Manage Microsoft 365 Copilot Chat

Microsoft 365 Copilot Chat eligibility

Copilot Chat is available at no additional cost for Entra account users with one of the following licenses:

• Microsoft 365 A1/A3/A5 (including MA3/MA5 for students, MA3/MA5 for faculty, and MA3/MA5 student-use benefit)
• Microsoft 365 Business Basic/Business Standard/Business Premium
• Microsoft 365 E3/E5
• Microsoft 365 F1/F3
• Microsoft Teams/Teams Enterprise/ Teams Essentials/Teams Rooms
• Office 365 A1/A1 Plus/A3/A5
• Office 365 E1/E1 Plus/E3/E5
• Office 365 F3

License versions above that are designated "(no Teams)" and "EEA (no Teams)" are also included.

Students under 18 are not yet eligible. To provide access to Copilot Chat for students aged 18 and older, admins must adjust the user profile. See Elevating User Management with Age Group and Consent Provided Fields in Microsoft Entra.

Pinning settings for Copilot Chat in the Microsoft 365 Copilot app, Microsoft Teams, and Outlook

To ensure people across your organization have easy access to Copilot Chat and can benefit from its security and experience updates, we recommend that your users have Microsoft 365 Copilot Chat pinned to their navigation bar. If Copilot Chat is pinned, it appears in the Microsoft 365 Copilot app (formerly the Microsoft 365 app), Teams, and Outlook across the web, desktop, and mobile. Copilot in other Microsoft 365 apps like Word, Excel, and PowerPoint requires a Microsoft 365 Copilot license.

Copilot Chat is pinned by default on web and desktop for users with a Microsoft 365 Copilot license. It becomes available and pinned by default for US government GCC M customers in April 2025.

The option to change the pinning settings for Copilot Chat can be found under Settings on the Copilot Control System page in the Microsoft 365 admin center. (Global Admin or AI Admin permissions required).

Admins can make changes to Microsoft 365 Copilot Chat pinning settings at any time. Changes take up to 48 hours to go into effect.

Get more details on how to pin Microsoft 365 Copilot Chat for your users.

Admins can also change the pinning settings of Copilot Chat for users in Microsoft Teams through the Teams admin center: Assign an app setup policy with Copilot Chat in the pinned apps to users with an Entra account. Learn more about how to change pinning settings in Teams through app setup policies. Like pinning any other app in Teams, Copilot Chat also needs to be allowed for those users through App permission policies or App centric management if you have migrated to it.

Manage web search queries in Copilot Chat

To help improve the quality of responses, Copilot Chat can use web search queries sent to the Bing search service to ground responses in the latest information from the web. Learn more about how generated web search queries work in Copilot Chat.

You can manage web search in Copilot Chat by using the Allow web search in Copilot policy, which is available in Cloud Policy service for Microsoft 365. The Allow web search in Copilot policy is also available in the settings section of the Copilot Control System page in the Microsoft 365 admin center. The policy allows web search to be managed at the tenant level and provides flexibility to modify for specific groups and users if the tenant has special requirements. The Allow web search in Copilot policy also allows you to manage web search for users with a Microsoft 365 Copilot license.

If you don't configure the Allow web search in Copilot policy, web search is available to users by default in both Microsoft 365 Copilot and Copilot Chat, unless you set the Allow the use of additional optional connected experiences in Office policy to Disabled. But turning off optional connected experiences restricts Microsoft 365 Copilot Chat, Microsoft 365 Copilot, and multiple experiences across Microsoft 365.

For more information on the Allow web search in Copilot policy, see Data, privacy, and security for web queries in Microsoft 365 Copilot and Microsoft 365 Copilot Chat.

Network requirements

Copilot Chat enables AI scenarios that access the web, so it may need to connect to specific network endpoints (domains). For Copilot Chat to work, you need to allowlist the following IPs:

• *.cloud.microsoft
• *.office.net
• *.office.com
• *.microsoft365.com
• m365copilot.com
• admin.microsoft.com
• browser.events.data.microsoft.com
• browser.pipe.aria.microsoft.com
• copilotstudio.microsoft.com
• login.microsoftonline.com
• config.edge.skype.com
• graph.microsoft.com
• designer.microsoft.com (needed for creating images)
• allow WebSocket connections to substrate.office.com:443

For Copilot Chat in Edge to work, you need to allowlist the following IPs:

• *.bing.com
• *.bing.net
• login.live.com

Microsoft 365 Copilot adds generative AI capabilities when using Microsoft 365 applications. It therefore must use the same network connections and endpoints that Microsoft 365 apps use.

See the full documentation of network requirements for Microsoft 365 Copilot, which provides a complete list of domains and WebSockets (WSS) that an organization's network shouldn't block.

Copilot Chat usage report

The Microsoft 365 Copilot Chat usage dashboard provides insights into active usage of Microsoft 365 Copilot Chat. Admins can generate reports on total active users, average daily active users, and active users of Copilot Chat in specific apps. Learn how to get the Microsoft 365 Copilot Chat usage dashboard and how to use it in the documentation for Microsoft 365 reports in the admin center.

How to ensure users access Copilot Chat

Since January 2025, the Copilot experiences for work and personal use no longer share the same name:

• Microsoft 365 Copilot Chat (grounded in the web) and Microsoft 365 Copilot (grounded in web and work data) are for work and education
• Microsoft Copilot is for personal use

These experiences are accessed by their own unique entry points (except for Microsoft Edge).

To understand the locations where users can access each distinct experience, see this table:

To ensure your users access Copilot Chat (work and education), instruct them to access it from the locations indicated under "Work and education" in the table.

To prevent access to Microsoft Copilot (personal use), block access to the locations indicated under "Personal use" in the table. Additionally, you can manage whether your users can sign in to the Microsoft 365 apps using a personal account (MSA). To manage user sign-in to Microsoft 365 apps using a personal account (MSA), use tenant restriction V2.

Manage Copilot Chat in Edge

Users can access Copilot Chat through the Copilot icon in the Edge browser UI when they're signed in with their Entra account.

Users can modify this permission by going to Microsoft Edge > Settings > Sidebar > Copilot, and then turning on or off the 'Allow Microsoft to access page content' toggle. An additional entry point to the Copilot in Edge policies is available in the settings section of the Copilot Control System page in the Microsoft 365 admin center, where group policies can be managed.

Admins can use multiple group policy settings to manage the behavior of the Copilot Chat in Edge sidebar:

• To allow or block Copilot Chat in Edge from using browsing context, use the EdgeEntraCopilotPageContext policy. This policy can prevent Copilot Chat from using webpage or PDF content when it formulates responses to prompts.
• To disable Copilot Chat in Edge entirely, use the HubsSidebarEnabled policy. Blocking Copilot Chat in Edge automatically blocks all Edge sidebar apps from being enabled.
• To allow or block Copilot Chat in Edge from using browsing context when users are signed in with their personal MSA Bing account while in the Edge work profile, use the CopilotPageContext policy. This policy prevents Microsoft Copilot (personal use) from using webpage or PDF content when it formulates responses to prompts.

Mapping the Copilot key

The Copilot key was introduced to some PC keyboards in 2024. It was originally intended to invoke Copilot in Windows, but this use shifted as we evolved Microsoft Copilot experiences on Windows to better address your feedback and needs.

As we previously shared, Copilot in Windows was removed, and the Microsoft Copilot app is now only available to personal users authenticating with a Microsoft account. The Microsoft Copilot app does not work for commercial users authenticating with a Microsoft Entra account. Users who wish to use Copilot for work or education can access Copilot Chat in the Microsoft 365 Copilot app. With this change, IT admins may need to take steps to ensure employees authenticating with a Microsoft Entra account can access Copilot Chat in the Microsoft 365 Copilot app via the Copilot key.

We recommend that managed commercial and educational organizations remap the Copilot key to invoke the Microsoft 365 Copilot app for simplified access to Copilot Chat experiences designed for work and education. Find detailed instructions on how to remap the Copilot key here.

Manage Copilot Chat on the web, in the Microsoft 365 Copilot app, and in Outlook

The Copilot app is an integrated app that provides Copilot Chat in the Microsoft 365 Copilot app (web, desktop, mobile) and Outlook (web, desktop, mobile). It also supports Copilot Chat on the web. Admins can deploy the Copilot app or manage its availability in the app store for users or user groups from Integrated Apps in the Microsoft 365 admin center (MAC).

Learn about Teams apps that work on Outlook and Microsoft 365.

To manage availability for the Copilot app, select Copilot from Integrated Apps in the Microsoft 365 admin center. Then, select "All users in the organization can install" or select "Specific users/group in the organization can install" and specify users or user groups who should have access.

Manage Copilot Chat in Teams

Admins can manage Copilot Chat in Teams through the Copilot app in the Teams admin center. Like all other Teams apps, admins manage a single Copilot app in Teams for users with and without a license. To manage Microsoft 365 Copilot Chat, you should manage the users who don't have a Microsoft 365 Copilot license. For users who do have a Microsoft 365 Copilot license, you should confirm that they're assigned access to the app.

Admins can manage access and pinning for Microsoft 365 Copilot Chat. See how to manage app access and how to pin Microsoft 365 Copilot Chat in the Microsoft 365 app, Microsoft Teams, and Outlook.

Remove access to Copilot Chat

If you wish to prevent access to Microsoft 365 Copilot Chat for your users, follow these steps:

1. Unpin Copilot Chat and block web access: Beginning on May 1, most users will have Copilot Chat pinned by default in the Microsoft 365 Copilot app, Teams, and Outlook. It remains pinned for those with a Microsoft 365 Copilot license.

   To change the pinning setting, use the control found under Settings on the Copilot Control System page in the Microsoft 365 admin center (MAC). Select 'Do not pin Microsoft 365 Copilot Chat to the navigation bar.' Learn more about pinning Microsoft 365 Copilot Chat. (Note for US government GCC M customers: When Copilot Chat is made available for your users, it's pinned by default. To change the pinning settings for US government GCC M customers, use the Integrated Apps controls as described in Step 2—modifying the Cloud Policy service for Microsoft 365 does not impact the visibility of Copilot in the navigation bars.)

   Microsoft 365 Copilot users can access Copilot Chat from copilot.cloud.microsoft even if it's not pinned to the Microsoft 365 app. To block access to Copilot Chat from copilot.cloud.microsoft, use a corporate proxy. This step becomes unnecessary after Integrated Apps controls are fully deployed by mid-May 2025. See Step 2.

2. Microsoft 365 Copilot app and Outlook: The Copilot app is an integrated app that provides Copilot Chat in the Microsoft 365 Copilot app (web, desktop, and mobile) and Outlook (web, desktop, and mobile). It also supports Copilot Chat on the web. You can manage the Copilot app for these surfaces through the Integrated Apps portal in the Microsoft 365 admin center (MAC).

   Note

   Beginning in April 2025 and rolling out over time, admins can manage the Microsoft 365 Copilot app through the Integrated Apps portal in the Microsoft 365 admin center (MAC). The full rollout of Integrated Apps controls to block Copilot Chat will be complete for the Copilot app on web and desktop by mid-May 2025; the rollout for mobile will be complete later in 2025. Until then, customers who wish to remove access to Copilot Chat should unpin it and block copilot.cloud.microsoft using a corporate proxy, as described in Step 1.

   To prevent access to the Copilot app for unlicensed users, including US government GCC M customers, don't deploy the Copilot app to these users. To prevent the Copilot app from being available in the App store for unlicensed users, select "Specific users/group in the organization can install." Then create a user group, or apply an existing group, with only Microsoft 365 Copilot licensed users. This will make the Copilot app unavailable for unlicensed users while keeping it available for licensed users. Learn more about these Controls for managing Teams apps that work on Outlook and the Microsoft 365 Copilot app.

   Note

   If you block the Copilot app using the Integrated app control, you will block the Copilot app tenant-wide across the Microsoft 365 Copilot app, Outlook, and the web, including for users assigned a Microsoft 365 Copilot license.

3. Teams: Only allow the Copilot app in Teams for users who are assigned a Microsoft 365 Copilot license—this will ensure your licensed users continue to have access to Copilot Chat. Don't allow it for users without a license. Learn more about allowing users access to apps in Microsoft Teams. Don't pin the Copilot app in app setup policies for users without a Microsoft 365 Copilot license. You need to do this even if you selected "Do not pin Microsoft 365 Copilot Chat to the navigation bar" in the Settings of the Copilot page in the Microsoft 365 admin center.

4. Microsoft Edge: Use the EdgeSidebarAppUrlHostBlockList policy to control which sidebar apps, including Copilot Chat, are blocked (except the Search app).

   You can find these URLs at edge://sidebar-internals. The sidebar internals JSON file includes a manifest for built-in sidebar apps, including a "target": {"url": "xyz"} parameter for each app. You can use these values to configure the policy.

Add recommended security protections for Copilot Chat

Microsoft helps you prepare for AI tools and companions while also building a strong foundation of security protection. Security recommendations for AI are based on Zero Trust, an industry-standard framework for security. By following these recommendations, you are building a Zero Trust foundation at the same time.

Introducing Copilot Chat to your environment provides the opportunity to tune-up security protections for web-grounded prompts. These include protections for user accounts, devices, and some app data. For more information, see Apply principles of Zero Trust to Microsoft Copilot Chat.

Introducing Copilot to your environment allows you to take a staged approach, starting with protections for web-grounded prompts with Copilot Chat and maturing to protections for Microsoft 365 graph-grounded prompts. Protections for prompts grounded with data provided by your security tools (Security Copilot) focus on tuning up least privilege practices and honing threat protection. For more information, see Use Zero Trust security to prepare for AI companions, including Microsoft Copilots.