You can block Copilot Chat. That does not fix what Copilot can see
A question keeps coming up in admin forums: "How do I turn Copilot off for everyone?", usually answered with "you can't". Microsoft's documentation says you can. Admins can block Copilot Chat for all users, or for chosen users and groups, including users who hold an eligible Copilot licence. That is an access switch. It decides who gets a chat window. It does not decide what is findable in your tenant, and it is not the control that fixes oversharing.
What Learn says you can do
| Action | What the documentation says |
|---|---|
| Block Copilot Chat | Admins can block access for all users or for specific users and groups, including users assigned an eligible Copilot licence. Users can no longer use Copilot Chat in supported experiences, including the Copilot app, Outlook, Teams and web-based Chat |
| What blocked users see | They might still see Chat in the Copilot app navigation. Selecting it shows a message that access is disabled by organisational policy. You can add a custom link to your own guidance (Copilot > Settings > View all > Custom link for blocked Microsoft Copilot app) |
| Limit to users or groups | Make Copilot experiences available only to selected users, for example those assigned a Copilot add-on licence, through the app controls in the Microsoft 365 admin center |
| Unpin Copilot Chat | Only changes where Chat is pinned. Learn states that unpinning does not remove access, and that the Pin Microsoft Copilot Chat setting no longer governs the Copilot app (since 28 January 2026 for tenants outside the EEA and Switzerland) |
| Network blocking | Microsoft does not recommend and cannot support managing Copilot Chat by blocking domains, URLs or IP ranges, because of how deeply it is integrated into the apps. Use tenant restrictions v2 to manage personal-account sign-in instead |
So the answer to "can it be turned off" is yes, with the admin-centre block, not with the pin setting and not at the firewall. The edge cases matter in practice: a tenant that unpinned Chat last year and believes Copilot is off has not turned it off.
Why that is not the oversharing fix
Copilot grounds its answers in what the signed-in user can already open. Learn's readiness guidance says Copilot and agents respect existing permissions and sharing settings. Blocking the chat removes one way for a person to ask a question. The permissions that make a file reachable stay exactly as they were: Anyone links, a site that Everyone except external users is a member of, broken inheritance, sites nobody owns. Those are what ordinary search, SharePoint and Office.com already surface today, and what Copilot would surface if you later turn it on.
Restricted Content Discovery is a stopgap, not a permission
If part of the worry is "what if Copilot finds this", Restricted Content Discovery (RCD) is the documented control for named sites. It limits discovery of a site's content, including recently interacted files, in organisation-wide search and Copilot responses, and removes AI entry points such as the Copilot button from those sites. Learn is plain about its limits: it does not change permissions, people who already have access can still open the content directly, it applies to SharePoint sites and not OneDrive, and Microsoft describes it as a temporary governance control to use selectively. Sites with more than 500,000 items can take more than a week to apply.
Set-SPOSite -Identity https://TENANT.sharepoint.com/sites/hr -RestrictContentOrgWideSearch $trueRCD requires a Copilot licence in the tenant and SharePoint Advanced Management, so it is not available to a tenant that has blocked Copilot and assigned nobody a licence.
The licensing catch for blocking everyone
This is the part people miss. Per Microsoft's prerequisites page, a tenant gets SharePoint Advanced Management capabilities for its Copilot deployment when at least one user is assigned a Copilot licence (or by buying the SharePoint Advanced Management Plan 1 add-on on a qualifying SharePoint subscription, or with Microsoft 365 E7). Blocking Copilot Chat does not remove anyone's licence, so the licence condition can still be met while the chat is blocked. But a tenant that holds no assigned Copilot licence at all, and has not bought the add-on, does not get the data access governance reports or RCD. Blocking Copilot for everyone is compatible with auditing your oversharing; it just does not do it, and without a licence or add-on, you do the audit another way.
What to do instead of, or as well as, blocking
- Decide whether Copilot is off for policy reasons (block it, document it, add the custom link) or only until the data is ready (then the block is a holding action with an end date).
- Inventory what is reachable regardless of Copilot: Anyone links, sites open to Everyone or Everyone except external users, sites with broken inheritance, ownerless sites.
- Use RCD narrowly for the few sites you know are risky while owners fix permissions, and set a date to remove it.
- Fix the permission itself. That is the only step that changes who can see a file.
Free: every Anyone link and every site open to all employees, as two CSVs
ShareScout Lite is a read-only PowerShell audit. It prints a tenant summary and writes one CSV of every Anyone link (path, type, expiry) and one of every site where Everyone or Everyone except external users has access. It runs on any plan, with or without a Copilot licence, and nothing leaves your tenant.
Download ShareScout Lite — free See what Solo addsDisclosure: ShareScout is our product. Settings are from Microsoft Learn as read on 20 October 2026. Microsoft is renaming Microsoft 365 Copilot to Microsoft Copilot; Learn is still mid-rename, so check the current wording. ShareScout is independent and not affiliated with or endorsed by Microsoft.
Sources
- Manage Microsoft Copilot Chat — block for all or selected users, what blocked users see, custom link, unpinning does not remove access, network blocking unsupported, tenant restrictions v2
- Microsoft Copilot overview: Copilot controls — the controls list, including removing user access to Copilot Chat entirely
- Restrict discovery of SharePoint sites and content — what RCD does, does not change permissions, SharePoint only, temporary, 500,000-item propagation note, prerequisites
- Prerequisites for SharePoint Advanced Management — one assigned Copilot licence, the Plan 1 add-on, or Microsoft 365 E7
- Get ready for Microsoft Copilot and agents with SharePoint Advanced Management — Copilot respects existing permissions and sharing settings