-# Data, privacy, and security for web queries in Microsoft 365 Copilot and Microsoft Copilot

-When web search is enabled, Microsoft 365 Copilot and Microsoft Copilot may fetch information from the Bing search service when information from the web will help provide a better, more grounded response. Admin controls and a user-level web content plugin toggle (only for Microsoft 365 Copilot) are available to [manage whether web search is enabled](#controls-available-to-manage-web-search) in your environment.

-When web search is enabled, Microsoft 365 Copilot and Microsoft Copilot parse the userΓÇÖs prompt and identifies terms where web search would improve the quality of the response. Based on these terms, Copilot generates a search query that it sends to the Bing search service asking for more information.

-This generated search query is different from the userΓÇÖs original promptΓÇöit consists of a few words informed by the userΓÇÖs prompt. When using Microsoft 365 Copilot, the generated query doesn't include the entirety of a Microsoft 365 documents associated with the prompt. However, it may also be informed by data within a Microsoft 365 document under the following conditions:

-The following information isn't included in the generated query sent to the Bing search service:

-When a Microsoft 365 Copilot user submits their prompt with the web content plugin toggle (that is, web search) turned on, they may receive two separate responses:

-> Unlike with Microsoft 365 Copilot, users can't invoke organizational content like files, emails, or chats, when prompting in Microsoft Copilot chat. For examples of purely web-based user prompts for Microsoft Copilot, see [Generated search queries](/copilot/privacy-and-protections#generated-search-queries).

-| I'm looking for a document authored last week by [coworker]. | None | Copilot returns documents by [coworker] found in Microsoft 365 data. No web queries are generated. |

-### How Microsoft handles generated queries

-Generated search queries sent to the Bing search service have the user and tenant identifiers removed. They aren't shared with advertisers. Also, web search queries sent to Bing do **not** impact any of the following:

-The Bing search service operates separately from Microsoft 365 and has different data-handling practices. The use of Bing is covered by the [Microsoft Services Agreement](https://www.microsoft.com/servicesagreement) between each user and Microsoft, together with the [Microsoft Privacy Statement](https://www.microsoft.com/privacy/privacystatement). The [Microsoft Products and Services Data Protection Addendum (DPA)](https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA) doesn't apply to the use of web content plugin in Microsoft 365 Copilot, Microsoft Copilot, or the Bing search service.

-To manage web search so it aligns with organizational policies, user preferences, and security considerations, two distinct controls are introduced: one for IT Administrators and another for end-users (only for Microsoft 365 Copilot).

-### IT administrator control for both Microsoft 365 Copilot and Microsoft Copilot

-> In the second half of November 2024, we'll be adding a new policy to provide you with more control for making web search available to your users. The policy will be called "Allow web search in Copilot" and will be available only in [Cloud Policy service for Microsoft 365](/microsoft-365-apps/admin-center/overview-cloud-policy). WeΓÇÖll update this section with more details once the new policy is available.

-Web search in both Microsoft 365 Copilot and Microsoft Copilot is part of optional connected experiences for Microsoft 365. The [privacy setting for optional connected experiences](/microsoft-365-apps/privacy/manage-privacy-controls#policy-setting-for-optional-connected-experiences) allows IT admins to either enable or disable web search for users or user groups across the tenant they manage in accordance with their organizationΓÇÖs policies, data privacy laws, or other regulatory requirements. This applies to both Microsoft 365 Copilot and Microsoft Copilot.

-If optional connected experiences, and thereby web search, are enabled, Microsoft 365 Copilot users within the tenant can choose for themselves whether to enable or disable web search using the web content plugin toggle. The web content plugin toggle isn't available as part of the Microsoft Copilot user experience.

-When optional connected experiences are disabled for users or user groups by an IT admin, web search is disabled in Microsoft 365 Copilot and Microsoft Copilot for those users within the tenant. This setting would override a Microsoft 365 Copilot userΓÇÖs selection with the web content plugin toggle, and they can't override this setting.

-Disabling optional connected experiences restricts Microsoft Copilot, Microsoft 365 Copilot, and multiple experiences across Microsoft 365.

-> [!NOTE]

-> - For subscription plans that donΓÇÖt include Microsoft 365 apps, the privacy setting for optional connected experiences doesnΓÇÖt apply, and there is no option to manage the use of web content.

-> - The privacy setting for optional connected experiences replaces the **Allow Copilot to improve responses with web content** control in the Microsoft 365 admin center previously used to manage web content in Microsoft 365 Copilot.

-### End user toggle (only for Microsoft 365 Copilot)

-The web content plugin end user toggle offers individual control over whether or not they want real-time web content in Microsoft 365 Copilot responses based on their personal preference. The end user toggle is only available as part of work chat in Microsoft 365 Copilot.

-If optional connected experiences are enabled, this setting is enabled by default. When enabled, the user receives responses grounded in real-time web content. If the IT admin disables optional connected experiences, this option isn't available to the Microsoft 365 Copilot user as part of work chat and web search is disabled.

-If a Microsoft 365 Copilot user disables the web content plugin in work chat, web content isn't included in Copilot responses.

-2. Disable the web content plugin.

-### Optional connected experiences for Microsoft 365 Copilot and Microsoft Copilot

-Copilot can make use of cloud-backed services, called optional connected experiences, to provide additional functionality to Copilot users. For example, Copilot can [reference web content](manage-public-web-access.md) to improve the quality of its responses to user prompts. For Copilot to use these cloud-backed services, optional connected experiences must be on. For more information, see [Microsoft 365 Copilot and privacy controls for connected experiences](microsoft-365-copilot-privacy.md#microsoft-365-copilot-and-privacy-controls-for-connected-experiences).

-When users have an issue and aren't able to send feedback logs to Microsoft, you can submit feedback logs on their behalf. The data will include prompts and generated responses, relevant content samples, and additional log file. Using this feature to send feedback logs will temporarily override any user level feedback policy.

-To learn more, see [Provide user feedback for Microsoft 365 Copilot](provide-feedback.md).

-If you turn off optional connected experiences in your organization, Microsoft 365 Copilot features that are optional connected experiences wonΓÇÖt be available to your users. For example, [web search](manage-public-web-access.md) wonΓÇÖt be available to your users.

-You're in the right place if your new employee needs Microsoft 365, and you're using a [Microsoft 365 plan]( https://www.microsoft.com/microsoft-365/buy/compare-all-microsoft-365-products?rtc=1) that lets you install apps in Microsoft 365, like Word and Excel, on a computer.

- **No Microsoft 365 productivity apps in your plan?** Follow these steps, but skip the sections for installing apps. Instead, use the [Get started at Microsoft365.com](https://support.microsoft.com/office/91a4ec74-67fe-4a84-a268-f6bdf3da1804).

-You must be a ([user management admin](about-admin-roles.md)) to do these steps.

-4. If the user is successfully restored, select **Send email and close**. If you encounter a name conflict or proxy address conflict, see the instructions below for how to restore those accounts.

-1. In the Microsoft 365 admin center, select **Teams and groups** \> **Active teams and groups** \> **Distribution lists**.

- 

- > [!NOTE]

- > You can also remove a user on this page. Select the user, select the ellipsis symbol and choose **Remove member**.

-All organization themes can be customized using the following tabs.

-|Tab|What can you do?|

-|||

-|[General](#general-modify-a-theme)|Modify a theme name and assign to up to five groups (if applicable).|

-|[Logos](#logos-specify-your-theme-logos)|Add your organization logo, including alternate logo for dark theme.|

-|[Colors](#colors-choose-theme-colors)|Customize a color scheme by specifying navigation bar, accent, text and icon colors.|

-**Note:** The Microsoft 365 suite header is designed to accommodate a variety of screen sizes, window sizes, and display settings. The responsive behavior of the suite header sometimes results in the logo not showing to give space to other capabilities shown on the suite header. To reduce the likelihood of this behavior a narrower image file is recommended.

-### Why am I receiving an error message every time I upload a logo URL

-[Add custom tiles to the My apps page and app launcher](../manage/customize-the-app-launcher.md) (article)\

-description: "Purchase Microsoft 365 Business Standard and set up your organization."

-1. On the [Microsoft 365 for business page](https://go.microsoft.com/fwlink/?linkid=2109654), select **See plans & pricing**.

-3. On the **Thank you for choosing Microsoft 365 Business Standard** page, enter your information to get started. Select **Next**.

-4. Enter an email address that you already use. This email address can be any address you want Microsoft to use to communicate with you during setup. It's also the address where we send you information about your bill and renewals. Then select, **Set up account**.

-|**Manage false positives/negatives**|A false positive is an entity, such as a file or a process that was detected and identified as malicious even though the entity isn't actually a threat. A false negative is an entity that wasn't detected as a threat, even though it actually is malicious. False positives/negatives can occur with any threat protection solution, including Microsoft Defender for Office 365 and Microsoft Defender for Business, which are both included in Microsoft 365 Business Premium. Fortunately, steps can be taken to address and reduce these kinds of issues. <br/><br/>For false positives/negatives on devices, see [Address false positives/negatives in Microsoft Defender for Endpoint](../security/defender-endpoint/defender-endpoint-false-positives-negatives.md).<br/><br/>For false positives/negatives in email, see the following articles: <br/>- [How to handle malicious emails that are delivered to recipients (False Negatives), using Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/step-by-step-guides/how-to-handle-false-negatives-in-microsoft-defender-for-office-365)<br/>- [How to handle Legitimate emails getting blocked (False Positive), using Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/step-by-step-guides/how-to-handle-false-positives-in-microsoft-defender-for-office-365)|

-|**Manage false positives/negatives**|A false positive is an entity, such as a file or a process that was detected and identified as malicious even though the entity isn't actually a threat. A false negative is an entity that wasn't detected as a threat, even though it actually is malicious. False positives/negatives can occur with any threat protection solution, including Microsoft Defender for Office 365 and Microsoft Defender for Business, which are both included in Microsoft 365 Business Premium. Fortunately, steps can be taken to address and reduce these kinds of issues. <br/><br/>For false positives/negatives on devices, see [Address false positives/negatives in Microsoft Defender for Endpoint](../security/defender-endpoint/defender-endpoint-false-positives-negatives.md).<br/><br/>For false positives/negatives in email, see the following articles: <br/>- [How to handle malicious emails that are delivered to recipients (False Negatives), using Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/step-by-step-guides/how-to-handle-false-negatives-in-microsoft-defender-for-office-365)<br/>- [How to handle Legitimate emails getting blocked (False Positive), using Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/step-by-step-guides/how-to-handle-false-positives-in-microsoft-defender-for-office-365)|

-[How to submit malware and non-malware to Microsoft for analysis](/microsoft-365/security/office-365-security/submissions-submit-files-to-microsoft) (article)

-|- [Safe Links & Safe Attachments](/microsoft-365/security/office-365-security/mdo-support-teams-about) with Microsoft Teams|:::image type="content" source="media/green-check-mark.png" alt-text="Included":::|||

-|- [Safe Links](/microsoft-365/security/office-365-security/safe-links-about) and [Safe Attachments](/microsoft-365/security/office-365-security/safe-attachments-for-spo-odfb-teams-about) for SharePoint and OneDrive|:::image type="content" source="media/green-check-mark.png" alt-text="Included":::|||

-description: "Learn how to add multiple users to Microsoft 365 for business from a list in a spreadsheet or other CSV formatted file. Watch a video on YouTube that explains how to add accounts to Microsoft 365. At the end of this process, each user with an account will have a Microsoft 365 mailbox. "

-|[Deploy and set up Microsoft Intune](https://go.microsoft.com/fwlink/?linkid=2223058)|[Deploy and set up Microsoft Intune](https://go.microsoft.com/fwlink/?linkid=2224812)|Set up Microsoft Intune to manage devices in your organization. For full control of corporate devices, you'll use Intune's mobile device management (MDM) features. To manage your organization's data on shared and personal devices, you can use Intune's mobile application management (MAM) features.<br>With the **Deploy and set up Microsoft Intune guide**, you'll set up device and app compliance policies, assign app protection policies, and monitor the device and app protection status.|