Forum Discussion

elbarbary's avatar
elbarbary
Copper Contributor
Aug 07, 2026

deactivate the Microsoft Copilot Consumer App

Hi support .. would like to deactivate the Microsoft Copilot Consumer App while ensuring that Microsoft 365 Copilot (work/enterprise) continues to function normally for users.

Here is my Questions

  1. Is it possible to disable only the Copilot Consumer App while keeping Microsoft 365 Copilot fully functional?
  2. If this is supported, what is the recommended Microsoft approach to achieve this?
  3. Are there any known limitations or potential impacts on Microsoft 365 Copilot or other Microsoft 365 services after disabling the Consumer App?
  4. Is this configuration officially supported by Microsoft?
  5. noticed that in Microsoft Defender for Cloud Apps (Cloud App Catalog), both the Copilot Consumer App and Microsoft 365 Copilot appear as Sanctioned automatically through the App Connector. Is this expected behavior, and can the Consumer App be managed independently without affecting Microsoft 365 Copilot?
microsoft 365 copilot
Microsoft 365 Copilot Admin
security and compliance

2 Replies

  • Jamony's avatar
    Jamony
    MCT
    Aug 09, 2026

    You can manage the consumer Copilot app separately from Microsoft 365 Copilot, but scope controls to the exact app rather than a broad Copilot domain block. Inventory the installed consumer package and determine whether users also access its website. For managed Windows, pilot an Intune uninstall assignment or Windows App Control policy targeting only that package. If web access must be blocked, use your approved filtering control and retest Microsoft 365 Copilot. In Defender for Cloud Apps, connector apps can appear automatically sanctioned. Marking one unsanctioned is primarily a discovery/governance action; automatic blocking requires Defender for Endpoint integration with Network Protection or another supported stream. Do not unsanction shared Microsoft dependencies. Test a small device group, then verify work-account Copilot in Microsoft 365 apps, Teams, and the web before expanding. Narrow targeting should leave Microsoft 365 Copilot unaffected because its packages and endpoints are excluded

  • CoralieSimonaire's avatar
    CoralieSimonaire
    Brass Contributor
    Aug 09, 2026

    Hello,

    It is essential to distinguish between the two products:

    • Microsoft Copilot (consumer) : Windows Store package MICROSOFT.COPILOT, a consumer application that does not support Microsoft Entra authentication. Any enterprise user attempting to sign in with their work account is automatically redirected to https://m365.cloud.microsoft/chat
    • Microsoft 365 Copilot : a separate enterprise application, accessible via the Microsoft 365 app, Teams, Outlook, or https://m365.cloud.microsoft/chat, covered by Enterprise Data Protection and Entra authentication.

    These two applications have no technical dependency on each other. Disabling the consumer app is officially supported by Microsoft and has no impact on Microsoft 365 Copilot.

    Microsoft recommended approach to disable the consumer app

    Configure an AppLocker policy with the following parameters:

    • Publisher: CN=MICROSOFT CORPORATION, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US
    • Package name: MICROSOFT.COPILOT
    • Package version: * (and above)

    When applied, this policy prevents installation if the app is not already on the device, and blocks the app from launching if it is already installed.

    Microsoft explicitly states that the TurnOffWindowsCopilot legacy policy (MDM/GPO) is subject to near-term deprecation. AppLocker is the official replacement.

    If the app is already deployed, you can also remove it via PowerShell :

    $packageFullName = Get-AppxPackage -Name "Microsoft.Copilot" | Select-Object -ExpandProperty PackageFullName Remove-AppxPackage -Package $packageFullName

     

    Both applications appearing automatically as Sanctioned through the App Connector is expected and documented behavior by Microsoft. Any app connected via App Connector is automatically set to Sanctioned state in Cloud Discovery.

    You can manually change the tag of the consumer app to Unsanctioned in Cloud Apps > Cloud Discovery > Discovered Apps, completely independently, without affecting Microsoft 365 Copilot in any way.

    Important: the Unsanctioned tag alone does not block access it only enables monitoring via discovery filters. For effective network-level blocking, you need to enable the Defender for Cloud Apps + Microsoft Defender for Endpoint integration (Network Protection in Block mode).

    The propagation delay is up to 3 hours after tagging (up to 1 hour for synchronization + up to 2 hours to push the policy to endpoint devices).

    You need :  Defender for Cloud Apps + Defender for Endpoint license or Microsoft 365 E5.

    Hope this helps.

    More : 

    • https://learn.microsoft.com/windows/client-management/manage-windows-copilot#remove-or-prevent-installation-of-the-microsoft-copilot-app
    • https://learn.microsoft.com/defender-cloud-apps/governance-discovery
    • https://learn.microsoft.com/defender-cloud-apps/mde-govern