Manage Copilot Cowork for your organization

  • Applies to: Microsoft 365 Copilot

Learn how to manage plugins, models, browser use, security and compliance, and usage-based billing in Copilot Cowork.

Allow access to Cowork

To allow users to access Cowork, admins must enable usage-based billing. To learn how to set up and enable usage-based billing, see Managing AI experiences enabled by usage-based billing.

Make Cowork discoverable to end users

IT admins can control Cowork's discoverability for end users. To learn more, see Discovery setting for AI experiences enabled by usage-based billing.

If an admin makes Cowork discoverable to end users but doesn't enable usage-based billing, end users can request to access Cowork directly in the app. Admins need to review and approve requests based on policy, cost, and compliance.

Manage plugins

Cowork supports plugins from the Microsoft 365 App Store that add skills and connectors to extend what Cowork can do. As an admin, you control which plugins are available, how they're deployed, and who can use them.

For the full admin guide on plugin deployment, availability controls, connector authentication, and monitoring, see Manage plugins for Cowork and Manage plugins in Microsoft 365 admin center.

Manage models

Cowork ships with several models: Claude Opus and Sonnet variants from Anthropic, the Sonnet+Opus Advisor pairing, GPT 5.5, and Imagen 2 for image generation.

As an admin, you can turn off individual models in the Microsoft 365 admin center under Copilot settings.

Microsoft might deploy other AI models for Microsoft 365 Copilot to use that are hosted and operated by Microsoft. These models are governed by the same contractual and data protection commitments already in place, including that no data leaves Microsoft. For more information about models that Microsoft 365 Copilot might use, see Understanding AI functionality and models in Microsoft Online Services.

For details on each model and how end users pick them, see Choose a model for Cowork.

Browser use

Cowork can complete web tasks for users in Microsoft Edge on their device, using their existing sign-ins and your organization's policies. Because the browser tab runs on the user's machine, browser tasks inherit the same conditional access, DLP, and tenant browsing policies you already apply to your users.

As an admin, you control:

  • Whether browser use is available to users—The Cowork Browsing tenant setting in the Microsoft 365 admin center turns the capability on or off for your organization.
  • Which sites users can reach through Cowork—Cowork respects any allowlist, blocklist, and view-only policies your organization applies to web browsing in Microsoft Edge.
  • Audit visibility—Each browser task Cowork starts on behalf of a user is recorded in the unified audit log alongside other Cowork activity.

For the end-user experience, see Use the local browser with Cowork.

Usage-based billing

Cowork uses a usage-based billing model. Activities such as model responses, tool and skill calls, image generation, and browser tasks count toward your organization's consumption. Admins see usage in the Microsoft 365 admin center and can set per-user or per-group limits. To learn more about usage-based billing, visit Microsoft 365 pay-as-you-go services.

Learn to Set up and configure Usage-based billing.

Learn more about what Copilot Credits are at What is Copilot Credits?.

Learn more about how to estimate costs with the Cowork cost estimator.

Learn how to setup Copilot Credits.

Security and compliance

Microsoft Purview is available to secure and govern Cowork, please see Use Microsoft Purview to manage data security & compliance for Microsoft 365 Copilot Cowork.

Data residency

Copilot Cowork follows the same data residency model as Copilot. For more details, see Data residency for Microsoft 365 Copilot.

Related content

  • Last updated on