teams: Only allow the Copilot app in Teams for users who are assigned a Microsoft 365 Copilot license—this will ensure your licensed users continue to have access to Copilot Chat. Don't allow it for users without a license. Learn more about allowing users access to apps in Microsoft Teams. Don't pin the Copilot app in app setup policies for users without a Microsoft 365 Copilot license. You need to do this even if you selected "Do not pin Microsoft 365 Copilot Chat to the navigation bar" in the Settings of the Copilot page in the Microsoft 365 admin center.

4. Microsoft Edge: Use the EdgeMicrosoft365CopilotChatIconEnabled policy to control which sidebar apps, including Copilot Chat, are blocked (except the Search app).

   You can find these URLs at edge://sidebar-internals. The sidebar internals JSON file includes a manifest for built-in sidebar apps, including a "target": {"url": "xyz"} parameter for each app. You can use these values to configure the policy.

Add recommended security protections for Copilot Chat

Microsoft helps you prepare for AI tools and companions while also building a strong foundation of security protection. Security recommendations for AI are based on Zero Trust, an industry-standard framework for security. By following these recommendations, you are building a Zero Trust foundation at the same time.

Introducing Copilot Chat to your environment provides the opportunity to tune-up security protections for web-grounded prompts. These include protections for user accounts, devices, and some app data. For more information, see Apply principles of Zero Trust to Microsoft Copilot Chat.

Introducing Copilot to your environment allows you to take a staged approach, starting with protections for web-grounded prompts with Copilot Chat and maturing to protections for Microsoft 365 graph-grounded prompts. Protections for prompts grounded with data provided by your security tools (Security Copilot) focus on tuning up least privilege practices and honing threat protection. For more information, see Use Zero Trust security to prepare for AI companions, including Microsoft Copilots.