Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Important
- This is a preview feature provided under Microsoft Product Terms.
- Preview features may have restricted functionality and may not be released for general availability. These features are available before an official release so that customers can get early access and provide feedback.
- You need to be part of the Frontier preview program to get early access. Frontier connects you directly with Microsoft's latest AI innovations. Frontier previews are subject to the existing preview terms of your customer agreements. As these features are still in development, their availability and capabilities may change over time.
When you run a project on your device, Copilot Code works inside a protected environment that limits what it can read, change, and reach on the network to only what you and your organization allow. This protection lets your organization turn on local mode by default while keeping the rest of your device and network out of reach.
This article explains what the protected environment covers, how permissions work inside it, and the controls administrators use to manage it. To choose between running on your device and running in the cloud, see Get started with Copilot Code. For administrator deployment and policy, see Manage Copilot Code for your organization.
What the protected environment covers
When Copilot Code runs a project on your device, everything it does on your behalf runs inside the same protected boundary:
- The work Copilot Code does directly, such as reading and writing files in your project.
- Any commands Copilot Code runs to build, test, or preview your project.
- The built-in tools Copilot Code uses to read and write files.
- Any connected tools you add.
Nothing Copilot Code starts on your behalf can operate outside this boundary. The Copilot app itself starts Copilot Code but sits outside the boundary, so the protection applies specifically to the work Copilot Code performs for your project.
File access
By default, Copilot Code can read and write files inside your project folder and can reach the caches, registries, and configuration files that common build tools need. It doesn't have access to the rest of your device unless you or your administrator grant it.
| Access | Default behavior |
|---|---|
| Your project folder | Read and write, granted automatically |
| Build tool caches and configuration | Read access, granted automatically so builds work |
| Other folders on your device | No access unless explicitly allowed |
Your administrator can allow additional folders and can block specific paths. A blocked path is always enforced, even if another rule would otherwise allow it.
Network access
Copilot Code's access to the network from your device follows the setting your organization chooses.
| Setting | What it means |
|---|---|
| Allow all outbound connections | Copilot Code can reach any host from the protected environment. |
| Allow only approved hosts | Copilot Code can reach only the hosts your organization approves. |
| Block outbound connections | Copilot Code can't make outbound network connections. |
Inbound connections are limited to your own device. This limitation lets you open a live preview of a web app you're building at a local address, while connections from other machines are refused.
How permissions work inside the boundary
Copilot Code asks for your approval before it takes actions that need it, such as running a command or reaching a folder outside your project. These approvals work inside the protected boundary—they let Copilot Code do something that's already permitted within the boundary. They never widen it.
- Approvals stay inside the boundary: Approving an action can't give Copilot Code access beyond what your organization's settings allow.
- You only see approvals that can succeed: Copilot Code doesn't ask you to approve an action that the protected environment would then refuse.
- The boundary can't be turned off from inside a project: After your administrator turns on secure local execution, you can't bypass it from your project or its settings.
For how to review and respond to approval prompts, see Use Copilot Code.
When an action is blocked
If the protected environment refuses an action, Copilot Code tells you which rule refused it—for example, a folder that's outside the allowed paths, or a host that isn't on the approved list—and how to fix it, such as adding the host to the approved list. Copilot Code doesn't quietly retry the action without protection or hide the failure.
If the protected environment can't be set up at all, Copilot Code doesn't start. If it can't be set up for a specific command, that command doesn't run. Copilot Code checks that your device supports secure local execution when it starts and tells you once, clearly, rather than failing partway through a task.
Supported operating systems
Secure local execution is available on Windows 11, version 24H2 or later. Support for more platforms, including Mac and earlier versions of Windows, is planned for a future release.
Note
If your device doesn't support secure local execution and your organization requires it for local mode, you can still run projects in the cloud. See Get started with Code.
Administrator controls
Administrators manage secure local execution through the Copilot policy in the Microsoft 365 admin center. Product defaults provide the starting configuration and policy can override them.
| Control | Default | What it does |
|---|---|---|
| Secure local execution | On for local mode | Runs local projects inside the protected environment. |
| Policy exemption group | None | Lets specific users or groups run local projects without the protected environment. |
| Allowed folders | Project folder and build tool files | Grants read or read/write access to additional folders. |
| Blocked file paths | None | Blocks specific folders. A blocked path always takes precedence over any allow rule. |
| Outbound network access | Allow approved hosts | Sets whether Copilot Code can reach all hosts, only approved hosts, or no hosts. |
When your organization manages a setting, users can see that it's managed but can't change it. When your organization doesn't manage a setting, users can adjust it for their own projects. Blocked paths always take precedence over allowed paths, whether the allow rule comes from the product default, an administrator, or a user.
For the full set of administrator controls, including enabling the Code tab, execution location, GitHub connection, work context, and audit logs, see Manage Copilot Code for your organization.