Manage Microsoft 365 Copilot Chat
Microsoft 365 Copilot Chat eligibility
Copilot Chat is available at no additional cost for all Entra account users with a Microsoft 365 subscription.
US government cloud customers and students under 18 are not yet eligible. To provide access to Copilot Chat for students aged 18 and older, admins must adjust the user profile. See Elevating User Management with Age Group and Consent Provided Fields in Microsoft Entra.
How to pin Copilot Chat in the Microsoft 365 Copilot app, Microsoft Teams, and Outlook
To ensure people across your organization have easy access to Copilot Chat, we recommend you pin Copilot Chat in the Microsoft 365 Copilot app (formerly the Microsoft 365 app), Teams, and Outlook for your users. If pinned, Copilot Chat appears in these apps across web, desktop, and mobile. Copilot Chat in other Microsoft 365 apps like Word, Excel, and PowerPoint requires a Microsoft 365 Copilot license.
Note
Copilot Chat is rolling out for Teams and Outlook on web, desktop, and mobile starting January 15, 2025. Some features may not be immediately available.
The option to pin Copilot Chat can be found under Settings on the Copilot Chat page in the Microsoft 365 admin center. (Global Admin permissions required).
Get more details on how to pin Microsoft 365 Copilot Chat for your users.
Note
Copilot Chat is pinned by default for users with a Microsoft 365 Copilot license.
In addition, admins can pin Copilot Chat for users in Microsoft Teams only through the Teams admin center: Assign an app setup policy with Copilot Chat in the pinned apps to users with an Entra account. Learn more about how to pin in Teams through app setup policies. Like pinning any other app in Teams, Copilot Chat also needs to be allowed for those users through App permission policies or App centric manage if you have migrated to it.
Managing web search queries in Copilot Chat
To help improve the quality of responses, Copilot Chat can use web search queries sent to the Bing search service to ground responses in the latest information from the web. Learn more about how generated web search queries work in Copilot Chat.
You can manage web search in Copilot Chat by using the Allow web search in Copilot policy, which is available only in Cloud Policy service for Microsoft 365. The policy allows web search to be managed at the user- and group-level. The Allow web search in Copilot policy also allows you to manage web search for users with a Microsoft 365 Copilot license.
If you don't configure the Allow web search in Copilot policy, web search is available to users by default in both Microsoft 365 Copilot and Copilot Chat, unless you set the Allow the use of additional optional connected experiences in Office policy to Disabled. But turning off optional connected experiences restricts Microsoft 365 Copilot Chat, Microsoft 365 Copilot, and multiple experiences across Microsoft 365.
For more information on the Allow web search in Copilot policy, see Data, privacy, and security for web queries in Microsoft 365 Copilot and Microsoft 365 Copilot Chat.
Note
If you turn off web search in Microsoft 365 Copilot Chat, web queries are not sent to the Bing search service and Copilot Chat uses only the underlying large language model (LLM) to generate responses.
Network requirements
Copilot Chat enables AI scenarios that access the web, so it may need to connect to specific network endpoints (domains). For Copilot Chat to work, you need to allowlist the following IPs:
- *.cloud.microsoft
- *.office.net
- *.office.com
- *.microsoft365.com
- m365copilot.com
- admin.microsoft.com
- browser.events.data.microsoft.com
- browser.pipe.aria.microsoft.com
- copilotstudio.microsoft.com
- login.microsoftonline.com
- config.edge.skype.com
- graph.microsoft.com
- designer.microsoft.com (needed for creating images)
- allow WebSocket connections to substrate.office.com:443
For Copilot Chat in Edge to work, you need to allowlist the following IPs:
- *.bing.com
- *.bing.net
- login.live.com
- challenges.cloudflare.com
Microsoft 365 Copilot adds generative AI capabilities when using Microsoft 365 applications. It therefore must use the same network connections and endpoints that Microsoft 365 apps use.
See the full documentation of network requirements for Microsoft 365 Copilot, which provides a complete list of domains and WebSockets (WSS) that an organization's network shouldn't block.
Copilot Chat usage report
The Microsoft 365 Copilot Chat usage dashboard provides insights into active usage of Microsoft 365 Copilot Chat. Admins can generate reports on total active users, average daily active users, and active users of Copilot Chat in specific apps. Learn how to get the Microsoft 365 Copilot Chat usage dashboard and how to use it in the documentation for Microsoft 365 reports in the admin center.
How to ensure users access Copilot Chat
With the recent updates to Microsoft 365 Copilot Chat, the Copilot experiences for work and personal use no longer share the same name:
- Microsoft 365 Copilot Chat and Microsoft 365 Copilot are for work and education
- Microsoft Copilot is for personal use
These experiences are accessed by their own unique entry points (except for Microsoft Edge).
To understand the locations where users can access each distinct experience, see this table:
| Location | Personal use | Work or education |
|---|---|---|
| Microsoft Copilot (unauthenticated/signed in with personal account) | Copilot Chat (signed in with Entra account) or Microsoft 365 Copilot | |
| Copilot.microsoft.com | Yes | No |
| Bing.com/chat | Yes | No |
| Microsoft Copilot app (mobile, desktop/Windows) | Yes | No |
| M365copilot.com | No | Yes |
| Copilot.cloud.microsoft | No | Yes |
| Microsoft 365 Copilot app (web, desktop/Windows, mobile) | No | Yes |
| Microsoft Edge | Yes | Yes |
Microsoft 365 web entry points include microsoft365.com/chat, office.com/chat, and m365.cloud.microsoft/chat.
Note
Copilot in Windows (the Copilot sidebar experience) has been removed via recent Windows updates. Use the Microsoft 365 Copilot app (formerly Microsoft 365 app) to access Copilot Chat.
To ensure your users access Copilot Chat (work and education), instruct your users to access it from the locations indicated under 'Work and education' in the table.
To prevent access to Microsoft Copilot (personal use), block access to the locations indicated under 'Personal use' in the table. Additionally, you can manage whether your users can sign in to the Microsoft 365 apps using a personal account (MSA). To manage user sign-in to Microsoft 365 apps using a personal account (MSA), use tenant restriction V2.
Manage Copilot Chat in Edge
Users can access Copilot Chat through the Copilot icon in the Edge browser UI when they're signed in with their Entra account.
Users can modify this permission by going to Microsoft Edge > Settings > Sidebar > Copilot, and then turning on or off the 'Allow Microsoft to access page content' toggle.
Admins can use multiple group policy settings to manage the behavior of the Copilot Chat in Edge sidebar:
- To allow or block Copilot Chat in Edge from using browsing context, use the EdgeEntraCopilotPageContext policy. This policy can prevent Copilot Chat from using webpage or PDF content when it formulates responses to prompts.
- To disable Copilot Chat in Edge entirely, use the HubsSidebarEnabled policy. Blocking Copilot Chat in Edge automatically blocks all Edge sidebar apps from being enabled.
- To allow or block Copilot Chat in Edge from using browsing context when users are signed in with their personal MSA Bing account while in the Edge work profile, use the CopilotPageContext policy. This policy prevents Microsoft Copilot (personal use) from using webpage or PDF content when it formulates responses to prompts.
Mapping the Copilot key
The Copilot key was introduced to some PC keyboards in 2024. It was originally intended to invoke Copilot in Windows, but this use shifted as we evolved Microsoft Copilot experiences on Windows to better address your feedback and needs.
As we previously shared, Copilot in Windows was removed, and the Microsoft Copilot app is now only available to personal users authenticating with a Microsoft account. The Microsoft Copilot app does not work for commercial users authenticating with a Microsoft Entra account. Users who wish to use Copilot for work or education can access Copilot Chat in the Microsoft 365 Copilot app. With this change, IT admins may need to take steps to ensure employees authenticating with a Microsoft Entra account can access Copilot Chat in the Microsoft 365 Copilot app via the Copilot key.
We recommend that managed commercial and educational organizations remap the Copilot key to invoke the Microsoft 365 Copilot app for simplified access to Copilot Chat experiences designed for work and education. Find detailed instructions on how to remap the Copilot key here. Additionally, admins must pin Copilot Chat for their users to access it in the Microsoft 365 Copilot app. See How to pin Microsoft Copilot in the Microsoft 365 app, Microsoft Teams, and Outlook.
Managing Copilot Chat in the Microsoft 365 Copilot mobile app
Microsoft 365 Copilot Chat is also available in the Microsoft 365 Copilot mobile app when eligible users are signed in with their Microsoft Entra accounts. Users get the same data security, privacy, and compliance standards and Copilot Chat features directly within the Microsoft 365 Copilot app.
To manage Copilot Chat in the Microsoft 365 (Office) app, admins can use the Microsoft Intune policy, group policy, or the Microsoft 365 admin center. Refer to documentation found here: Manage Microsoft 365 (Office) for iOS and Android with Intune.
Note
For Copilot Chat to appear in the Microsoft 365 Copilot mobile app, a user must be eligible for one of the following service plans and it must be enabled: "Office for the Web," "Office for the Web for Developer," or "Office for the Web for Education." Enabling these plans can be managed as part of the user's licenses.
Managing Copilot Chat in Teams
Admins can manage Copilot Chat in Teams through the Copilot app in the Teams admin center. Like all other Teams apps, admins manage a single Copilot app in Teams for users with and without a license. To manage Microsoft 365 Copilot Chat, you should manage the users who don't have a Microsoft 365 Copilot license. For users who do have a Microsoft 365 Copilot license, you should confirm that they're assigned access to the app.
Admins can manage access and pinning for Microsoft 365 Copilot Chat. See how to manage app access and how to pin Microsoft 365 Copilot Chat in the Microsoft 365 app, Microsoft Teams, and Outlook.
Removing access to Copilot Chat
If you wish to prevent access to Microsoft 365 Copilot Chat for your users, follow these steps:
Microsoft 365 Copilot app, Teams, and Outlook: Using the control found under Settings on the Copilot page in the Microsoft 365 admin center, select "Do not pin Microsoft 365 Copilot Chat to the navigation bar." Then uncheck "Allow users to be asked whether they want to pin it." Learn more about pinning Microsoft 365 Copilot Chat.
Teams: Only allow the Copilot app in Teams for users who are assigned a Microsoft 365 Copilot license; don't allow it for users without a license. Learn more about allowing users access to apps in Microsoft Teams. Don't pin the Copilot app in app setup policies for users without a Microsoft 365 Copilot license. Note: You need to do this even if you selected "Do not pin Microsoft 365 Copilot Chat to the navigation bar" in the Settings of the Copilot page in the Microsoft 365 admin center.
Note
This only applies to Microsoft 365 Copilot Chat users. Copilot Chat will still be pinned in the Microsoft 365 Copilot app for users who are assigned a Microsoft 365 Copilot license.
Web: After following Steps 1 and 2, block copilot.cloud.microsoft using a corporate proxy.
Note
If you block copilot.cloud.microsoft, please direct your Microsoft 365 Copilot licensed users to access Copilot Chat from m365copilot.com or directly in the Microsoft 365 Copilot app at m365.cloud.microsoft/chat.
Microsoft Edge: Use the EdgeSidebarAppUrlHostBlockList policy to control which sidebar apps, including Copilot Chat, are blocked (except the Search app).
- You can find these URLs at edge://sidebar-internals. The sidebar internals JSON file includes a manifest for built-in sidebar apps, including a "target": {"url": "xyz"} parameter for each app. You can use these values to configure the policy.
Microsoft 365 Copilot mobile app: Use Intune app protection and configuration policies with Microsoft 365 (Office) for iOS and Android to ensure collaboration experiences are always accessed with safeguards in place.
- Key: com.microsoft.office.officemobile.BingChatEnterprise.IsAllowed
- Value:
- True (default): Copilot Chat is enabled for the tenant
- False: Copilot Chat is disabled for the tenant
Note
This also blocks Copilot Chat in the Microsoft 365 Copilot mobile app for users with a Microsoft 365 Copilot license.