CopilotBrowserUseAllowList

Allow Copilot browser use on specified URLs

Supported versions

  • Windows: ≥ 158
  • macOS: ≥ 158
  • Android: Not supported
  • iOS: Not supported

Description

Defines the URLs where Copilot browser use is allowed. Users can't modify this policy.

If you don't configure this policy, all URLs are allowed unless they match an entry in the CopilotBrowserUseBlockList policy.

If you configure this policy with a non-empty list, a URL must match an allow rule that takes precedence over any matching block rule. A configured but empty list allows no URLs. To allow all URLs, include '*'. A more specific block list rule still blocks access when the allow list contains '*'.

URL patterns use the same syntax as the URLAllowlist and URLBlocklist policies. Patterns can specify schemes, hosts, ports, paths, and query conditions. A hostname such as contoso.com also matches its subdomains. Start the hostname with a dot, such as .contoso.com, to match only that host. Don't use '[*.]contoso.com' or '*.contoso.com'; these forms don't match URLs.

Paths match by prefix, not by path segment. For example, contoso.com/team matches both /team/report and /teamwork.

The most specific matching rule determines whether a URL is allowed or blocked. Exact-host rules take precedence over rules that include subdomains, followed by longer hostnames, longer paths, and more query conditions. If allow and block rules are equally specific, the allow rule wins. Schemes and ports restrict matching but don't increase a rule's precedence.

Only the first 1,500 entries in each list are used; later entries are ignored.

This policy doesn't enable Copilot browser use. The private-network and intranet check also reads this allow list using content-settings patterns, which differ from the URL syntax above. Entries that win under that grammar exempt destinations from that check; '*' can exempt private IP addresses, localhost and intranet hosts. '[*.]contoso.com' can grant that exemption but doesn't match the browser-use URL list, while contoso.com includes subdomains for the URL list but exempts only the exact host from the private-network check. Other safety checks still apply. For guidance on formatting URL patterns, see https://go.microsoft.com/fwlink/?linkid=2095322.

Supported features

  • Can be mandatory: Yes
  • Can be recommended: No
  • Dynamic Policy Refresh: Yes
  • Per Profile: Yes
  • Applies to a profile that is signed in with a Microsoft account: No

Data type

  • List of strings

Windows information and settings

Group Policy (ADMX) info

  • GP unique name: CopilotBrowserUseAllowList
  • GP name: Allow Copilot browser use on specified URLs
  • GP path (Mandatory): Administrative Templates/Microsoft Edge
  • GP path (Recommended): N/A
  • GP ADMX file name: MSEdge.admx

Example value

https://www.contoso.com/approved

contoso.edu

contoso.net

.login.contoso.us

Registry settings

  • Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge\CopilotBrowserUseAllowList
  • Path (Recommended): N/A
  • Value name: 1, 2, 3, ...
  • Value type: List of REG_SZ

Example registry value

SOFTWARE\Policies\Microsoft\Edge\CopilotBrowserUseAllowList\1 =

https://www.contoso.com/approved

SOFTWARE\Policies\Microsoft\Edge\CopilotBrowserUseAllowList\2 =

contoso.edu

SOFTWARE\Policies\Microsoft\Edge\CopilotBrowserUseAllowList\3 =

contoso.net

SOFTWARE\Policies\Microsoft\Edge\CopilotBrowserUseAllowList\4 =

.login.contoso.us

Mac information and settings

  • Preference Key name: CopilotBrowserUseAllowList
  • Example value:
<array>
  <string>https://www.contoso.com/approved</string>
  <string>contoso.edu</string>
  <string>contoso.net</string>
  <string>.login.contoso.us</string>
</array>

See also

  • Last updated on