Manage Copilot Cowork

  • 8 minutes

Copilot Cowork is generally available, but availability doesn't grant a user access. Cowork access depends on licensing, environment enablement, and usage-based billing. Web-search behavior is a separate administrative decision that you manage through Cloud Policy.

This unit separates those controls so you can test the supported web-search state without enabling chargeable Cowork access or generating usage.

Distinguish availability from access

A user needs an active Microsoft 365 Copilot license, an environment where Cowork is enabled, and usage-based billing enabled for Cowork. An administrator grants access through a spending policy that selects Cowork.

A spending policy is an access control, not only a budget. A user in its scope can use Cowork even when the credit limit is small. To keep a user out of Cowork, don't include that user in any spending policy that selects Cowork.

Cowork is no longer managed through Agents > All Agents > Cowork in the Microsoft 365 admin center. The Cowork agent entry remains visible, but its configuration has no effect on access. Don't use that legacy surface as evidence that access is allowed or blocked.

Important

The task in this unit doesn't create, enable, or exercise a spending policy. Enabling a spending policy that selects Cowork can authorize usage-based charges and requires separate billing approval.

Use the Office Apps Administrator role when possible. Security Administrator and Global Administrator can also manage Cloud Policy. The administrator needs access to the Microsoft 365 Apps admin center and a supported Microsoft 365 Apps subscription. This capability isn't supported for Microsoft 365 operated by 21Vianet, GCC, GCC High, or Department of Defense environments.

Cloud Policy applies settings to user objects rather than devices, so scope your pilot group to actual user accounts. A device-only group doesn't provide a valid user scope.

For more information, see Get started with Copilot Cowork and Manage Copilot Cowork for your organization.

Allow web search in Microsoft Copilot is available only in the Cloud Policy service for Microsoft 365. Set Configuration setting to Enabled, and then set Options to Disabled in Microsoft 365 Copilot Work mode, Enabled in Microsoft 365 Copilot Web mode and Microsoft 365 Copilot Chat.

For assigned users, this state has these effects:

  • Disables web search in Copilot Work mode, Researcher, and Cowork.
  • Retains web search in Copilot Web mode and Copilot Chat.
  • Leaves Cowork access unchanged because a spending policy controls access.

Cowork doesn't have a user web-search toggle — its web-search behavior always follows the Cloud Policy state, with no user override to check.

For policy details and role eligibility, see Manage web search and the Microsoft 365 Apps admin center overview.

The Cloud Policy wizard configures group scope on a separate stage from the setting itself. The following screenshot shows the policy-setting pane for the Relecloud Copilot web-search pilot group before you save it — group assignment and the save action happen on other stages of the wizard.

Screenshot of Allow web search in Copilot enabled for Work and Web modes.

Configure Cowork web search for a pilot group

This task changes the same policy Cloud Policy manages tenant-wide, but scoped to a single pilot group so you can confirm the outcome before you extend it further.

  1. Confirm that your Relecloud Copilot web-search pilot Microsoft Entra security group contains the users you want to pilot the change with. Don't add this group to a spending policy — that's the unrelated Cowork-access decision from earlier in this unit.
  2. In the Microsoft 365 Apps admin center, open Customization > Policy Management, and create a Cloud Policy configuration scoped to that group.
  3. Find Allow web search in Copilot, set Configuration setting to Enabled, set Additional setting > Options to Disabled in Microsoft 365 Copilot Work mode, Enabled in Microsoft 365 Copilot Web mode and Microsoft 365 Copilot Chat, and select Apply.
  4. Review the group assignment and policy status, then save.
  5. Expect the effect within 90 minutes for members who already retrieve Cloud Policy, and up to 24 hours otherwise: Cowork and Copilot Work mode lose web search, while Copilot Web mode and Chat keep it.

A saved Cloud Policy record confirms what you configured and whom you targeted — it doesn't confirm that a specific device has retrieved it yet. Runtime behavior in Copilot doesn't confirm it either: Copilot decides for itself whether web information improves a given answer, so a missing citation or web result during the retrieval window doesn't mean the policy failed.

Resolve unexpected behavior

Use the applicable branch when the pilot group's behavior doesn't match what you configured:

  • Policy unavailable: Verify the administrator role, supported subscription, environment, and that you're using Cloud Policy instead of the Microsoft 365 admin-center shortcut.
  • Group unavailable: Verify that the group contains user objects, not a device-only scope.
  • Unexpected runtime behavior: Recheck the effective policy assignment and allow time for policy retrieval before assuming the setting didn't take.
  • Conflicting policy: Review Cloud Policy priority and assignments before you change another configuration.

If the pilot doesn't go as planned, remove the group from the policy scope or delete the policy configuration — the same way you'd reverse any Cloud Policy change.