Forum Discussion

CoralieSimonaire's avatar
CoralieSimonaire
Brass Contributor
Aug 09, 2026

Hello,

It is essential to distinguish between the two products:

  • Microsoft Copilot (consumer) : Windows Store package MICROSOFT.COPILOT, a consumer application that does not support Microsoft Entra authentication. Any enterprise user attempting to sign in with their work account is automatically redirected to https://m365.cloud.microsoft/chat
  • Microsoft 365 Copilot : a separate enterprise application, accessible via the Microsoft 365 app, Teams, Outlook, or https://m365.cloud.microsoft/chat, covered by Enterprise Data Protection and Entra authentication.

These two applications have no technical dependency on each other. Disabling the consumer app is officially supported by Microsoft and has no impact on Microsoft 365 Copilot.

Microsoft recommended approach to disable the consumer app

Configure an AppLocker policy with the following parameters:

  • Publisher: CN=MICROSOFT CORPORATION, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US
  • Package name: MICROSOFT.COPILOT
  • Package version: * (and above)

When applied, this policy prevents installation if the app is not already on the device, and blocks the app from launching if it is already installed.

Microsoft explicitly states that the TurnOffWindowsCopilot legacy policy (MDM/GPO) is subject to near-term deprecation. AppLocker is the official replacement.

If the app is already deployed, you can also remove it via PowerShell :

$packageFullName = Get-AppxPackage -Name "Microsoft.Copilot" | Select-Object -ExpandProperty PackageFullName Remove-AppxPackage -Package $packageFullName

 

Both applications appearing automatically as Sanctioned through the App Connector is expected and documented behavior by Microsoft. Any app connected via App Connector is automatically set to Sanctioned state in Cloud Discovery.

You can manually change the tag of the consumer app to Unsanctioned in Cloud Apps > Cloud Discovery > Discovered Apps, completely independently, without affecting Microsoft 365 Copilot in any way.

Important: the Unsanctioned tag alone does not block access it only enables monitoring via discovery filters. For effective network-level blocking, you need to enable the Defender for Cloud Apps + Microsoft Defender for Endpoint integration (Network Protection in Block mode).

The propagation delay is up to 3 hours after tagging (up to 1 hour for synchronization + up to 2 hours to push the policy to endpoint devices).

You need :  Defender for Cloud Apps + Defender for Endpoint license or Microsoft 365 E5.

Hope this helps.

More : 

  • https://learn.microsoft.com/windows/client-management/manage-windows-copilot#remove-or-prevent-installation-of-the-microsoft-copilot-app
  • https://learn.microsoft.com/defender-cloud-apps/governance-discovery
  • https://learn.microsoft.com/defender-cloud-apps/mde-govern