How to pin Copilot Chat in the Microsoft 365 Copilot app, Microsoft Teams, and Outlook
To ensure people across your organization have easy access to Copilot Chat, we recommend you pin Copilot Chat in the Microsoft 365 Copilot app (formerly the Microsoft 365 app), Teams, and Outlook for your users. If pinned, Copilot Chat appears in these apps across web, desktop, and mobile. Copilot Chat in other Microsoft 365 apps like Word, Excel, and PowerPoint requires a Microsoft 365 Copilot license.
Piezīme
Copilot Chat is rolling out for Teams and Outlook on web, desktop, and mobile starting in mid-February 2025. Some features may not be immediately available.
The option to pin Copilot Chat can be found under Settings on the Copilot Chat page in the Microsoft 365 admin center. (Global Admin permissions required).
Global administrators can make changes to Microsoft 365 Copilot Chat pinning settings at any time. Changes take up to 48 hours to go into effect.
Copilot Chat is pinned by default for users with a Microsoft 365 Copilot license.
In addition, admins can pin Copilot Chat for users in Microsoft Teams only through the Teams admin center: Assign an app setup policy with Copilot Chat in the pinned apps to users with an Entra account. Learn more about how to pin in Teams through app setup policies. Like pinning any other app in Teams, Copilot Chat also needs to be allowed for those users through App permission policies or App centric manage if you have migrated to it.
Managing web search queries in Copilot Chat
To help improve the quality of responses, Copilot Chat can use web search queries sent to the Bing search service to ground responses in the latest information from the web. Learn more about how generated web search queries work in Copilot Chat.
You can manage web search in Copilot Chat by using the Allow web search in Copilot policy, which is available only in Cloud Policy service for Microsoft 365. The policy allows web search to be managed at the user- and group-level. The Allow web search in Copilot policy also allows you to manage web search for users with a Microsoft 365 Copilot license.
If you don't configure the Allow web search in Copilot policy, web search is available to users by default in both Microsoft 365 Copilot and Copilot Chat, unless you set the Allow the use of additional optional connected experiences in Office policy to Disabled. But turning off optional connected experiences restricts Microsoft 365 Copilot Chat, Microsoft 365 Copilot, and multiple experiences across Microsoft 365.
If you turn off web search in Microsoft 365 Copilot Chat, web queries are not sent to the Bing search service and Copilot Chat uses only the underlying large language model (LLM) to generate responses.
Network requirements
Copilot Chat enables AI scenarios that access the web, so it may need to connect to specific network endpoints (domains). For Copilot Chat to work, you need to allowlist the following IPs:
*.cloud.microsoft
*.office.net
*.office.com
*.microsoft365.com
m365copilot.com
admin.microsoft.com
browser.events.data.microsoft.com
browser.pipe.aria.microsoft.com
copilotstudio.microsoft.com
login.microsoftonline.com
config.edge.skype.com
graph.microsoft.com
designer.microsoft.com (needed for creating images)
allow WebSocket connections to substrate.office.com:443
For Copilot Chat in Edge to work, you need to allowlist the following IPs:
*.bing.com
*.bing.net
login.live.com
challenges.cloudflare.com
Microsoft 365 Copilot adds generative AI capabilities when using Microsoft 365 applications. It therefore must use the same network connections and endpoints that Microsoft 365 apps use.
See the full documentation of network requirements for Microsoft 365 Copilot, which provides a complete list of domains and WebSockets (WSS) that an organization's network shouldn't block.
Copilot Chat usage report
The Microsoft 365 Copilot Chat usage dashboard provides insights into active usage of Microsoft 365 Copilot Chat. Admins can generate reports on total active users, average daily active users, and active users of Copilot Chat in specific apps. Learn how to get the Microsoft 365 Copilot Chat usage dashboard and how to use it in the documentation for Microsoft 365 reports in the admin center.
How to ensure users access Copilot Chat
With the recent updates to Microsoft 365 Copilot Chat, the Copilot experiences for work and personal use no longer share the same name:
Microsoft 365 Copilot Chat and Microsoft 365 Copilot are for work and education
Microsoft Copilot is for personal use
These experiences are accessed by their own unique entry points (except for Microsoft Edge).
To understand the locations where users can access each distinct experience, see this table:
Location
Personal use
Work or education
Microsoft Copilot (unauthenticated/signed in with personal account)
Copilot Chat (signed in with Entra account) or Microsoft 365 Copilot
Copilot.microsoft.com
Yes
No
Bing.com/chat
Yes
No
Microsoft Copilot app (mobile, desktop/Windows)
Yes
No
M365copilot.com
No
Yes
Copilot.cloud.microsoft
No
Yes
Microsoft 365 Copilot app (web, desktop/Windows, mobile)
No
Yes
Microsoft Edge
Yes
Yes
Microsoft 365 web entry points include microsoft365.com/chat, office.com/chat, and m365.cloud.microsoft/chat.
Piezīme
Copilot in Windows (the Copilot sidebar experience) has been removed via recent Windows updates. Use the Microsoft 365 Copilot app (formerly Microsoft 365 app) to access Copilot Chat.
To ensure your users access Copilot Chat (work and education), instruct them to access it from the locations indicated under 'Work and education' in the table.
To prevent access to Microsoft Copilot (personal use), block access to the locations indicated under 'Personal use' in the table. Additionally, you can manage whether your users can sign in to the Microsoft 365 apps using a personal account (MSA). To manage user sign-in to Microsoft 365 apps using a personal account (MSA), use tenant restriction V2.
Manage Copilot Chat in Edge
Users can access Copilot Chat through the Copilot icon in the Edge browser UI when they're signed in with their Entra account.
Users can modify this permission by going to Microsoft Edge > Settings > Sidebar > Copilot, and then turning on or off the 'Allow Microsoft to access page content' toggle.
Admins can use multiple group policy settings to manage the behavior of the Copilot Chat in Edge sidebar:
To allow or block Copilot Chat in Edge from using browsing context, use the EdgeEntraCopilotPageContext policy. This policy can prevent Copilot Chat from using webpage or PDF content when it formulates responses to prompts.
To disable Copilot Chat in Edge entirely, use the HubsSidebarEnabled policy. Blocking Copilot Chat in Edge automatically blocks all Edge sidebar apps from being enabled.
To allow or block Copilot Chat in Edge from using browsing context when users are signed in with their personal MSA Bing account while in the Edge work profile, use the CopilotPageContext policy. This policy prevents Microsoft Copilot (personal use) from using webpage or PDF content when it formulates responses to prompts.
Mapping the Copilot key
The Copilot key was introduced to some PC keyboards in 2024. It was originally intended to invoke Copilot in Windows, but this use shifted as we evolved Microsoft Copilot experiences on Windows to better address your feedback and needs.
As we previously shared, Copilot in Windows was removed, and the Microsoft Copilot app is now only available to personal users authenticating with a Microsoft account. The Microsoft Copilot app does not work for commercial users authenticating with a Microsoft Entra account. Users who wish to use Copilot for work or education can access Copilot Chat in the Microsoft 365 Copilot app. With this change, IT admins may need to take steps to ensure employees authenticating with a Microsoft Entra account can access Copilot Chat in the Microsoft 365 Copilot app via the Copilot key.
We recommend that managed commercial and educational organizations remap the Copilot key to invoke the Microsoft 365 Copilot app for simplified access to Copilot Chat experiences designed for work and education. Find detailed instructions on how to remap the Copilot key here. Additionally, admins must pin Copilot Chat for their users to access it in the Microsoft 365 Copilot app. See How to pin Microsoft Copilot in the Microsoft 365 app, Microsoft Teams, and Outlook.
Managing Copilot Chat in the Microsoft 365 Copilot mobile app
Microsoft 365 Copilot Chat is also available in the Microsoft 365 Copilot mobile app when eligible users are signed in with their Microsoft Entra accounts. Users get the same data security, privacy, and compliance standards and Copilot Chat features directly within the Microsoft 365 Copilot app.
To manage Copilot Chat in the Microsoft 365 (Office) app, admins can use the Microsoft Intune policy, group policy, or the Microsoft 365 admin center. Refer to documentation found here: Manage Microsoft 365 (Office) for iOS and Android with Intune.
Piezīme
For Copilot Chat to appear in the Microsoft 365 Copilot mobile app, a user must be eligible for one of the following service plans and it must be enabled: "Office for the Web," "Office for the Web for Developer," or "Office for the Web for Education." Enabling these plans can be managed as part of the user's licenses.
Managing Copilot Chat in the Microsoft 365 Copilot app and Outlook
Microsoft 365 Copilot Chat is available through the Copilot app in the Microsoft 365 Copilot app and Outlook. The Copilot app is a Teams app that works on the Microsoft 365 Copilot app (formerly the Microsoft 365 app) and Outlook, which admins can manage through the Integrated Apps portal in the Microsoft 365 admin center (MAC). Learn more about Teams apps that work on Outlook and Microsoft 365.
Admins can use the Integrated Apps portal in MAC to deploy the Copilot app or manage its availability in the app store for users or user groups.
Piezīme
Blocking the Copilot app through Integrated Apps is a tenant-wide control for all users, including those users assigned a Microsoft 365 Copilot license. Using this control blocks the Copilot app in the Microsoft 365 Copilot app and Outlook, and will additionally block access to copilot.cloud.microsoft for all users. To remove access to the Copilot app only for users without a Microsoft 365 Copilot license while maintaining it for users with a Microsoft 365 Copilot license, please see Removing access to Copilot Chat.
Managing Copilot Chat in Teams
Admins can manage Copilot Chat in Teams through the Copilot app in the Teams admin center. Like all other Teams apps, admins manage a single Copilot app in Teams for users with and without a license. To manage Microsoft 365 Copilot Chat, you should manage the users who don't have a Microsoft 365 Copilot license. For users who do have a Microsoft 365 Copilot license, you should confirm that they're assigned access to the app.
If you wish to prevent access to Microsoft 365 Copilot Chat for your users, follow these steps:
Do not pin Copilot Chat: The Copilot app is used to access Copilot Chat and is not pinned in the Microsoft 365 Copilot app, Teams, and Outlook by default. To prevent users from being asked to pin the Copilot app, use the control found under Settings on the Copilot page in the Microsoft 365 admin center. Select "Do not pin Microsoft 365 Copilot Chat to the navigation bar" then uncheck "Allow users to be asked whether they want to pin it." Learn more about pinning Microsoft 365 Copilot Chat.
Piezīme
This only applies to users without a Microsoft 365 Copilot license. The Copilot app will still be pinned in the Microsoft 365 Copilot app for users who are assigned a Microsoft 365 Copilot license.
Microsoft 365 Copilot app and Outlook: Only allow the Copilot app in the Microsoft 365 Copilot app and Outlook for users who are assigned a Microsoft 365 Copilot license—this will ensure your licensed users continue to have access to Copilot Chat via the Copilot app and prevent your unlicensed users from discovering the Copilot app in the app store. The Copilot app is a Teams app that works on the Microsoft 365 Copilot app (formerly the Microsoft 365 app) and Outlook. You can manage the Copilot app through the Integrated Apps portal in the Microsoft 365 admin center (MAC). Learn more about controls for managing Teams apps that work on Outlook and the Microsoft 365 Copilot app.
To allow the Copilot app only for users with a Microsoft 365 Copilot license, create a user group for these users, then deploy the Copilot app and make it available only for these users.
Piezīme
If you block the Copilot app using the Integrated app control, you will block the Copilot app tenant-wide, including users assigned a Microsoft 365 Copilot license.
Teams: Only allow the Copilot app in Teams for users who are assigned a Microsoft 365 Copilot license—this will ensure your licensed users continue to have access to Copilot Chat. Don't allow it for users without a license. Learn more about allowing users access to apps in Microsoft Teams. Don't pin the Copilot app in app setup policies for users without a Microsoft 365 Copilot license. You need to do this even if you selected "Do not pin Microsoft 365 Copilot Chat to the navigation bar" in the Settings of the Copilot page in the Microsoft 365 admin center.
Piezīme
If you'd like to continue to offer Copilot Chat to your users, but don't want web search queries as part of the experience, refer to Managing web search queries in Copilot Chat.
Web: Block copilot.cloud.microsoft using a corporate proxy.
Piezīme
If you block copilot.cloud.microsoft, please direct your Microsoft 365 Copilot licensed users to access Copilot Chat from m365copilot.com or directly in the Microsoft 365 Copilot app at m365.cloud.microsoft/chat.
Microsoft Edge: Use the EdgeSidebarAppUrlHostBlockList policy to control which sidebar apps, including Copilot Chat, are blocked (except the Search app).
You can find these URLs at edge://sidebar-internals. The sidebar internals JSON file includes a manifest for built-in sidebar apps, including a "target": {"url": "xyz"} parameter for each app. You can use these values to configure the policy.
True (default): Copilot Chat is enabled for the tenant
False: Copilot Chat is disabled for the tenant
Piezīme
This also blocks Copilot Chat in the Microsoft 365 Copilot mobile app for users with a Microsoft 365 Copilot license.
Add recommended security protections for Copilot Chat
Microsoft helps you prepare for AI tools and companions while also building a strong foundation of security protection. Security recommendations for AI are based on Zero Trust, an industry-standard framework for security. By following these recommendations, you are building a Zero Trust foundation at the same time.
Introducing Copilot Chat to your environment provides the opportunity to tune-up security protections for web-grounded prompts. These include protections for user accounts, devices, and some app data. For more information, see Apply principles of Zero Trust to Microsoft Copilot Chat.
Introducing Copilot to your environment allows you to take a staged approach, starting with protections for web-grounded prompts with Copilot Chat and maturing to protections for Microsoft 365 graph-grounded prompts. Protections for prompts grounded with data provided by your security tools (Security Copilot) focus on tuning up least privilege practices and honing threat protection. For more information, see Use Zero Trust security to prepare for AI companions, including Microsoft Copilots.
This learning path examines the Microsoft 365 Copilot design and its security and compliance features, and it provides instruction on how to implement Microsoft 365 Copilot.