+ Title: "Microsoft 365 Copilot admin"

+description: "Learn about Microsoft 365 Copilot admin and how it can help simplify admin tasks."

+# Microsoft 365 Copilot admin - overview

+Microsoft 365 Copilot admin harnesses the value of generative AI to boost IT admins' productivity by simplifying administration of Microsoft 365 and Microsoft 365 Copilot, and empowering you to focus on more strategic priorities. Microsoft 365 Copilot admin helps admins perform tasks across different Microsoft 365 services using natural language interactions, contextual guidance, and proactive suggestions. Microsoft 365 Copilot admin also leverages the power of Copilot to provide transferable skills across different admin centers and surfaces, breaking the barriers of switching between multiple admin tools and interfaces.

+Microsoft 365 Copilot admin is currently available in an invite-only preview. To use Microsoft 365 Copilot admin,

+2. Select the Copilot button in the upper right shell to launch Microsoft 365 Copilot admin.

+## How can I use Microsoft 365 Copilot admin?

+With Microsoft 365 Copilot admin, you can:

+In preview, Copilot is automatically enabled for select customers who have purchased Microsoft 365 Copilot.

+### Which admin roles can use Microsoft 365 Copilot admin?

+No. Microsoft 365 Copilot admin handles prompts in the same way as Microsoft 365 Copilot.

+ Title: "Enterprise data protection in Microsoft 365 Copilot and Microsoft Copilot"

+description: "Learn what enterprise data protection means for Microsoft 365 Copilot and Microsoft Copilot."

+# Enterprise data protection in Microsoft 365 Copilot and Microsoft Copilot

+> The following information applies to Microsoft 365 Copilot currently and will start rolling out to Microsoft Copilot in the second half of September 2024 for users signed in with a Microsoft Entra account.

+## What is enterprise data protection in Microsoft 365 Copilot and Microsoft Copilot?

+The use of Microsoft 365 Copilot and Microsoft Copilot, as used by organizations, are covered by the terms of the [Data Protection Addendum (DPA)](https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA) and [Product Terms](https://www.microsoft.com/licensing/terms/product/PrivacyandSecurityTerms/all), with Microsoft acting as a data processor.

+Enterprise data protection (EDP) refers to controls^[1] and commitments, under the Data Protection Addendum (DPA) and Product Terms, that apply to customer data for users of Microsoft 365 Copilot and Microsoft Copilot. The use of the term EDP isn't meant to limit the benefits offered under the DPA and Product Terms.

+Microsoft 365 Copilot and Microsoft Copilot offer the same enterprise terms^[2] available in our Microsoft 365 commercial offerings.

+Use of Microsoft 365 Copilot and Microsoft Copilot involves prompts (entered by users) and responses (content generated by Copilot). With EDP, prompts and responses are protected by the same contractual terms and commitments widely trusted by our customers for their emails in Exchange and files in SharePoint.

+- **Your data is private:** We wonΓÇÖt use your data except as you instruct. Our commitments to [privacy](https://www.microsoft.com/trust-center/privacy) include support for [GDPR](/compliance/regulatory/gdpr), [ISO/IEC 27018](/compliance/regulatory/offering-ISO-27018)^[3], and our [Data Protection Addendum](https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA).

+- **Your access controls and policies apply to Copilot:** Copilot respects your [identity model](microsoft-365-copilot-privacy.md#how-does-microsoft-365-copilot-protect-organizational-data) and [permissions](microsoft-365-copilot-privacy.md#how-does-microsoft-365-copilot-use-your-proprietary-organizational-data), inherits your [sensitivity labels](/purview/sensitivity-labels#sensitivity-labels-and-microsoft-365-copilot), applies your [retention](/purview/retention-policies-copilot) policies, supports [audit](/purview/audit-search?tabs=microsoft-purview-portal) of interactions, and follows your administrative settings. The specific controls and policies will vary depending on the underlying subscription plan.

+- **You're protected against AI security and copyright risks:** We help safeguard against AI-focused risks such as [harmful content](microsoft-365-copilot-privacy.md#how-does-copilot-block-harmful-content) and [prompt injections](microsoft-365-copilot-privacy.md#does-copilot-block-prompt-injections-jailbreak-attacks). For content copyright concerns, we provide [protected material detection](microsoft-365-copilot-privacy.md#does-copilot-provide-protected-material-detection) and our [Customer Copyright Commitment](https://blogs.microsoft.com/on-the-issues/2023/09/07/copilot-copyright-commitment-ai-legal-concerns/).

+- **Your data isnΓÇÖt used to train foundation models:** Microsoft Copilot uses the userΓÇÖs context to create relevant responses. Microsoft 365 Copilot also uses Microsoft Graph data. Consistent with our other Copilot offers, prompts, responses, and data accessed through Microsoft Graph [aren't used to train foundation models](https://blogs.microsoft.com/on-the-issues/2024/03/28/data-protection-responsible-ai-azure-copilot/).

+- [Learn more about data, security, and privacy for Microsoft 365 Copilot](microsoft-365-copilot-privacy.md)

+- Web queries sent to the Bing search service are handled identically by both Copilots. Queries are generated from the prompt into a few words. They're sent via a secure connection with user and tenant identifiers removed. They aren't shared with advertisers and arenΓÇÖt used to train our foundation large language models (LLMs).

+- [Learn more about data, privacy, and security of web queries in Microsoft 365 Copilot and Microsoft Copilot](manage-public-web-access.md)

+## Plugins in Microsoft 365 Copilot

+When youΓÇÖre using plugins to help Microsoft 365 Copilot to provide more relevant information, check the privacy statement and terms of use of the plugin to determine how it will handle your organizationΓÇÖs data. For more information, see [Extensibility of Microsoft 365 Copilot](microsoft-365-copilot-privacy.md#extensibility-of-microsoft-365-copilot).

+^[1] The specific controls will vary depending on a customer's Microsoft subscription plans.

+^[2] Microsoft 365 Copilot supports HIPAA compliance for properly configured implementations. Microsoft Copilot is under review and doesn't support HIPAA compliance at this time.

+^[3] Microsoft 365 Copilot runs on the ISO 27018 certified Microsoft 365 platform. Microsoft Copilot will start rolling out to the same platform in the second half of September 2024, for users signed in with a Microsoft Entra account.

+ Title: Data, privacy, and security for web queries in Microsoft 365 Copilot and Microsoft Copilot

+description: "Learn how to manage Microsoft 365 Copilot and Microsoft 365 access to web content for your organization."

+# Data, privacy, and security for web queries in Microsoft 365 Copilot and Microsoft Copilot

+Microsoft 365 Copilot chat and [Microsoft Copilot](/copilot/overview) chat have an optional feature that allows Copilot to reference web content when responding to user prompts. Allowing Microsoft 365 Copilot and Microsoft Copilot to reference web content improves the quality of Copilot responses by grounding them in the latest information from the web (referred to as ΓÇ£web groundingΓÇ¥).

+## Web grounding

+When web grounding is enabled, Microsoft 365 Copilot and Microsoft Copilot may fetch information from the Bing search service when information from the web will help provide a better, more grounded response. Admin controls and a user-level web content plugin toggle (only for Microsoft 365 Copilot) are available to [manage whether web grounding is enabled](#controls-available-to-manage-web-grounding) in your environment.

+### How web grounding works

+When web grounding is enabled, Microsoft 365 Copilot and Microsoft Copilot parse the userΓÇÖs prompt and identifies terms where web grounding would improve the quality of the response. Based on these terms, Copilot generates a search query that it sends to the Bing search service asking for more information.

+This generated search query is different from the userΓÇÖs original promptΓÇöit consists of a few words informed by the userΓÇÖs prompt. When using Microsoft 365 Copilot, the generated query won't include the entirety of a Microsoft 365 documents associated with the prompt. However, it may also be informed by data within a Microsoft 365 document under the following conditions:

+- When the user explicitly references a specific document in their prompt (for example, asking Copilot about a specific document from copilot.cloud.microsoft).

+The following information isn't included in the generated query sent to the Bing search service:

+- The user's entire prompt, unless the prompt is very short (for example, "local weather")

+- Entire Microsoft 365 files (for example, emails or documents) or files uploaded into Copilot

+- Entire web pages or PDFs summarized by Copilot in Microsoft Edge (only for Microsoft Copilot)

+- Any identifying information based on the user's Microsoft Entra ID (for example, username, domain, or tenant ID)

+The user's prompts and Copilot's responses are stored within Microsoft 365 and never leave the service boundary for both Microsoft 365 Copilot and Microsoft Copilot.

+After Microsoft 365 Copilot and Microsoft Copilot receive additional information from the Bing search service, this information is used to compose the response returned to the user.

+When a Microsoft 365 Copilot user submits their prompt with the web content plugin toggle (that is, web grounding) turned on, they may receive two separate responses:

+The following table provides multiple examples of a user's prompt and the generated search queries sent to Bing. It also explains how Microsoft 365 Copilot and Microsoft Copilot formulate a response. Brackets indicate placeholders for specific information referenced by the user or inferred by Copilot.

+> [!NOTE]

+> Unlike with Microsoft 365 Copilot, users can't invoke organizational content like files, emails, or chats, when prompting in Microsoft Copilot chat. For examples of purely web-based user prompts for Microsoft Copilot, see [Generated search queries](/copilot/privacy-and-protections#generated-search-queries).

+| Who is my manager and what public information is available about them? | [Manager name] | Copilot will find the name of the user's manager from Microsoft 365 data. It will then generate a Bing search query based on their name to see what information about them is available on the web. |

+| I'm looking for a document authored last week by [coworker]. | None | Copilot will return documents by [coworker] found in Microsoft 365 data. No web queries are generated. |

+| We're considering a possible acquisition of Fabrikam. Summarize financial information about the company, including their business strategy. | Fabrikam strategy<br>Fabrikam financials | Copilot will return a response with two sections. One is headlined "From your company's data" that references information the user has access to in Microsoft 365. The other is headlined "From the web," which includes any publicly available information. |

+| Summarize [internal strategy document about clean energy] and tell me if Fabrikam has publicly announced a similar approach. | Fabrikam clean energy policy announcements | The user explicitly includes a reference to a specific document in Microsoft 365. Copilot reasons over this document and identifies "clean energy policy" as a major theme. "Clean energy policy" is added to the generated search query sent to the Bing search service (the document itself isn't included).<br>Copilot then takes web results returned from Bing and identifies any similarities between this public information and the strategy described in the internal document. |

+Microsoft 365 Copilot and Microsoft Copilot both use generated search queries sent to the Bing search service to ground responses in web data. The way Microsoft handles these queries is identical in both services.

+Generated search queries sent to the Bing search service have the user and tenant identifiers removed. They aren't shared with advertisers. Also, web grounding queries sent to Bing do **not** impact any of the following:

+The Bing search service operates separately from Microsoft 365 and has different data-handling practices. The use of Bing is covered by the [Microsoft Services Agreement](https://www.microsoft.com/servicesagreement) between each user and Microsoft, together with the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement). The [Microsoft Products and Services Data Protection Addendum (DPA)](https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA) doesn't apply to the use of web content plugin in Microsoft 365 Copilot, Microsoft Copilot, or the Bing search service.

+## Controls available to manage web grounding

+To manage web grounding so it aligns with organizational policies, user preferences, and security considerations, two distinct controls are introduced: one for IT Administrators and another for end-users (only for Microsoft 365 Copilot).

+### IT administrator control for both Microsoft 365 Copilot and Microsoft Copilot

+Web grounding in both Microsoft 365 Copilot and Microsoft Copilot is part of optional connected experiences for Microsoft 365. The [privacy setting for optional connected experiences](/microsoft-365-apps/privacy/manage-privacy-controls#policy-setting-for-optional-connected-experiences) allows IT admins to either enable or disable web grounding for users or user groups across the tenant they manage in accordance with their organizationΓÇÖs policies, data privacy laws, or other regulatory requirements. This applies to both Microsoft 365 Copilot and Microsoft Copilot.

+If optional connected experiences, and thereby web grounding, are enabled, Microsoft 365 Copilot users within the tenant can choose for themselves whether to enable or disable web grounding using the web content plugin toggle. The web content plugin toggle isn't available as part of the Microsoft Copilot user experience.

+When optional connected experiences are disabled for users or user groups by an IT admin, web grounding is disabled in Microsoft 365 Copilot and Microsoft Copilot for those users within the tenant. This setting would override a Microsoft 365 Copilot userΓÇÖs selection with the web content plugin toggle, and they can't override this setting.

+Disabling optional connected experiences restricts Microsoft Copilot, Microsoft 365 Copilot, and multiple experiences across Microsoft 365.

+> [!NOTE]

+> - For subscription plans that donΓÇÖt include Microsoft 365 apps, the privacy setting for optional connected experiences doesnΓÇÖt apply, and there is no option to manage the use of web content.

+> - The privacy setting for optional connected experiences replaces the **Allow Copilot to improve responses with web content** control in the Microsoft 365 admin center previously used to manage web content in Microsoft 365 Copilot.

+### End user toggle (only for Microsoft 365 Copilot)

+The web content plugin end user toggle offers individual control over whether or not they want real-time web content in Microsoft 365 Copilot responses based on their personal preference. The end user toggle is only available as part of work chat in Microsoft 365 Copilot.

+If optional connected experiences are enabled, this setting is enabled by default. When enabled, the user will receive responses grounded in real-time web content. If the IT admin has disabled optional connected experiences, this option isn't available to the Microsoft 365 Copilot user as part of work chat and web grounding is disabled.

+If a Microsoft 365 Copilot user disables the web content plugin in work chat, web content isn't included in Copilot responses.

+Microsoft 365 Copilot users can manage web grounding in work chat by following these steps:

+1. Select the plugin menu at the bottom right of the chat input box in Microsoft 365 Copilot when using work chat.

+ Title: "Enable users for Microsoft 365 Copilot"

+description: "Learn about the steps to deploy Microsoft 365 Copilot to your users."

+# Enable users for Microsoft 365 Copilot

+There are three main steps to deploy Microsoft 365 Copilot in your organization:

+1. Review the [prerequisites](microsoft-365-copilot-requirements.md) and verify that your organization is prepared for Microsoft 365 Copilot.

+3. Send an email to your users announcing Microsoft 365 Copilot and its features.

+You can use the [Microsoft 365 Copilot setup guide](https://admin.microsoft.com/Adminportal/Home?Q=learndocs#/modernonboarding/microsoft365copilotsetupguide) in the Microsoft 365 admin center to perform all three steps, or use the steps described in this article.

+Before you can assign Copilot licenses, you need to make sure that you've already provisioned users in your tenant. If you haven't done so yet, you can follow the steps in the [Microsoft 365 Copilot setup guide](https://admin.microsoft.com/Adminportal/Home?Q=learndocs#/modernonboarding/microsoft365copilotsetupguide) or [Add users and assign licenses in Microsoft 365](/microsoft-365/admin/add-users/add-users). These resources will guide you through the process of creating users and assigning licenses. To learn more about assigning Microsoft 365 licenses with PowerShell, see [Assign licenses to user accounts](/microsoft-365/enterprise/assign-licenses-to-user-accounts-with-microsoft-365-powershell).

+2. Select **Microsoft 365 Copilot**.

+After licensing your users for Microsoft 365 Copilot, we recommend sending them a welcome email to introduce them to Microsoft 365 Copilot and help them understand what it can do for them. The easiest way to do this is to use the [Microsoft 365 Copilot setup guide](https://admin.microsoft.com/Adminportal/Home?Q=learndocs#/modernonboarding/microsoft365copilotsetupguide), which includes an option for sending a welcome email to your Copilot users. HereΓÇÖs an example of this email:

+We recommend that you enable all feedback settings for the Microsoft 365 Apps. This allows Microsoft 365 Copilot users to provide details with their thumbs up or thumbs down reaction to what Copilot produced from their prompt. You can use either the [cloud policy service](https://config.office.com) or group policies to enable the feedback for your users. Once all the policies are enabled, users will have the option to provide logs, screenshots, an email address for further contact about their feedback submission.

+## Microsoft 365 Copilot usage activity report

+After your users have had a chance to use Copilot, we recommend running and reviewing the [Microsoft 365 Copilot usage report](/microsoft-365/admin/activity-reports/microsoft-365-copilot-usage) to get a summary of user adoption, retention, and engagement with Microsoft 365 Copilot. The report can be found in the Microsoft 365 admin center under **Reports** > **Usage**.

+ Title: "Adoption and enablement resources available for Microsoft 365 Copilot"

+f1.keywords:

+- NOCSH

+audience: Admin

+ms.localizationpriority: medium

+- scotvorg

+- m365copilot

+- magic-ai-copilot

+description: "Take advantage of the many helpful resources available on the Adoption site as you enable Microsoft 365 Copilot in your organization."

+# Adoption and enablement resources available for Microsoft 365 Copilot

+Take advantage of the many helpful resources available on the [Microsoft Adoption site](https://adoption.microsoft.com/) as you enable Microsoft 365 Copilot in your organization. This site includes many resources, including the following:

+* A downloadable Success Kit to help drive user enablement and technical readiness in your organization.

+* A Launch Day kit to help create hype around your rollout.

+* The interactive Scenario Library with example outcomes and success measures for several different industries and roles.

+See [Microsoft 365 Copilot](https://adoption.microsoft.com/copilot/) to explore and download resources.

+ Title: "Understand licensing requirements for Microsoft 365 Copilot"

+f1.keywords:

+- NOCSH

+audience: Admin

+ms.localizationpriority: medium

+- scotvorg

+- m365copilot

+- magic-ai-copilot

+description: "Understand which plans include Microsoft 365 Copilot, licensing requirements, and availability."

+# Understand licensing requirements for Microsoft 365 Copilot

+Microsoft 365 Copilot is available as an [add-on plan](https://www.microsoft.com/microsoft-365/microsoft-copilot) with one of the following licensing prerequisites:

+**For Business and Enterprise:**

+- **Microsoft 365 plans:**

+ - Microsoft 365 E5

+ - Microsoft 365 E3

+ - Microsoft 365 F1

+ - Microsoft 365 F3

+ - Microsoft 365 Business Basic

+ - Microsoft 365 Business Premium

+ - Microsoft 365 Business Standard

+ - Microsoft 365 Apps for business

+ - Microsoft 365 Apps for enterprise

+- **Office 365 plans:**

+ - Office 365 E5

+ - Office 365 E3

+ - Office 365 E1

+ - Office 365 F3

+- **Microsoft Teams plans:**

+ - Microsoft Teams Essentials

+ - Microsoft Teams Enterprise

+ - Microsoft Teams EEA (European Economic Area)

+- **Exchange plans:**

+ - Exchange Kiosk

+ - Exchange Plan 1

+ - Exchange Plan 2

+- **SharePoint plans:**

+ - SharePoint Plan 1

+ - SharePoint Plan 2

+- **OneDrive for Business plans:**

+ - OneDrive for Business Plan 1

+ - OneDrive for Business Plan 2

+- **Planner and Project plans:**

+ - Microsoft Planner Plan 1 (formerly Project Plan 1)

+ - Microsoft Project Plan 3

+ - Microsoft Project Plan 5

+ - Project Online Essentials

+- **Visio plans:**

+ - Visio Plan 1

+ - Visio Plan 2

+- **Other plans:**

+ - Microsoft ClipChamp

+**For Education Faculty and Higher Education Students Aged 18+:**

+- Microsoft 365 A1*

+- Microsoft 365 A3*

+- Microsoft 365 A5*

+- Office 365 A1*

+- Office 365 A3*

+- Office 365 A5*

+*Available via Enrollment for Education Solutions (EES) or Cloud Solution Provider (CSP) only.

+>[!NOTE]

+> Customers with Education or Business subscriptions that do not include Teams can still purchase Microsoft 365 Copilot licenses.

+You can use the [Microsoft 365 Copilot setup guide](https://admin.microsoft.com/Adminportal/Home?Q=learndocs#/modernonboarding/microsoft365copilotsetupguide) in the Microsoft 365 admin center to assign the required licenses to users. For more information, see [Assign licenses to users in the Microsoft 365 admin center](/microsoft-365/admin/manage/assign-licenses-to-users) and [Microsoft 365 Copilot requirements](microsoft-365-copilot-requirements.md).

+ Title: "Microsoft 365 Copilot overview"

+description: Learn how Microsoft 365 Copilot works, how it uses Microsoft Graph to get your organization user data, and the common Copilot features in Microsoft 365 apps, like Word, Excel, PowerPoint, and Teams.

+# Microsoft 365 Copilot overview

+[Microsoft 365 Copilot](/office365/servicedescriptions/office-365-platform-service-description/microsoft-365-copilot) is an AI-powered productivity tool.

+It provides real-time intelligence that enables users to complete tasks more efficiently, enhance their productivity & skills, and improve their overall work experience. Users get content relevant to their tasks, like drafting, summarizing, and answering questions; all in the context of their work within their Microsoft 365 app.

+Microsoft 365 Copilot:

+- Coordinates large language models (LLMs). LLMs are a type of artificial intelligence (AI) algorithms that use deep learning techniques and data sets to understand, summarize, predict, and generate content.

+ These LLMs include pretrained models, like Generative Pre-Trained Transformers (GPT) (like GPT-4), that are designed to excel in these tasks.

+- Uses content in Microsoft Graph, like emails, chats, and documents that users have permission to access.

+- Pairs with the Microsoft 365 productivity apps that you use every day, like Word, Excel, PowerPoint, Outlook, Teams, and others.

+To learn more, see:

+- [Your new way of working: Microsoft 365 Copilot](https://www.microsoft.com/microsoft-365/blog/2024/03/28/your-new-way-of-working-copilot-for-microsoft-365)

+- [Microsoft 365 Copilot intro](https://www.microsoft.com/microsoft-365/business/copilot-for-microsoft-365)

+This article describes how Microsoft 365 Copilot works, the components it uses, and the Copilot features in Microsoft 365 apps.

+## How Microsoft 365 Copilot works

+The following diagram provides a visual representation of how Microsoft 365 Copilot works.

+Let's take a look:

+1. Copilot receives an input prompt from a user in a Microsoft 365 app, like Word or PowerPoint.

+2. Copilot preprocesses the input prompt using **grounding**.

+ Grounding improves the specificity of your prompt, and helps you get answers that are relevant and actionable to your specific task. The prompt can include text from input files or other content Copilot discovers.

+ Copilot only accesses data that an individual user is authorized to access, based on, for example, existing Microsoft 365 role-based access controls. Copilot doesn't access data that the user doesn't have permission to access.

+ To learn more, see [Data stored about user interactions with Microsoft 365 Copilot](microsoft-365-copilot-privacy.md#data-stored-about-user-interactions-with-microsoft-365-copilot).

+3. Copilot sends the grounded prompt to the LLM. The LLM uses the prompt to generate a response that is contextually relevant to the user's task.

+4. Copilot takes this response from the LLM and post-processes it.

+5. This post-processing includes more grounding calls to Microsoft Graph, responsible AI checks, security, compliance and privacy reviews, and command generation.

+Copilot returns the response to the app, where the user can review and assess the response.

+The user's prompt and Copilot's response to that prompt is the **content of interactions**. The record of those interactions is in the user's Copilot interaction history. So, users can review and reuse their previous prompts.

+## Copilot works with Microsoft 365 apps, Graph, and LLMs

+Copilot has intelligent features, functionality, and prompting. These features are designed to help users in the context of their work within their Microsoft 365 apps.

+Microsoft's LLMs and other components work together. They help users securely access and use your organizational data with AI-powered capabilities. Specifically, Microsoft 365 Copilot uses the following components:

+✅ **Microsoft 365 apps**

+Apps like Word, Excel, PowerPoint, Outlook, Teams, and Loop work with Copilot to support users in the context of their work. For example, Copilot in Word helps users create, understand, and edit documents.

+For more features, see [Copilot features in Microsoft 365 apps](#copilot-features-in-microsoft-365-apps) (in this article).

+✅ **Graph-grounded chat**

+With Graph-grounded chat, you can draft content, review what you missed, and get answers to questions using open-ended prompts. This information is securely grounded in your work data.

+You can use Graph-grounded Copilot in Microsoft Teams, at [Microsoft365.com](https://www.microsoft365.com/), and at [copilot.microsoft.com](https://copilot.microsoft.com/).

+✅ **Microsoft Graph**

+Microsoft Graph includes information about the relationships between users, activities, and your organization's data. The Microsoft Graph API brings more context from customer signals into the prompt, like information from emails, chats, documents, and meetings.

+To learn more, see [Overview of Microsoft Graph](/graph/overview) and [Major services and features in Microsoft Graph](/graph/overview-major-services).

+✅ **Semantic index**

+Semantic index is generated from content in [Microsoft Graph](https://developer.microsoft.com/graph). It helps create contextually relevant responses to user prompts. It allows organizations to search through billions of vectors (mathematical representations of features or attributes) and return related results.

+To learn more, see [Semantic index for Copilot](/microsoftsearch/semantic-index-for-copilot).

+## Copilot features in Microsoft 365 apps

+Microsoft 365 productivity apps (like Word, Excel, PowerPoint, Outlook, Teams, loop, and more) work with Copilot to support users in the context of their work.

+> [!TIP]

+> To learn how users can use Copilot within Microsoft 365 apps, including sample prompts, see [Copilot Lab](https://copilot.cloud.microsoft/prompts).

+Some of these features include:

+| Microsoft 365 App | Feature |

+|||

+| **Word** | **Draft**ΓÇöGenerate text with and without formatting in new or existing documents. Word files can also be used for grounding data. <br/><br/> **Chat**ΓÇöCreate content, summarize, ask questions about your document, and do light commanding. |

+| **PowerPoint** | **Draft**ΓÇöCreate a new presentation from a prompt or Word file using enterprise templates. PowerPoint files can also be used for grounding data. <br/><br/> **Chat**ΓÇöSummary and Q&A <br/><br/> **Light commanding**ΓÇöAdd slides, pictures, or make deck-wide formatting changes. |

+| **Excel** | **Draft**ΓÇöGet suggestions for formulas, chart types, and insights about data in your spreadsheet. |

+| **Loop** | **Collaborative content creation**ΓÇöCreate content that can be collaboratively improved through direct editing. |

+| **Outlook** | **Coaching tips**ΓÇöGet coaching tips and suggestions on clarity, sentiment, & tone, and an overall message assessment and suggestions for improvement. <br/><br/> **Summarize**ΓÇöSummarize an email thread to quickly understand the discussion. <br/><br/> **Draft**ΓÇöPull from other emails or content across Microsoft 365 that the user already has access to. |

+| **Teams** | **Chat**ΓÇöCopilot can summarize up to 30 days of the chat content before the last message in a chat. <br/><br/>Copilot uses only the single chat thread as source content for responses. It can't reference other chats or data types, like meeting transcripts, emails, and files. Users can select prewritten prompts or write their own questions. Responses include clickable citations that direct users to the relevant source content that was used. <br/><br/> Conversations with Copilot take place in a side panel and allows users to copy and paste. Copilot conversations close when the side panel closes. <br/><br/> **Meetings**ΓÇöUsers can invoke Copilot in meetings or calls within the same tenant. Copilot uses the transcript in real-time to answer questions from the user. It only uses the transcript and knows the name of the user typing the question. <br/><br/> Users can type any question or use predetermined prompts. Copilot answers questions only related to the meeting conversation from the transcript. The user can copy/paste an answer and access Copilot after the meeting ends. <br/><br/> **Copilot**ΓÇöUsers access data across their Microsoft 365 Graph and use LLM functionality. Copilot can be accessed in Teams and when signed-in to Bing with an Active Directory account. <br/><br/> **Calls**ΓÇöAutomates important administrative tasks of a call, like capturing key points, task owners, and next steps. It supports voice over Internet Protocol (VoIP) and public switched telephone network (PSTN) calls. <br/><br/> **Whiteboard**ΓÇöUse natural language to generate ideas, organize ideas into themes, create designs based on ideas, and summarize whiteboard content. |

+| **OneNote** | **Draft**ΓÇöUse prompts to draft plans, generate ideas, create lists, and organize information to help you find what you need. |

+| **Forms** | **Draft**ΓÇöUse prompts to draft questions and suggestions that help you create surveys, polls, and other forms. |

+## Related content

+- [Understand licensing for Microsoft 365 Copilot](microsoft-365-copilot-licensing.md)

+- [Get started with Microsoft 365 Copilot](microsoft-365-copilot-setup.md)

+- [Read about Data, Privacy, and Security for Microsoft 365 Copilot](microsoft-365-copilot-privacy.md)

+- [Learn more about Copilot Lab](https://copilot.cloud.microsoft/prompts)

+- Watch:

+ - [Copilot system explained by Microsoft](https://www.youtube.com/watch?v=E5g20qmeKpg)

+ - [Semantic Index explained by Microsoft](https://www.youtube.com/watch?v=KtsVRCsdvoU)

+ - [Microsoft 365 Copilot, LLMs, and your apps](https://www.youtube.com/watch?v=B2-8wrF9Okc)

+ - [Get ready for Microsoft 365 Copilot](https://aka.ms/M365CopilotAdmin)

+- Stay up to date on the latest Copilot features, changes, and announcements using the [Message center](/microsoft-365/admin/manage/message-center) in the [Microsoft 365 admin center](https://admin.microsoft.com/Adminportal/Home#/MessageCenter).

+ Title: Manage Microsoft 365 Copilot settings

+description: "Learn about the Copilot page and how you can manage Microsoft 365 Copilot settings in the Microsoft 365 admin center."

+# Manage Microsoft 365 Copilot settings in the Microsoft 365 admin center

+You can manage Microsoft 365 Copilot through the Microsoft 365 admin center by going to the Settings tab on the Copilot page. Manage how users in your organization interact with Microsoft 365 Copilot, Copilot for Security, and more.

+- Your organization must have purchased Copilot licenses to access the Settings tab on the Copilot page in the Microsoft 365 admin center. While you don't need a license assigned to your admin account, you must have these licenses present within the organization for the Copilot page to be visible. For more information, see [Get started with Microsoft 365 Copilot](microsoft-365-copilot-setup.md).

+Copilot capabilities with [enterprise data protection](/copilot/overview) provides enhanced security for users accessing the generative AI capabilities of Copilot. This experience is on by default for [users with eligible licenses](/copilot/manage#commercial-data-protection-eligibility) assigned by your organization when they are signed in with their work or school (Entra ID) accounts.

+Copilot in Bing, Edge, and Windows is the public version of Copilot and doesn't require users to be signed in. You can reroute to the documentation available on the panel to turn off the public experience and still have access to the Copilot capabilities with enterprise data protection experience.

+You should use a PowerShell script to control access to Microsoft 365 Copilot in Bing, Edge, and Windows. Running this script controls access to Microsoft 365 Copilot in Bing.com, Edge sidebar, Edge mobile app, Copilot in Windows, copilot.microsoft.com, and the Copilot app. It doesn't change how users access Copilot in other Microsoft 365 productivity apps.

+To turn on or turn off Microsoft 365 Copilot in Bing, Edge, and Windows, follow these steps:

+3. Run the following command first: 'Set-ExecutionPolicy unrestricted'.

+ - To get the **current status** of Microsoft 365 Copilot in Bing, Edge, and Windows in your tenant, run: *'.\ConfigureM365Copilot.ps1'*

+ - To **turn on** Microsoft 365 Copilot in Bing, Edge, and Windows, run: *'.\ConfigureM365Copilot.ps1 -enable $true'*

+ - To **turn off** Microsoft 365 Copilot in Bing, Edge, and Windows, run: *'.\ConfigureM365Copilot.ps1 -enable $false'*

+### Manage plugins that work with Microsoft 365 Copilot

+Microsoft 365 Copilot is powered by an advanced processing and orchestration engine that seamlessly integrates Microsoft 365 productivity apps, Microsoft Graph, and large language models (LLMs) to turn your words into the most powerful productivity tool. While Copilot is already able to use the apps and data within the Microsoft 365 ecosystem, many users still depend on various external tools and services for work management and collaboration. You can extend Microsoft 365 Copilot by building a plugin or by connecting to an external data source.

+This control allows you to control how non-Microsoft apps and first party apps can work with Microsoft 365 Copilot.

+### Optional connected experiences for Microsoft 365 Copilot and Microsoft Copilot

+Copilot can make use of cloud-backed services, called optional connected experiences, to provide additional functionality to Copilot users. For example, Copilot can [reference web content](manage-public-web-access.md) to improve the quality of its responses to user prompts. For Copilot to use these cloud-backed services, optional connected experiences must be on. For more information, see [Microsoft 365 Copilot and privacy controls for connected experiences](microsoft-365-copilot-privacy.md#microsoft-365-copilot-and-privacy-controls-for-connected-experiences).

+This link navigates you to the Microsoft Purview compliance portal where you can manage sensitivity labels, retention policies, Copilot interactions, audit records for Copilot, search Copilot interactions, and configure how Microsoft 365 Copilot interacts and references protected documents. Learn more about [how to protect and manage Microsoft 365 Copilot interactions with Microsoft Purview](/purview/ai-microsoft-purview).

+This link directs you to the Copilot for Security portal to manage settings. Copilot for Security is a separate product and license from Microsoft 365 Copilot. If purchased, you can use this link to navigate to Copilot for Security settings page. To learn more, see [Copilot for Security](/copilot/security/).

+### Microsoft 365 Copilot feedback logs

+To learn more, see [Provide user feedback for Microsoft 365 Copilot](provide-feedback.md).

+ Title: "Data, Privacy, and Security for Microsoft 365 Copilot"

+description: "Learn how Microsoft 365 Copilot uses data and how it stores and protects that data."

+# Data, Privacy, and Security for Microsoft 365 Copilot

+Microsoft 365 Copilot is a sophisticated processing and orchestration engine that provides AI-powered productivity capabilities by coordinating the following components:

+For an overview of how these three components work together, see [Microsoft 365 Copilot overview](microsoft-365-copilot-overview.md). For links to other content related to Microsoft 365 Copilot, see [Microsoft 365 Copilot documentation](index.yml).

+> - Microsoft 365 Copilot is compliant with our existing privacy, security, and compliance commitments to Microsoft 365 commercial customers, including the General Data Protection Regulation (GDPR) and European Union (EU) Data Boundary.

+> - Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft 365 Copilot.

+> - Microsoft 365 Copilot operates with multiple protections, which include, but are not limited to, [blocking harmful content](#how-does-copilot-block-harmful-content), [detecting protected material](#does-copilot-provide-protected-material-detection), and [blocking prompt injections (jailbreak attacks)](#does-copilot-block-prompt-injections-jailbreak-attacks).

+- [How does Microsoft 365 Copilot use your proprietary organizational data?](#how-does-microsoft-365-copilot-use-your-proprietary-organizational-data)

+- [How does Microsoft 365 Copilot protect organizational information and data?](#how-does-microsoft-365-copilot-protect-organizational-data)

+- [What data is stored about user interactions with Microsoft 365 Copilot?](#data-stored-about-user-interactions-with-microsoft-365-copilot)

+- [What data residency commitments does Microsoft 365 Copilot make?](#microsoft-365-copilot-and-data-residency)

+- [What extensibility options are available for Microsoft 365 Copilot](#extensibility-of-microsoft-365-copilot)

+- [How does Microsoft 365 Copilot meet regulatory compliance requirements?](#meeting-regulatory-compliance-requirements)

+- [Do privacy controls for connected experiences in Microsoft 365 Apps apply to Microsoft 365 Copilot?](#microsoft-365-copilot-and-privacy-controls-for-connected-experiences)

+- [Can I trust the content that Microsoft 365 Copilot creates? Who owns that content?](#about-the-content-that-microsoft-365-copilot-creates)

+> Microsoft 365 Copilot will continue to evolve over time with new capabilities. To keep up to date on Microsoft 365 Copilot or ask questions, visit the [Microsoft 365 Copilot community](https://techcommunity.microsoft.com/t5/microsoft-365-copilot/ct-p/Microsoft365Copilot) on the Microsoft Tech Community.

+## How does Microsoft 365 Copilot use your proprietary organizational data?

+Microsoft 365 Copilot provides value by connecting LLMs to your organizational data. Microsoft 365 Copilot accesses content and context through Microsoft Graph. It can generate responses anchored in your organizational data, such as user documents, emails, calendar, chats, meetings, and contacts. Microsoft 365 Copilot combines this content with the userΓÇÖs working context, such as the meeting a user is in now, the email exchanges the user had on a topic, or the chat conversations the user had last week. Microsoft 365 Copilot uses this combination of content and context to help provide accurate, relevant, and contextual responses.

+> Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft 365 Copilot.

+Microsoft 365 Copilot only surfaces organizational data to which individual users have at least view permissions. It's important that you're using the permission models available in Microsoft 365 services, such as SharePoint, to help ensure the right users or groups have the right access to the right content within your organization. This includes permissions you give to users outside your organization through inter-tenant collaboration solutions, such as [shared channels in Microsoft Teams](/microsoftteams/shared-channels).

+When you enter prompts using Microsoft 365 Copilot, the information contained within your prompts, the data they retrieve, and the generated responses remain within the Microsoft 365 service boundary, in keeping with our current privacy, security, and compliance commitments. Microsoft 365 Copilot uses Azure OpenAI services for processing, not OpenAIΓÇÖs publicly available services. Azure OpenAI doesn't cache customer content and Copilot modified prompts for Microsoft 365 Copilot.

+> - When youΓÇÖre using plugins to help Microsoft 365 Copilot to provide more relevant information, check the privacy statement and terms of use of the plugin to determine how it will handle your organizationΓÇÖs data. For more information, see [Extensibility of Microsoft 365 Copilot](#extensibility-of-microsoft-365-copilot).

+> - When youΓÇÖre using the web content plugin, Microsoft 365 Copilot parses the userΓÇÖs prompt and identifies terms where web grounding would improve the quality of the response. Based on these terms, Copilot generates a search query that it sends to the Bing Search service. For more information, [Data, privacy, and security for web queries in Microsoft 365 Copilot and Microsoft Copilot](/microsoft-365-copilot/manage-public-web-access).

+Abuse monitoring for Microsoft 365 Copilot occurs in real-time, without providing Microsoft any standing access to customer data, either for human or for automated review. While abuse moderation, which includes human review of content, is available in Azure OpenAI, Microsoft 365 Copilot services have opted out of it. Microsoft 365 data isnΓÇÖt collected or stored by Azure OpenAI.

+> We may use customer feedback, which is optional, to improve Microsoft 365 Copilot, just like we use customer feedback to improve other Microsoft 365 services and Microsoft 365 productivity apps. We don't use this feedback to train the foundation LLMs used by Microsoft 365 Copilot. Customers can manage feedback through admin controls. For more information, see [Manage Microsoft feedback for your organization](/microsoft-365/admin/manage/manage-feedback-ms-org) and [Providing feedback about Microsoft Copilot with Microsoft 365 apps](https://support.microsoft.com/topic/c481c26a-e01a-4be3-bdd0-aee0b0b2a423).

+## Data stored about user interactions with Microsoft 365 Copilot

+When a user interacts with Microsoft 365 Copilot (using apps such as Word, PowerPoint, Excel, OneNote, Loop, or Whiteboard), we store data about these interactions. The stored data includes the user's prompt and Copilot's response, including citations to any information used to ground Copilot's response. We refer to the userΓÇÖs prompt and CopilotΓÇÖs response to that prompt as the ΓÇ£content of interactionsΓÇ¥ and the record of those interactions is the userΓÇÖs Copilot interaction history. For example, this stored data provides users with Copilot interaction history in [Business Chat](https://support.microsoft.com/topic/5b00a52d-7296-48ee-b938-b95b7209f737) and [meetings in Microsoft Teams](https://support.microsoft.com/office/0bf9dd3c-96f7-44e2-8bb8-790bedf066b1). This data is processed and stored in alignment with contractual commitments with your organizationΓÇÖs other content in Microsoft 365. The data is encrypted while it's stored and isn't used to train foundation LLMs, including those used by Microsoft 365 Copilot.

+- [Learn about retention for Copilot](/purview/retention-policies-copilot)

+### Deleting the history of user interactions with Microsoft 365 Copilot

+Your users can delete their Copilot interaction history, which includes their prompts and the responses Copilot returns, by going to the [My Account portal](https://myaccount.microsoft.com/). For more information, see [Delete your Microsoft 365 Copilot interaction history](https://support.microsoft.com/office/76de8afa-5eaf-43b0-bda8-0076d6e0390f).

+## Microsoft 365 Copilot and the EU Data Boundary

+Microsoft 365 Copilot calls to the LLM are routed to the closest data centers in the region, but also can call into other regions where capacity is available during high utilization periods.

+## Microsoft 365 Copilot and data residency

+Microsoft 365 Copilot is upholding data residency commitments as outlined in the Microsoft Product Terms and Data Protection Addendum. Microsoft 365 Copilot was added as a covered workload in the data residency commitments in Microsoft Product Terms on March 1, 2024.

+Microsoft [Advanced Data Residency (ADR)](/microsoft-365/enterprise/advanced-data-residency) and [Multi-Geo Capabilities](/microsoft-365/enterprise/microsoft-365-multi-geo) offerings include data residency commitments for Microsoft 365 Copilot customers as of March 1, 2024. For EU customers, Microsoft 365 Copilot is an EU Data Boundary service. Customers outside the EU may have their queries processed in the US, EU, or other regions.

+## Extensibility of Microsoft 365 Copilot

+While Microsoft 365 Copilot is already able to use the apps and data within the Microsoft 365 ecosystem, many organizations still depend on various external tools and services for work management and collaboration. Microsoft 365 Copilot experiences can reference third-party tools and services when responding to a userΓÇÖs request by using [Microsoft Graph connectors](/graph/connecting-external-content-connectors-overview) or plugins. Data from Graph connectors can be returned in Microsoft 365 Copilot responses if the user has permission to access that information.

+When plugins are enabled, Microsoft 365 Copilot determines whether it needs to use a specific plugin to help provide a relevant response to the user. If a plugin is needed, Microsoft 365 Copilot generates a search query to send to the plugin on the userΓÇÖs behalf. The query is based on the userΓÇÖs prompt, Copilot interaction history, and data the user has access to in Microsoft 365.

+In the **Integrated apps** section of the [Microsoft 365 admin center](/microsoft-365/admin/admin-overview/admin-center-overview), admins can view the permissions and data access required by a plugin as well as the pluginΓÇÖs terms of use and privacy statement. Admins have full control to select which plugins are allowed in their organization. A user can only access the plugins that their admin allows and that the user installed or is assigned. Microsoft 365 Copilot only uses plugins that are turned on by the user.

+- [Extend Microsoft 365 Copilot](/microsoft-365-copilot/extensibility/)

+- [How Microsoft 365 Copilot can work with your external data](https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/how-microsoft-365-copilot-can-work-with-your-external-data/ba-p/3937645)

+## How does Microsoft 365 Copilot protect organizational data?

+The permissions model within your Microsoft 365 tenant can help ensure that data won't unintentionally leak between users, groups, and tenants. Microsoft 365 Copilot presents only data that each individual can access using the same underlying controls for data access used in other Microsoft 365 services. Semantic Index honors the user identity-based access boundary so that the grounding process only accesses content that the current user is authorized to access. For more information, see MicrosoftΓÇÖs [privacy policy and service documentation](https://privacy.microsoft.com/).

+When you have data that's encrypted by Microsoft Purview Information Protection, Microsoft 365 Copilot honors the usage rights granted to the user. This encryption can be applied by [sensitivity labels](/purview/sensitivity-labels) or by restricted permissions in apps in Microsoft 365 by using Information Rights Management (IRM). For more information about using Microsoft Purview with Microsoft 365 Copilot, see [Microsoft Purview data security and compliance protections for generative AI apps](/purview/ai-microsoft-purview).

+- For content accessed through Microsoft 365 Copilot plugins, encryption can exclude programmatic access, thus limiting the plugin from accessing the content. For more information, see [Configure usage rights for Azure Information Protection](/azure/information-protection/configure-usage-rights).

+Microsoft 365 Copilot is built on top of MicrosoftΓÇÖs current commitments to data security and privacy in the enterprise. There's no change to these commitments. Microsoft 365 Copilot is integrated into Microsoft 365 and adheres to all existing privacy, security, and compliance commitments to Microsoft 365 commercial customers. For more information, see [Microsoft Compliance](/compliance).

+### Microsoft 365 Copilot and privacy controls for connected experiences

+Some privacy controls for connected experiences in Microsoft 365 Apps can affect the availability of Microsoft 365 Copilot features. This includes the privacy controls for connected experiences that analyze your content and the privacy control for optional connected experiences. For more information about these privacy controls, see [Overview of privacy controls for Microsoft 365 Apps for enterprise](/microsoft-365-apps/privacy/overview-privacy-controls).

+#### Privacy control for connected experiences that analyze your content

+If you turn off connected experiences that analyze your content on Windows or Mac devices in your organization, Microsoft 365 Copilot features wonΓÇÖt be available to your users in the following apps:

+There's also a privacy control that turns off all connected experiences, including connected experiences that analyze your content. If you use that privacy control, Microsoft 365 Copilot features wonΓÇÖt be available for certain apps on certain devices as described above.

+#### Privacy control for optional connected experiences

+If you turn off optional connected experiences in your organization, Microsoft 365 Copilot features that are optional connected experiences wonΓÇÖt be available to your users. For example, [web grounding](manage-public-web-access.md) wonΓÇÖt be available to your users. For a list of Microsoft 365 Copilot features that are optional connected experiences, see [Experiences for Microsoft 365 Copilot](/microsoft-365-apps/privacy/optional-connected-experiences#experiences-for-microsoft-365-copilot).

+There's also a privacy control that turns off all connected experiences, including optional connected experiences. If you use that privacy control, Microsoft 365 Copilot features that are optional connected experiences wonΓÇÖt be available.

+### About the content that Microsoft 365 Copilot creates

+The responses that generative AI produces aren't guaranteed to be 100% factual. While we continue to improve responses, users should still use their judgment when reviewing the output before sending them to others. Our Microsoft 365 Copilot capabilities provide useful drafts and summaries to help you achieve more while giving you a chance to review the generated AI rather than fully automating these tasks.

+Yes, Microsoft 365 Copilot provides detection for protected materials, which includes text subject to copyright and code subject to licensing restrictions. Not all of these mitigations are relevant for all Microsoft 365 Copilot scenarios.

+[Jailbreak attacks](/azure/ai-services/openai/whats-new#responsible-ai) are user prompts that are designed to provoke the generative AI model into behaving in ways it was trained not to or breaking the rules it's been told to follow. Microsoft 365 Copilot is designed to protect against prompt injection attacks. [Learn more about jailbreak attacks and how to use Azure AI Content Safety to detect them](/azure/ai-services/content-safety/concepts/jailbreak-detection).

+- [Microsoft 365 Copilot requirements](microsoft-365-copilot-requirements.md)

+- [Get started with Microsoft 365 Copilot](microsoft-365-copilot-setup.md)

+- [Microsoft 365 Copilot adoption site](https://adoption.microsoft.com/copilot/)

+ Title: "Microsoft 365 Copilot requirements"

+description: "Learn about the requirements for Microsoft 365 Copilot."

+# Microsoft 365 Copilot requirements

+The integration of Microsoft 365 Copilot and Microsoft 365 Apps enables Copilot experiences to take place inside individual apps, such as Word, PowerPoint, Teams, Excel, Outlook, and more. As a result of this integration, the requirements for using Microsoft 365 Copilot are nearly identical to the requirements for using Microsoft 365 Apps.

+The following are the prerequisites for using Microsoft 365 Copilot. Microsoft 365 Copilot requires the user to have a prerequisite base license assigned. You can find the list of eligible base licenses in the [license requirements](#license-requirements) section or in the [Microsoft 365 Copilot service description guide](/office365/servicedescriptions/office-365-platform-service-description/microsoft-365-copilot).

+[Microsoft 365 Apps](/deployoffice/about-microsoft-365-apps) must be deployed. In the Microsoft 365 admin center, use the [Microsoft 365 Apps setup guide](https://admin.microsoft.com/Adminportal/Home?Q=learndocs#/modernonboarding/microsoft365copilotsetupguide) to deploy to your users.

+> - Review your privacy settings for Microsoft 365 Apps because those settings might have an effect on the availability of Microsoft 365 Copilot features. For more information, see [Microsoft 365 Copilot and privacy controls for connected experiences](microsoft-365-copilot-privacy.md#microsoft-365-copilot-and-privacy-controls-for-connected-experiences).

+Some features in Microsoft 365 Copilot, such as file restore and OneDrive management, require that users have a [OneDrive account](/sharepoint/introduction). You can use the [OneDrive setup guide](https://admin.microsoft.com/Adminportal/Home?Q=m365setup#/modernonboarding/onedrivequickstartguide) in the Microsoft 365 admin center to enable OneDrive for your users.

+Microsoft 365 Copilot works with classic Outlook and new Outlook (for [Windows](https://support.microsoft.com/office/getting-started-with-the-new-outlook-for-windows-656bb8d9-5a60-49b2-a98b-ba7822bc7627) and [Mac](https://support.microsoft.com/office/the-new-outlook-for-mac-6283be54-e74d-434e-babb-b70cefc77439)). Users can switch to the new Outlook by selecting **Try the new Outlook** in their existing Outlook client.

+> Microsoft 365 Copilot is only supported on primary mailboxes that are hosted on Exchange Online. It is not available on a user's archive mailbox, group mailboxes, or shared and delegate mailboxes that they have access to.

+Copilot in [Teams Phone](/microsoftteams/what-is-phone-system-in-office-365) supports both voice over Internet Protocol (VOIP) and public switched telephone network (PSTN) calls. For support across VoIP calls, you'll need a Microsoft 365 Copilot license. To use Copilot for PSTN calls, you'll need a Teams Phone license and a calling plan in addition to the Microsoft 365 Copilot license.

+To use Microsoft 365 Copilot with Microsoft Loop, you must have Loop enabled for your tenant. This can be done in the [Microsoft 365 admin center](https://admin.microsoft.com/Adminportal/Home#/Settings/Services/:/Settings/L1/Loop) or the [Microsoft 365 Apps admin center](https://config.office.com) under **Customization** \| **Policy Management**. For more information, see [Manage Loop workspaces in Syntex repository services](/microsoft-365/loop/loop-workspaces-configuration) and [Learn how to enable the Microsoft Loop app, now in Public Preview](https://techcommunity.microsoft.com/t5/microsoft-365-blog/learn-how-to-enable-the-microsoft-loop-app-now-in-public-preview/ba-p/3769013).

+To use Microsoft 365 Copilot with Microsoft Whiteboard, you must have Whiteboard enabled for your tenant. To learn more about Microsoft Whiteboard, see [Manage access to Microsoft Whiteboard for your organization](/microsoft-365/whiteboard/manage-whiteboard-access-organizations).

+See [Understand licensing for Microsoft 365 Copilot](microsoft-365-copilot-licensing.md).

+Microsoft 365 Copilot will follow the standard practice of deployment and updates for Microsoft 365 Apps, being available in all update channels, except for Semi-Annual Enterprise Channel. Preview channels (also known as Microsoft 365 Insider) include Current Channel (Preview) and Beta Channel. Production channels include Current Channel and Monthly Enterprise Channel.

+- [Microsoft 365 Copilot setup guide](https://admin.microsoft.com/Adminportal/Home?Q=learndocs#/modernonboarding/microsoft365copilotsetupguide)

+- [Microsoft 365 Copilot - Microsoft Community Hub](https://techcommunity.microsoft.com/t5/microsoft-365-copilot/ct-p/Microsoft365Copilot)

+ Title: "Get started with Microsoft 365 Copilot"

+description: "Learn how to prepare your organization for Microsoft 365 Copilot. You should assign licenses, optimize SharePoint search, give enough access, prevent oversharing, use sensitivity labels, create a pilot group, and more."

+# Get started with Microsoft 365 Copilot

+[Microsoft 365 Copilot](microsoft-365-copilot-overview.md) is an AI-powered productivity tool that uses large language models (LLMs). It integrates with your data, with Microsoft Graph, and with Microsoft 365 Apps.

+It works alongside popular Microsoft 365 Apps, like Word, Excel, PowerPoint, Outlook, Teams, and more. Copilot provides real-time intelligent assistance, enabling users to enhance their creativity, productivity, and skills.

+This article covers how you can prepare your organization for Copilot.

+This section gives an overview of the prerequisites (licensing and admin centers access), and apps that can use Copilot. There might be more requirements at [Microsoft Copilot 365 requirements](microsoft-365-copilot-requirements.md).

+### Prerequisites

+- This article uses the following admin centers. These admin centers require a specific role to complete the tasks in the article.

+ - **[Microsoft 365 admin center](https://admin.microsoft.com)**: There are different roles, depending on the task you need to complete. To learn more about roles, see [Commonly used Microsoft 365 admin center roles](/microsoft-365/admin/add-users/about-admin-roles#commonly-used-microsoft-365-admin-center-roles).

+ - **[SharePoint admin center](https://go.microsoft.com/fwlink/?linkid=2185219)**: Sign in as the [SharePoint administrator](/sharepoint/sharepoint-admin-role).

+ - **[Microsoft Purview portal](https://purview.microsoft.com)**: There are different roles, depending on the task you need to complete. To learn more, see:

+ - [Permissions required to create and manage sensitivity labels](/purview/get-started-with-sensitivity-labels#permissions-required-to-create-and-manage-sensitivity-labels)

+ - [Roles and role groups in Microsoft Defender for Office 365 and Microsoft Purview](/defender-office-365/scc-permissions)

+- You must have an appropriate **subscription plan to purchase Microsoft 365 Copilot**.

+ You can purchase Microsoft 365 Copilot licenses through the [Microsoft 365 admin center](https://admin.microsoft.com) (**Billing** > **Purchase services**), Microsoft partners, or your Microsoft account team.

+ Microsoft 365 Copilot licenses are available as an add-on to other licensing plans. To learn more, see [Understand licensing for Microsoft 365 Copilot](microsoft-365-copilot-licensing.md).

+- More licenses might be required to use some of the features describes in this article, like Microsoft Purview and SharePoint Advanced Management.

+ To learn more, see:

+ - [Microsoft Purview service description](/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-purview-service-description)

+ - [Microsoft SharePoint Premium - SharePoint Advanced Management overview](/sharepoint/advanced-management#licensing)

+### App requirements

+- **Microsoft 365 Apps** - Including desktop applications, like Word, Excel, PowerPoint, Outlook, and Teams. Copilot is available in web versions of the apps when a license is assigned. To get started with the implementation process, see [Deployment guide for Microsoft 365 Apps](/deployoffice/deployment-guide-microsoft-365-apps).

+- **OneDrive Account** - You need a OneDrive account for several features within Microsoft 365 Copilot, like saving and sharing your files. For more information, see [Sign in or create an account for OneDrive](https://support.microsoft.com/office/video-sign-in-or-create-an-account-for-onedrive-3adf09fd-90e3-4420-8c4e-b55e2cde40d2?ui=en-us&rs=en-us&ad=us).

+- **Outlook for Windows** - For seamless integration of Microsoft 365 Copilot with Outlook, new Outlook (Windows, Mac, Web, Mobile) is recommended. Copilot does support classic Outlook (Windows). You can switch to Outlook Mobile to access the new Outlook experience. For more information, see [Getting started with the new Outlook for Windows](https://support.microsoft.com/office/getting-started-with-the-new-outlook-for-windows-656bb8d9-5a60-49b2-a98b-ba7822bc7627).

+- **Microsoft Teams** - To use Microsoft 365 Copilot with Microsoft Teams, you must [download the Teams desktop client or web client](https://www.microsoft.com/microsoft-teams/download-app), or sign into the web app at [https://teams.microsoft.com](https://teams.microsoft.com/). Both the current and the new version of Teams are supported. For more information, see [Microsoft Teams desktop client](/microsoftteams/get-clients?tabs=Windows).

+ To enable Copilot in Teams to reference meeting content after the meeting end, transcription or meeting recording must be enabled. To learn more about configuring transcription and recording, see [Configure transcription and captions for Teams meetings](/microsoftteams/meeting-transcription-captions) and [Teams meeting recording](/microsoftteams/meeting-recording).

+- **Microsoft Loop** - To use Copilot in Microsoft Loop, you must have Loop enabled for your tenant. For more information on enabling Loop, see [Get started with Microsoft Loop](https://support.microsoft.com/office/get-started-with-microsoft-loop-9f4d8d4f-dfc6-4518-9ef6-069408c21f0c).

+- **Microsoft Whiteboard** - To use Microsoft 365 Copilot with Microsoft Whiteboard, you must have Whiteboard enabled for your tenant. To learn more about Microsoft Whiteboard, see [Manage access to Microsoft Whiteboard for your organization](/microsoft-365/whiteboard/manage-whiteboard-access-organizations).

+## Step 1 - Optimize search in SharePoint

+✅ **Optimize your SharePoint content for search**

+When a user makes a request to Copilot, it processes the request then generates a response with Large Language Models (LLMs) by leveraging content from Microsoft Graph and web content (optional).

+Content in Microsoft Graph includes emails, files, meetings, chats, calendars, and contacts. A significant portion of them is [stored as SharePoint ](/sharepoint/get-ready-copilot-sharepoint-advanced-management#copilot-and-sharepoint). Copilot gather SharePoint content in the same way of SharePoint Search does. To get the most out of Copilot and get the best results, optimize your SharePoint content for search by:

+- [Making sure the content can be found](/sharepoint/make-sure-content-can-be-found)

+- [Making sure the search results look great](/sharepoint/make-search-results-look-great)

+- [Planning your content](/microsoftsearch/plan-your-content)

+Microsoft 365 Copilot allows users to find and access their content through natural language prompting. Copilot ensures data security and privacy by following existing obligations and integrating with your organization's policies. It uses your Microsoft Graph content with the same access controls as other Microsoft 365 services.

+To learn more about privacy with Microsoft 365 Copilot, see [Data, Privacy, and Security for Microsoft 365 Copilot](microsoft-365-copilot-privacy.md).

+## Step 2 - Apply principles of Just Enough Access

+### Prevent sharing and control access with SharePoint and OneDrive

+To get ready for your organizationΓÇÖs Microsoft 365 Copilot adoption, there are a few [highly recommended steps you can take with SharePoint and OneDrive](/sharepoint/get-ready-copilot-sharepoint-advanced-management). To start, you can:

+✅ **Reduce accidental oversharing with SharePoint sharing settings**

+To minimize accidental content oversharing via Copilot results, implement the best practice sharing settings at both the organization and site levels:

+1. At the organization level:

+ - Update [sharing settings for SharePoint and OneDrive](/sharepoint/turn-external-sharing-on-or-off) for your tenant from organization-wide sharing to specific people links.

+ - Consider hide broad-scope permissions from your end users. For example, use the SharePoint `Set-SPOTenant` PowerShell cmdlet to [hide "Everyone Except External Users" in the People Picker control](/powershell/module/sharepoint-online/set-spotenant) so end users can't use it.

+ - Use [Restricted SharePoint Search(RSS)](/sharepoint/restricted-sharepoint-search) to temporarily restrict Copilot results to up to 100 selected SharePoint sites (child sites of Hub sites are not counted toward the 100 limit).RSS gives you time to review & audit site permissions. It should be used only as a temporary solution to give your organization time to adopt Copilot.

+2. Reduce accidental oversharing at the site level:

+ - Educate site admins on the site-level controls they can use to [restrict members from sharing](/sharepoint/change-external-sharing-site).

+ - Make sure that [Site Owners receive a request to access the site](https://support.microsoft.com/office/set-up-and-manage-access-requests-94b26e0b-2822-49d4-929a-8455698654b3).

+ - [Change the external sharing setting for a user's OneDrive](/sharepoint/user-external-sharing-settings). When a user saves a file to OneDrive, it's in the end user's personal storage. The user has full control over the file and can share it with others. To ensure data security, review OneDrive sharing features.

+✅ **Check permissions and site access in SharePoint admin center**

+To ensure data is secure, review SharePoint site access and permissions. Prioritize sites that contain sensitive information.

+1. In the [SharePoint admin center](https://go.microsoft.com/fwlink/?linkid=2185219), see **Active Sites** > select a site > **Edit** > **Settings**.

+ **Private** means that only users in your organization with access to the site can find it. **Public** (default) means anyone in your organization can find the site and access its content.

+ :::image type="content" source="media/sharepoint-active-sites-setting.png" alt-text="Screenshot showing the SharePoint admin center active sites panel." lightbox="media/sharepoint-active-sites-setting.png":::

+1. In the **Membership** tab, review access to site owners, members, and visitors. Ensure that only the necessary users have access to the site.

+✅ **Identify sites with potentially overshared content and control access** *

+You can use SharePoint Advanced Management(SAM) activity based reports to quickly identify most actively overshared sites, by running three individual reports:

+- [Usage of "Everyone Except External Users"](/sharepoint/data-access-governance-reports#content-shared-with-everyone-except-external-users-eeeu-reports)

+- [Usage of ΓÇ£People in your organization" sharing links](/sharepoint/data-access-governance-reports#sharing-links-reports)

+- [Usage of "Anyone" sharing links](/sharepoint/data-access-governance-reports#sharing-links-reports)

+You can then [initiate a Site Access Review](/sharepoint/restricted-access-control) for site owners to confirm overshared content and take remediation steps. Meanwhile, you as the SharePoint admin can use the [Restricted Access Control Policy](/sharepoint/restricted-access-control) to restrict access to a site with overshared content.

+For business-critical sites, you can:

+- Use [Restricted Access Control (RAC)](/sharepoint/restricted-access-control) to proactively protect against oversharing. Even better: as part of your custom site provisioning process, configure RAC policy on new sites from the get-go and proactively avoid oversharing forever.

+- Consider blocking downloads from selected sites via a block download policy. Or specifically [block the download of Teams meeting recordings and transcripts](/microsoftteams/block-download-meeting-recording).

+- Finally, consider applying encryption action with "extract rights" enforced on business-critical office documents. Learn more [here](/purview/ai-microsoft-purview).

+> [!NOTE]

+> SharePoint Advanced Management has more features to help you get ready for Copilot fast and at scale. To learn more, see [Get ready for Copilot for Microsoft 365 with SharePoint Advanced Management (SAM)](/sharepoint/get-ready-copilot-sharepoint-advanced-management).

+✅ **Can use tenant restrictions and MDM policies to block personal accounts**

+For users with multiple Microsoft accounts (work/school account or personal account), Copilot features work seamlessly in Excel, Word, PowerPoint, and OneNote when:

+- One of those accounts signs into a Windows session, and

+- One of those accounts has a Copilot Pro or Microsoft 365 Copilot license assigned

+For example:

+- A user has a Microsoft 365 Copilot license and is on their work machine. On the work machine, the user can open a document from their personal OneDrive, and use Copilot in the personal document.

+- A user has a Copilot Pro license and signs in to their work device with their personal Microsoft account (MSA). On the work device, the user can use Copilot with Office files stored on their OneDrive (work or personal) or in SharePoint document libraries.

+As an admin, you can:

+- Use a [Microsoft Entra tenant restriction](/entra/external-id/tenant-restrictions-v2) that blocks users from adding a personal Microsoft account to their work device. This feature prevents users with Copilot Pro from seeing and using Copilot features in their personal Microsoft 365 apps on their work device.

+ You need to create tenant restriction policies for each Microsoft 365 app. To learn more, see [Set up tenant restrictions](/entra/external-id/tenant-restrictions-v2).

+- Prevent Microsoft 365 apps from using your work/school Microsoft Entra accounts on end users personally owned devices that use Copilot. Specifically, you can use compliance and Conditional Access policies that prevent users from accessing resources on noncompliant devices.

+ For more information on using Microsoft Intune for these policies, see:

+ - [Use compliance policies to set rules for devices you manage with Intune](/mem/intune/protect/device-compliance-get-started)

+ - [Common ways to use Conditional Access with Intune](/mem/intune/protect/conditional-access-intune-common-ways-use)

+> [!NOTE]

+> In sovereign tenants where Microsoft 365 Copilot is not available, users are blocked from using Copilot features. They're blocked even if a device has multiple accounts signed in and one of those accounts has Copilot.

+### Sensitivity labels from Microsoft Purview

+✅ **Use sensitivity labels to protect your data**

+In the [Microsoft Purview portal](https://purview.microsoft.com), you can create [sensitivity labels](/purview/create-sensitivity-label) (**Information protection** > **Sensitivity labels**). Use these labels to identify how sensitive the data is in your organization. When they're applied to items like documents and emails, the labels add an extra layer of protection and can affect Copilot results.

+The extra later of protection includes:

+- Copilot Business Chat can reference data from different types of items. The sensitivity label with the highest priority is visible to users.

+- If the label applies encryption, Copilot checks the usage rights for the user. For Copilot to return data from that item, the user must be granted permissions to copy from it.

+With sensitivity labels, you can:

+1. **Create labels or activate default labels**: If you don't already have sensitivity labels, you might be eligible to have some [default labels](/purview/mip-easy-trials#default-sensitivity-labels) automatically created for you, like Public, General, and Confidential. The default labels are suitable for items like files, emails, and meetings. You can modify the default labels and always create your own labels.

+ To learn more, see:

+ - [Create and configure sensitivity labels and their policies](/purview/create-sensitivity-labels)

+ - [Default labels and policies to protect your data](/purview/mip-easy-trials)

+2. **Define the data sensitivity requirements** and review your SharePoint sites & files in OneDrive. Focus on the most critical repositories and determine the sensitivity of the data on these sites.

+ If you're piloting Copilot, deploy Copilot licenses to users who have access to these critical sites. Then, iterate through the rest of your repositories and expand your user base.

+ For a more detailed strategy to deploy and drive adoption, see [Step 7 - Deploy to some users and measure adoption](#step-7deploy-to-some-users-and-measure-adoption) (in this article).

+3. **Enable and apply sensitivity labels**: [Enable sensitivity labels for files in SharePoint and OneDrive](/purview/sensitivity-labels-sharepoint-onedrive-files). Then, with a publishing label policy, you can configure a default label and users can manually apply your labels. To label at scale, use [autolabeling](/purview/apply-sensitivity-label-automatically) to automatically apply labels based on sensitive information detected.

+ For more information about the different ways that you can apply sensitivity labels, see [Common scenarios for sensitivity labels](/purview/get-started-with-sensitivity-labels#common-scenarios-for-sensitivity-labels).

+ One of the available labeling methods is to apply sensitivity labels based on content found in documents when you use [data loss prevention (DLP) policies](/purview/dlp-learn-about-dlp). DLP policies can automatically apply sensitivity labels when specific types of information are identified in a document, like personal data that includes addresses, tax information, or passport numbers.

+ With DLP policies, you can also:

+ - Use the [trainable classifier tool](/purview/trainable-classifiers-get-started-with) to identify categories of content, like source code, financial documents, and HR.

+ - Set up [endpoint DLP policies](/purview/endpoint-dlp-learn-about) that restrict users from specific actions, like copying content to clipboard or removable USB devices, or printing.

+Once applied, the sensitivity labels enforce your protection settings.

+To learn more about sensitivity labels, see [Learn about sensitivity labels](/purview/sensitivity-labels).

+### Copilot activity and Microsoft Purview

+✅ **Audit Copilot activity, create retention policies, and use eDiscovery and communication compliance**

+In the [Microsoft Purview portal](https://purview.microsoft.com), you can use the following features to search for specific content and activities that include Copilot prompts and responses.

+- **Audit**

+ You can search for specific activities, activities performed by specific users, and activities that occurred with a date range. To learn more, see [Learn about auditing solutions in Microsoft Purview](/purview/audit-solutions-overview).

+- **Retention policies**

+ Configure retention policies to retain the Copilot prompts and responses if this data is needed for compliance reasons, even if users delete their chat history. To learn more, see [Learn about retention for Copilot](/purview/retention-policies-copilot).

+- **eDiscovery and communication compliance**

+ Use eDiscovery and communication compliance policies to analyze Copilot user prompts and responses. The policies can detect inappropriate or risky interactions, or sharing of confidential information.

+ To learn more, see [Microsoft Purview eDiscovery solutions](/purview/ediscovery) and [Configure a communication compliance policy to detect for Copilot interactions](/purview/communication-compliance-copilot?tabs=purview-portal).

+> [!TIP]

+> To learn more about these Microsoft Purview security and compliance protections for Copilot, and how Microsoft Purview AI Hub can help you more quickly deploy them, see [Microsoft Purview data security and compliance protections for generative AI apps](/purview/ai-microsoft-purview).

+## Step 3 - Review app privacy

+✅ **Review your Microsoft 365 apps privacy settings**

+The privacy settings in your Microsoft 365 apps can affect the availability of Microsoft 365 Copilot features. To ensure that users can access Copilot features, review the privacy settings in your Microsoft 365 apps.

+For more information, see [Microsoft 365 Copilot and privacy controls for connected experiences](microsoft-365-copilot-privacy.md#microsoft-365-copilot-and-privacy-controls-for-connected-experiences).

+## Step 4 - Update channels

+✅ **Use the Current Channel or Monthly Enterprise Channel to update apps**

+Microsoft 365 Copilot follows the Microsoft 365 Apps standard practice for deployment and updates. It's available in all update channels, *except* for Semi-Annual Enterprise Channel.

+Your options:

+- **Production** channels include **Current Channel** and **Monthly Enterprise Channel**.

+ - **Current Channel** provides your users with the newest Microsoft 365 app features as soon as they're ready. It provides the best experience for a fast-moving product, like Copilot.

+ - **Monthly Enterprise Channel** gives more predictability of when these new Microsoft 365 app features are released each month. It's a good option for organizations that want to validate the new features before they're released to the Current Channel.

+- **Preview** channels include **Current Channel (Preview)** and **Beta Channel**.

+ Preview channels are a great option to validate the product before rolling out to the rest of organization. To learn more, see [Overview of update channels](/deployoffice/updates/overview-update-channels) and [Microsoft 365 Insider channels](/deployoffice/insider/compare-channels).

+## Step 5 - Provision Microsoft 365 Copilot licenses

+✅ **Assign Copilot licenses using the Microsoft 365 admin center**

+The next step is to assign licenses. You can assign to individual users or to groups of users, and also reassign licenses to other users. You can manage Microsoft 365 Copilot licenses in the Microsoft 365 admin center.

+- To access license management in the [Microsoft 365 admin center](https://admin.microsoft.com), see **Billing** > **Licenses**.

+To learn more about enabling Copilot in your organization, see [Enable users for Microsoft 365 Copilot](microsoft-365-copilot-enable-users.md).

+You can also assign licenses in bulk to [groups of users through the Azure admin center](/entra/identity/users/licensing-groups-assign) or [assign licenses to users with PowerShell](/microsoft-365/enterprise/assign-licenses-to-user-accounts-with-microsoft-365-powershell). For more information, see [Assign Microsoft 365 licenses to users](/microsoft-365/admin/manage/assign-licenses-to-users).

+## Step 6 - Configure settings for Copilot

+✅ **Configure more Copilot features**

+In the [Microsoft 365 admin center](https://admin.microsoft.com) > **Copilot**, there are more Copilot features that benefit admins and settings you can configure that benefit your organization.

+You can:

+- View the status of Copilot license assignments

+- Access the latest information on Copilot

+- Manage data security and compliance controls

+- Submit feedback on behalf of users

+- Configure plugins and permissions

+- Enable the use of web data as grounding data in Copilot

+To learn more, see [Manage Microsoft 365 Copilot with the Copilot page](microsoft-365-copilot-page.md).

+## Step 7 - Deploy to some users and measure adoption

+✅ **Create a group of early adopters**

+There are many uses of Microsoft 365 Copilot across the various Microsoft 365 productivity apps. And, there are opportunities for users to find value in different ways.

+To help drive adoption, create a group of early adopters. This group can help you understand how users are using Copilot and how it's valuable to them.

+1. Identify users across various business groups in your organization, ideally with high usage of existing Microsoft 365 features. You can identify these users by [reviewing usage metrics](/microsoft-365/admin/activity-reports/microsoft365-apps-usage-ww) in the [Microsoft 365 admin center](https://admin.microsoft.com).

+2. Assign these users Microsoft 365 Copilot licenses and onboard them using the resources available at the [Microsoft 365 Copilot adoption hub](https://adoption.microsoft.com/), including the [user onboarding kit](https://adoption.microsoft.com/copilot/user-onboarding-toolkit/).

+3. As these users get more comfortable with using Copilot, they can speak to how they use it best, and where it's most valuable for them. This information provides you with product champions that can help other users adopt and use Copilot across your organization.

+ With your established community of early adopters or Champions, they can better speak to their peers within their organization and contextualize the value of Copilot to best suit their needs. This framework also provides IT departments with a scalable way to handle questions through Champions, developing a team of experts across your organization.

+ To learn more about driving adoption, visit the [Microsoft 365 Copilot adoption hub](https://adoption.microsoft.com/Copilot/).

+✅ **Get insights and user sentiment**

+To measure the impact of Copilot on your organization, use the [Copilot Dashboard from Viva Insights](/viva/insights/org-team-insights/copilot-dashboard). Viva Insights gives organizational leaders and IT decision makers insights into readiness, adoption, impact, and user sentiment.

+To learn more, see:

+- [Open the Microsoft Copilot Dashboard (Preview) from Viva Insights](https://aka.ms/copilotdashboard)

+- [Learn more about the Microsoft Copilot Dashboard (Preview) from Viva Insights](/viva/insights/org-team-insights/copilot-dashboard)

+- [Microsoft 365 Copilot setup guide](https://admin.microsoft.com/Adminportal/Home?Q=learndocs#/modernonboarding/microsoft365copilotsetupguide)

+- [Microsoft 365 Copilot ΓÇô Microsoft Adoption](https://adoption.microsoft.com/Copilot/)

+- [Microsoft 365 Copilot - Microsoft Community Hub](https://techcommunity.microsoft.com/t5/microsoft-365-copilot/ct-p/Microsoft365Copilot)

+- [Microsoft 365 Copilot technical documentation hub](index.yml)

+ Title: "Transparency Note for Microsoft 365 Copilot"

+description: "Transparency Note for Microsoft 365 Copilot"

+# Transparency Note for Microsoft 365 Copilot

+## The Basics of Microsoft 365 Copilot

+[Microsoft 365 Copilot](microsoft-365-copilot-overview.md) is an AI-powered productivity tool that uses large language models (LLMs) and integrates data with [Microsoft Graph](/graph/) and Microsoft 365 apps and services. It works alongside popular Microsoft 365 apps such as Word, Excel, PowerPoint, Outlook, Teams, and more.

+Microsoft 365 Copilot uses a combination of models provided by Azure OpenAI Service. This allows us to match the specific needs of each feature ΓÇô for example, speed, creativity ΓÇô to the right model, so that Microsoft 365 Copilot can provide real-time intelligent assistance that enables users to enhance their creativity, productivity, and skills.

+|User Prompt |A User Prompt is the text sent to Microsoft 365 Copilot to execute a specific task or provide information. For example, a user might input the following prompt: Write an email congratulating my team on the end of the fiscal year. |

+|Processing |Processing of a user prompt in Microsoft 365 Copilot involves several steps, including responsible AI checks, to ensure that Microsoft 365 Copilot provides relevant and actionable responses. |

+|Grounding |Grounding refers to the process of providing input sources to the LLM related to the user prompt. By enabling Microsoft 365 Copilot to access data to use as input sources ΓÇô such as data from Microsoft Graph or Bing ΓÇô Microsoft 365 Copilot may deliver more accurate, contextually relevant responses to users. |

+|Microsoft Graph Connectors |Microsoft Graph Connectors offer a way to bring content from external services into Microsoft Graph, enabling external data to power Microsoft 365 intelligent experiences such as Microsoft Search and Microsoft 365 Copilot. |

+|Indexing |Microsoft uses both lexical and semantic indexing of Microsoft Graph data to ground responses for Microsoft 365 Copilot in enterprise data. Indexing interprets user prompts to produce contextually relevant responses. For more on indexing, see [System Behavior](#system-behavior). |

+|Enriched prompt|A prompt is enriched when additional instructions are added to a user's inputted prompt to guide Microsoft 365 Copilot in generating a more specific and relevant response. |

+|Content of interactions|The term used to describe the userΓÇÖs prompt and Microsoft 365 CopilotΓÇÖs response to that prompt.|

+|LLM Response|The content generated by the LLM as a response to the user prompt that is returned to Microsoft 365 Copilot.|

+|Post-processing|The processing Microsoft 365 Copilot does after it receives a response from the LLM. This post-processing includes additional grounding calls to Microsoft Graph, responsible AI, security, compliance, and privacy checks.|

+|Copilot agents|Copilot agents are applications developed by Microsoft and other providers that users and organizations can install to add new skills and knowledge to Microsoft 365 Copilot. For more information about the use of AI in Copilot agents, refer to those offerings directly. |

+|Microsoft 365 Copilot in Word |Microsoft 365 Copilot in Word transforms writing with efficiency and creativity ΓÇôso that users can create, summarize, comprehend, refine, and elevate documents. Users can also use enhanced capabilities like visualizing and transforming text into a table. Some other capabilities also include adding onto existing prompts, drafting a document by referencing other documents and discovering information about documents. <br/><br/> For more information, see [Frequently asked questions about Copilot in Word](https://support.microsoft.com/office/7fa03043-130f-40f3-9e8b-4356328ee072). |

+|Microsoft 365 Copilot in PowerPoint |Microsoft 365 Copilot in PowerPoint lets users create a new presentation from a prompt or Word file, leveraging enterprise templates. The chat feature enables Summary and Q&A and light commanding enables users to add slides, pictures, or make deck-wide formatting changes. PowerPoint files can also be used for grounding data. <br/><br/> For more information, see [Frequently Asked Questions about Copilot in PowerPoint](https://support.microsoft.com/office/3e229188-9086-4f4c-9f9f-824cd25ae84f). |

+|Microsoft 365 Copilot in Excel |Microsoft 365 Copilot in Excel assists users with suggestions for formulas, chart types, and insights about data in spreadsheets. <br/><br/> For more information, see [Frequently asked questions about Copilot in Excel](https://support.microsoft.com/office/7a13758f-d61e-4a56-8440-f2c9a07802ec). |

+|Microsoft 365 Copilot in Outlook |Microsoft 365 Copilot in Outlook helps manage the email inbox and create impactful communication more efficiently. Microsoft 365 Copilot in Outlook can summarize an email thread, suggest action items, replies, and follow-up meetings. It can also adjust length and tone when drafting an email. <br/><br/> For more information, see [Frequently asked questions about Copilot in Outlook](https://support.microsoft.com/office/07420c70-099e-4552-8522-7d426712917b). |

+|Microsoft 365 Copilot in Teams |Microsoft 365 Copilot in Teams can recap conversations, organize key discussion points, and summarize key actions. Users can get answers to specific questions and catch up on things theyΓÇÖve missed in meetings or chat <br/><br/> For more information, see [Frequently asked questions about Copilot in Microsoft Teams](https://support.microsoft.com/office/e8737767-4087-4ae6-b1d8-10264152b05a). |

+|Microsoft 365 Copilot in Loop |Microsoft 365 Copilot in Loop allows users to create content that can be collaboratively improved through direct editing or refinement by Copilot. <br/><br/> For more information, see [Frequently asked questions about Copilot in Loop](https://support.microsoft.com/office/cdba1c99-3a3f-4f0d-bb1b-8ca62d0bb23d). |

+|Microsoft 365 Copilot in Microsoft Stream|Microsoft 365 Copilot in Microsoft Stream helps get information from any video with a transcript. Microsoft 365 Copilot in Stream can provide a summary of the video, answer specific questions, quickly jump to specific topics or points of discussion, and identify calls to action. <br/><br/> For more information, see [Frequently asked questions about Copilot in Stream](https://support.microsoft.com/topic/20ef6f0e-10f8-47aa-8bb7-697db7445fae). |

+|Microsoft 365 Copilot in Whiteboard|Microsoft 365 Copilot in Whiteboard helps kickstart the ideation process to generate, categorize, and summarize ideas. <br/><br/> For more information, see [Frequently Asked Questions about Copilot in Whiteboard](https://support.microsoft.com/topic/cbe05878-d68d-4d9d-83c1-5b47d6b76792). |

+|Microsoft 365 Copilot in OneNote|Microsoft 365 Copilot in OneNote enables users to draft plans, generate ideas, create lists, and organize information to help them find what they need in the OneNote app.<br/><br/> For more information, see [Frequently asked questions about Copilot in OneNote](https://support.microsoft.com/office/2d9136e0-132a-4d4c-ab0e-39cf3ed914cc). |

+|Business Chat|Business Chat combines the power of Large Language Models with the Internet, work content and context, and other apps, to help users draft content, catch up on whatΓÇÖs missed, and get answers to questions via prompts. |

+|Power Platform Connectors|Power Platform Connectors allow customers to access real time data from a collection of business and personal productivity applications in the Microsoft 365 Copilot experience.|

+|Microsoft Graph Connectors|Microsoft Graph Connectors enable connections to external data sources, including up to 500 items per Microsoft 365 Copilot license. |

+|Microsoft Purview|Microsoft Purview is a solution that helps organizations manage and protect their data. It provides a unified platform for data governance, information protection, risk management, and compliance. Customers can extend Microsoft Purview capabilities provided by customersΓÇÖ Microsoft subscriptions (for example, Microsoft 365 E3 or E5 subscriptions) to Microsoft 365 Copilot data and interactions.|

+Microsoft 365 Copilot uses a combination of LLMs to summarize, predict, and generate content. These LLMs include pre-trained models, such as Generative Pre-Trained Transformers (GPT) like GPT-4 from OpenAI, designed to excel in these tasks.

+- **Microsoft 365 apps** (such as Word, Excel, PowerPoint, Outlook, OneNote, Teams, and Loop) operate with Microsoft 365 Copilot to support users in the flow of their work. For example, Microsoft 365 Copilot in Word is designed to assist users specifically in the process of creating, understanding, and editing documents. In a similar way, Microsoft 365 Copilot in the other apps helps users in the context of their work within those apps.

+- **Business Chat** enables customers to bring work content and context to Microsoft 365 Copilot's chat capabilities. With Business Chat, users can draft content, catch up on what they missed, and get answers to questions via open-ended promptsΓÇö all securely grounded in work data. Use Business Chat at many surfaces, including within Microsoft Teams, at [Microsoft365.com](https://www.microsoft365.com/), and at [copilot.microsoft.com](https://copilot.microsoft.com/).

+#### Here's an explanation of how Microsoft 365 Copilot works:

+- Microsoft 365 Copilot receives an input prompt from a user in an app, such as Word or PowerPoint.

+- Microsoft 365 Copilot then processes the user prompt, which improves the specificity of the prompt, to help the user get answers that are relevant and actionable to their specific task. The prompt can include text from input files or other content discovered by Microsoft 365 Copilot using Microsoft Graph, and Microsoft 365 Copilot sends this prompt to the LLM for processing. Microsoft 365 Copilot only accesses data that an individual user has existing access to, based on, for example, existing Microsoft 365 role-based access controls.

+- Microsoft 365 Copilot takes the response from the LLM and post-processes it. This post-processing includes other grounding calls to Microsoft Graph, responsible AI checks such as content classifiers, security, compliance and privacy checks, and command generation.

+- Microsoft 365 Copilot returns the response to the app, where the user can review and assess the response.

+The data is encrypted while it's stored and isn't used to train Azure OpenAI Service [foundation LLMs](https://blogs.microsoft.com/on-the-issues/2024/03/28/data-protection-responsible-ai-azure-copilot/), including those used by Microsoft 365 Copilot. For more information about this, see [Data, Privacy, and Security for Microsoft 365 Copilot](microsoft-365-copilot-privacy.md).

+Microsoft 365 Copilot offers features to help users unlock productivity and creativity. Its adaptability means that it can be customized to meet the unique needs of different organizations. The ability to extend its capabilities through extensions makes it a continually evolving asset that can adapt to the ever-changing landscape of business needs. Learn more about customizing Microsoft 365 Copilot at [Copilot | Microsoft Developer](https://developer.microsoft.com/copilot). For more information about the use of AI in extensions, refer to those offerings directly.

+Microsoft 365 Copilot is a general-purpose service, designed to assist with a wide variety of everyday tasks across any organization by connecting with work data and integrating with the apps customers use every day. For example:

+- **Chat and conversation interaction & creation**: Users can interact with Business Chat and generate responses drawn from trusted documents such as internal company documentation or tech support documentation.

+Microsoft provides detailed guidance focusing on common use cases and scenarios, to help customers accelerate the integration of Microsoft 365 Copilot capabilities into their organizations. Learn more at [Microsoft Copilot Scenario Library ΓÇô Microsoft Adoption](https://adoption.microsoft.com/copilot-scenario-library/).

+We encourage users to review all content generated by Microsoft 365 Copilot before putting it to use. Additionally, there are certain scenarios that we recommend avoiding. In some cases, meaningful human oversight and review can further reduce the risk of harmful outcomes.

+### Specific Limitations of Microsoft 365 Copilot

+1. **Integration and Compatibility**: While Microsoft 365 Copilot is designed to integrate seamlessly with Microsoft 365 applications, there can be limitations or issues with compatibility in certain environments, especially with third party (non-Microsoft) apps and customized or non-standard configurations.

+2. **Customization and flexibility**: While Microsoft 365 Copilot can be tailored, there are limitations on how much it can be customized to fit specific organizational needs or workflows. Organizations might find certain features or responses to be rigid or not fully aligned with organizational requirements.

+3. **Dependence on internet connectivity**: Microsoft 365 Copilot relies on internet connectivity to function. Any disruption in connectivity can impact the availability and performance of the service.

+4. **User training and adoption**: Effective use of Microsoft 365 Copilot requires users to understand its capabilities and limitations. There might be a learning curve, and users need to be trained to effectively interact with and benefit from the service.

+6. **Legal and compliance considerations**: Organizations need to consider their particular legal and compliance obligations when using Microsoft 365 Copilot, especially in regulated industries. Microsoft is examining regulatory requirements that apply to Microsoft as a provider of the technology and addressing them within the product through a process of continuous improvement.

+7. **Bias, stereotyping, and ungrounded content**: Despite intensive training by OpenAI and the implementation of responsible AI controls by Microsoft on both user prompts and LLM outputs, AI services are fallible and probabilistic. This makes it challenging to comprehensively block all inappropriate content, leading to potential biases, stereotypes, or ungroundedness in AI-generated content. For more on the known limitations of AI-generated content, see the [Transparency Note for Azure OpenAI Service](/legal/cognitive-services/openai/transparency-note), which includes references to the LLMs behind Microsoft 365 Copilot.

+## Microsoft 365 Copilot performance

+In many AI systems, performance is often defined in relation to accuracyΓÇöthat is, how often the AI system offers a correct prediction or output. With Microsoft 365 Copilot, two different users might look at the same output and have different opinions of how useful or relevant it is, which means that performance for these systems must be defined more flexibly. We broadly consider performance to mean that the application performs as users expect.

+### Best practices for improving the Microsoft 365 Copilot experience

+To improve the performance in relation to the accuracy of Microsoft 365 Copilot output, we recommend that organizations consider the following:

+- **Write good prompts.** Writing good prompts is key to getting better outcomes with Microsoft 365 Copilot. Just like there are techniques to help people communicate effectively with a human, there are guidelines that may help users get better results with Microsoft 365 Copilot when writing prompts. For example: include details, structure prompts, provide positive instructions, iterate and regenerate, and always review and verify AI-generated responses. For more information, see [Get better results with Copilot prompting](https://support.microsoft.com/topic/77251d6c-e162-479d-b398-9e46cf73da55).

+- **Allow referencing of web content.** Allowing Microsoft 365 Copilot to reference web content can improve the quality, accuracy, and relevance of Microsoft 365 Copilot responses where a response would benefit from current, public information from the web. Note, however, that when Microsoft 365 Copilot references web content, it does so via the Bing Search service, and data-handling practices for Bing Search queries are different from how data is handled by Microsoft 365 Copilot. The use of Bing is covered by the [Microsoft Services Agreement](https://www.microsoft.com/servicesagreement) between each user and Microsoft, together with the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement).

+- **Extend grounding in Microsoft Graph.** Microsoft 365 Copilot uses data from Microsoft Graph to ground responses in organization-specific data like emails, chats, files, and calendars. By extending Microsoft Graph with organizational data from sources like CRM systems, or external file repositories, organizations can include additional context-specific, relevant information that further enhances the richness and accuracy of Microsoft 365 Copilot responses.

+Like other transformational technologies, harnessing the benefits of AI isn't risk-free, and a core part of MicrosoftΓÇÖs responsible AI program is designed to identify potential risks, measure their propensity to occur, and build mitigations to manage them. Guided by our AI Principles and our Responsible AI Standard, and building on learnings from other generative AI products and our centralized mitigation infrastructure (for example, [Azure AI Content Safety](/azure/ai-services/content-safety/)), we seek to map, measure, and manage potential risks and misuse of Microsoft 365 Copilot while securing the transformative and beneficial uses that the new experience provides. In the sections below we describe our iterative approach to map, measure, and manage potential risks.

+At the model level, our work began with exploratory analyses of GPT-4 in the late summer of 2022. This included conducting extensive red team testing in collaboration with OpenAI. This testing was designed to assess how the latest technology would work without any additional safeguards applied to it. Our specific intention at this time was to identify risks, surface potential avenues for misuse, and identify capabilities and limitations. Our combined learnings across OpenAI and Microsoft contributed to advances in model development and, for us at Microsoft, informed our understanding of risks and contributed to early mitigation strategies for all of our generative AI technologies, including Microsoft 365 Copilot.

+In addition to model-level red team testing, a multidisciplinary team of experts conducted application-level red team testing on Microsoft 365 Copilot experiences before making them publicly available. This process helped us better understand how the system could be exploited and improve our mitigations. Post-release, the new AI experiences in Microsoft 365 Copilot are integrated into the engineering organizationΓÇÖs existing production measurement and testing infrastructure.

+Red team testing can surface instances of specific risks, but in production users will have millions of different kinds of interactions with Microsoft 365 Copilot. Moreover, interactions are contextual and often multi-turn, and identifying harmful content within an interaction is a complex task. To better understand and address the potential for risks for our generative AI services, including Microsoft 365 Copilot experiences, we developed responsible AI evaluations specific to those new AI experiences for measuring potential risks like jailbreaks, harmful content, and ungrounded content.

+As an illustrative example, the updated partially automated measurement pipeline for harmful content includes two major innovations: conversation simulation and automated, human-verified conversation annotation. First, responsible AI experts built templates to capture the structure and content of conversations that could result in different types of harmful content. These templates were then given to a conversational agent, which interacted as a hypothetical user with Microsoft 365 Copilot, generating simulated conversations. To identify whether these simulated conversations contained harmful content, we took guidelines that are typically used by expert linguists to label data and modified them for use by LLMs to label conversations at scale, refining the guidelines until there was significant agreement between model-labeled conversations and human-labeled conversations. Finally, we used the model-labeled conversations to understand the effectiveness of Microsoft 365 Copilot at mitigating harmful content.

+As we identified potential risks and misuse through processes like red team testing and measured them, we developed mitigations to reduce the potential for harm. Below, we describe some of those mitigations. We'll continue monitoring the Microsoft 365 Copilot experiences to improve product performance and mitigations.

+- **Phased release, continual evaluation.** We're committed to learning and improving our responsible AI approach continuously as our technologies and user behavior evolve. We're making changes to Microsoft 365 Copilot regularly to improve product performance, improve existing mitigations, and implement new mitigations in response to our learnings.

+- **Grounding in business data.** A known risk with large language models is their ability to generate ungrounded contentΓÇöcontent that appears correct but isn't present in source materials. An important mitigation in Microsoft 365 Copilot is to ground AI-generated content in relevant business data that the user has access to based on their permissions. For example, based on the user prompt, Microsoft 365 Copilot is provided with relevant business documents to ground its response in those documents. However, in summarizing content from various sources, Microsoft 365 Copilot may include information in its response that isn't present in its input sources. In other words, it may produce ungrounded results. Users should always take caution and use their best judgment when using outputs from Microsoft 365 Copilot. We have taken several measures to mitigate the risk that users may over-rely on ungrounded AI-generated content. Where possible, responses in Microsoft 365 Copilot that are based on business documents include references to the sources for users to verify the response and learn more. Users are also provided with explicit notice that they're interacting with an AI system and advised to check the source materials to help them use their best judgment.

+- **AI-based classifiers and metaprompting to mitigate potential risks or misuse.** The use of LLMs may produce problematic content that could lead to harm. Examples could include output related to self-harm, violence, graphic content, protected material, inaccurate information, hateful speech, or text that could relate to illegal activities. Classifiers such as those available in Azure AI Content Safety and metaprompting are two examples of mitigations that have been implemented in Microsoft 365 Copilot to help reduce the risk of these types of content. Classifiers classify text to flag different types of potentially harmful content in user prompts or generated responses. Microsoft 365 Copilot uses AI-based classifiers and content filters. Flags lead to potential mitigations, such as not returning generated content to the user or diverting the user to a different topic. Metaprompting involves giving instructions to the model to guide its behavior, including so that the system behaves in accordance with Microsoft's AI Principles and user expectations. For example, the metaprompt may include a line such as ΓÇ£communicate in the userΓÇÖs language of choice.ΓÇ¥

+- **Prompt enrichment.** In some cases, a user's prompt may be ambiguous. When this happens, Microsoft 365 Copilot may use the LLM to help build out more details in the prompt to help ensure users get the response they're seeking. Such prompt enrichment doesn't rely on any knowledge of the user or their prior searches, but instead on the LLM.

+- **User-centered design and user experience interventions.** User-centered design and user experiences are an essential aspect of MicrosoftΓÇÖs approach to responsible AI. The goal is to root product design in the needs and expectations of users. As users interact with Microsoft 365 Copilot for the first time, we offer various touchpoints designed to help them understand the capabilities of the system, disclose to them that Microsoft 365 Copilot is powered by AI, and communicate limitations.

+- **AI disclosure.** Microsoft 365 Copilot provides several touchpoints for meaningful AI disclosure where users are notified that they're interacting with an AI system as well as opportunities to learn more about Microsoft 365 Copilot. For example, when using Microsoft 365 Copilot in the Word app, AI-generated content is given alongside notice that AI-generated content may contain errors. Empowering users with this knowledge can help them avoid over-relying on AI-generated outputs and learn about the systemΓÇÖs strengths and limitations.

+- **Media provenance.** For all images created with Designer's editing features from within Microsoft 365 Copilot, we have implemented content credentials, provenance based on the C2PA standard, to help people identify whether images were edited or generated with AI. Provenance metadata can be viewed on the [Content Credentials site](https://contentcredentials.org/verify).

+- **Feedback and ongoing evaluation.** The Microsoft 365 Copilot experience builds on existing tooling that allows users to submit feedback about our products. Users can submit feedback about content generated by Microsoft 365 Copilot by using the pane that appears after selecting thumbs up or thumbs down buttons on responses. Feedback submitted by users is used to improve our offerings as part of our commitment to improving product performance. Customer admins can review feedback submitted in the Microsoft 365 admin center. We also continually improve and test the performance of Microsoft 365 Copilot and specific mitigations as part of our ongoing evaluation and improvement of the service. Learn more at [Providing feedback about Microsoft Copilot with Microsoft 365 apps](https://support.microsoft.com/topic/c481c26a-e01a-4be3-bdd0-aee0b0b2a423).

+## Evaluating and integrating Microsoft 365 Copilot for your organization

+Microsoft provides tools like the Microsoft Copilot Dashboard for Microsoft 365 customers and reports in the Microsoft 365 admin center. These tools are designed to help organizations measure usage, adoption, and the impact of Microsoft 365 Copilot. For example:

+- **Microsoft 365 Copilot usage report** enables administrators to view a summary of how usersΓÇÖ adoption, retention, and engagement are with Microsoft 365 Copilot, and the activity of every user in an organization

+- **Adoption Score** offers administrators insights into how their organization works with Microsoft 365 Copilot. It provides a score on a 100-point scale, a dashboard view of adoption data & trends, and a tool for creating user surveys to gather feedback.

+## Learn more about Microsoft 365 Copilot

+- [Microsoft 365 Copilot overview](microsoft-365-copilot-overview.md)

+- [Data, Privacy, and Security for Microsoft 365 Copilot](microsoft-365-copilot-privacy.md)

+- [Extensibility of Microsoft 365 Copilot](microsoft-365-copilot-privacy.md#extensibility-of-microsoft-365-copilot)

+> Users with a license for Microsoft 365 Copilot will have it pinned by default.

+- [Data, Privacy, and Security for Microsoft 365 Copilot](microsoft-365-copilot-privacy.md)

+- [Microsoft 365 Copilot technical documentation hub](index.yml)

+ Title: "Provide user feedback for Microsoft 365 Copilot"

+description: "Learn how to provide Microsoft 365 Copilot feedback to Microsoft on behalf of their users who encounter issues"

+# Provide user feedback for Microsoft 365 Copilot

+Microsoft 365 Copilot is a product that helps users boost their productivity with large-language models (LLM). While Copilot is designed to provide accurate and informative responses based on the knowledge and data available in the Microsoft Graph, it's important to note that answers may not always be completely accurate. This is because Copilot generates responses based on patterns and probabilities in language data. Providing feedback is essential to improve the product and make it more dependable for users.

+Microsoft 365 Copilot currently allows user-initiated feedback. As an admin, you can give feedback to supplement the user-initiated process. This helps Microsoft receive comprehensive diagnostic data to aid in debugging, especially in cases where users may not be able to provide feedback themselves. By providing feedback on behalf of your users, you can help enhance the overall experience of Copilot for your organization by improving the quality and relevance of its responses.

+- A Microsoft 365 subscription with Microsoft 365 Copilot5 license

+- An email address of the user who experienced an issue with Microsoft 365 Copilot.

+To provide feedback to Microsoft on behalf of a user who encountered a problem with Microsoft 365 Copilot, follow these steps:

+8. The Microsoft product team will use the data in the zip file to troubleshoot and resolve the issue by correlating it with other backend systems.

+For more information about privacy with Microsoft 365 Copilot, see [Data, Privacy, and Security for Microsoft 365 Copilot](microsoft-365-copilot-privacy.md).

+- [Microsoft 365 Copilot help and learning](https://support.microsoft.com/copilot)

+- [Microsoft 365 Copilot documentation](/microsoft-365-copilot/)

+|[Microsoft 365 Copilot readiness report](microsoft-365-copilot-readiness.md)|Yes|N/A²|N/A²|N/A²|N/A²|

+|[Microsoft 365 Copilot usage report](microsoft-365-copilot-usage.md)|Yes|N/A²|N/A²|N/A²|N/A²|

+ Title: "Microsoft 365 Copilot features adoption using organizational messages"

+description: "Learn how you can use organizational messages to help with the adoption of Microsoft 365 Copilot."

+# Microsoft 365 Copilot features adoption using organizational messages

+To help with the adoption of Microsoft 365 Copilot features, organizational messages in Microsoft 365 usage analytics report enable admins to send messages to their Microsoft 365 licensed users who haven't recently used any Copilot features. In the pipeline, we're planning to expand organizational messages across platforms like Teams, Outlook, Excel, PowerPoint, and Word to further enhance the adoption of specific Copilot features.

+To preview organizational messages in the Microsoft 365 Copilot usage report, you need to have one of the following admin roles:

+In the Microsoft 365 admin center, go to **Reports** > **Usage > Microsoft 365 Copilot**.

+*The users see the Windows 11 notification recommending they use Microsoft 365 Copilot.*

+For this Copilot awareness scenario, the recipients of your message are, by default, selected based on their activities. Accordingly, within the Recipients section, your messages' recipient list will, at minimum, include users in your tenant who have Microsoft 365 licenses but have not actively used any Microsoft 365 Copilot features in the past month. You can further restrict the message to be seen only by members of the Microsoft 365 group you specify with the **Filter by Microsoft 365 Group** component.

+ Title: "Microsoft 365 admin center Microsoft 365 Copilot readiness"

+description: "Learn about the Microsoft 365 Copilot readiness report and how it can help you assess your organization's readiness to adopt Copilot."

+# Microsoft 365 reports in the Admin Center ΓÇô Microsoft 365 Copilot readiness

+In the Microsoft 365 Copilot readiness report, which is in continuous enhancement, you can view which users are technically eligible for Copilot, assign licenses, and monitor usage of Microsoft 365 apps that Copilot integrates best with. The report becomes available within 72 hours, and once available, the usage data shown on the report can have up to a maximum of 72 hours latency.

+## How do I get to the Microsoft 365 Copilot report?

+1. Select the **Microsoft 365 Copilot** page.

+## Interpret the Readiness section in the Microsoft 365 Copilot report

+You can use this report to see how ready your organization is to adopt Microsoft 365 Copilot. The Readiness section is set up to show your data over the past 28 days. Currently this portion does not include any other time period options, but we'll be rolling out updates soon to enable 7-day, 30-day, 90-day, and 180-day periods.

+You can also export the report data into an Excel .csv file by selecting the Export link. This exports the Microsoft 365 Copilot readiness data of all users with any engagement on Teams meetings, Teams chat, and Outlook email for Office docs in past 30 days, and enables you to do simple sorting, filtering, and searching for further analysis.

+To make the data in the Microsoft 365 Copilot report anonymous, you must be a global administrator. This will hide identifiable information (using MD5 hashes) such as display name, email, and Microsoft Entra Object ID in report and their export.

+ Title: "Microsoft 365 admin center Microsoft 365 Copilot usage"

+description: "Learn how to get the Microsoft 365 Copilot usage report and gain insights into the Microsoft 365 Copilot activity in your organization."

+# Microsoft 365 reports in the Admin Center ΓÇô Microsoft 365 Copilot usage

+In the Microsoft 365 Copilot usage report, which is in continuous enhancement, you can view a summary of how usersΓÇÖ adoption, retention, and engagement are with Microsoft 365 Copilot, and the activity of every Copilot user in your organization. For Copilot activity on a given day, the report becomes available within 72 hours of the end of that day (in UTC).

+## How do I get to the Microsoft 365 Copilot usage report?

+1. Select the **Microsoft 365 Copilot5** page.

+## Interpret the Microsoft 365 Copilot usage report

+You can use this report to see the usage of Microsoft 365 Copilot in your organization.

+At the top, you can filter by different periods. The Microsoft 365 Copilot report can be viewed over the last 7 days, 30 days, 90 days, or 180 days.

+You can view several numbers for Microsoft 365 Copilot usage, which highlight the enablement number and the adoption of the enablement:

+**Enabled Users** shows the total number of unique users in your organization with Microsoft 365 Copilot licenses over the selected time period.

+**Active Users** shows the total number of enabled users in your organization who tried a user-initiated Microsoft 365 Copilot feature, in one or more apps in Microsoft 365 over the selected time period.

+| | Intelligent Recap | Selecting **Recap** tab in the meeting chat for Teams calendar event after the meeting ends (meeting is recorded and transcribed). | [Get started with Microsoft 365 Copilot in Teams - Microsoft Support](https://support.microsoft.com/office/get-started-with-copilot-for-microsoft-365-in-teams-60c37fde-6e13-4412-8101-40bbbc711ec9) |

+| | Copilot chat | Going to Chat on the left side of Teams, selecting Copilot from the top of your Teams chat list, typing a prompt and sending. | [Get started with Microsoft 365 Copilot in Teams - Microsoft Support](https://support.microsoft.com/office/get-started-with-copilot-for-microsoft-365-in-teams-60c37fde-6e13-4412-8101-40bbbc711ec9) |

+| Word | All Copilot in Word features are automatically included in the Microsoft 365 Copilot usage report. Usage of any Copilot in Word feature counts towards the Active users metric and is indicated in the per-user Last activity date (UTC). | | To learn more about Copilot in Word features, refer to [Welcome to Copilot in Word - Microsoft Support](https://support.microsoft.com/office/welcome-to-copilot-in-word-2135e85f-a467-463b-b2f0-c51a46d625d1). |

+| Excel | All Copilot in Excel features are automatically included in the Microsoft 365 Copilot usage report. Usage of any Copilot in Excel feature counts towards the Active users metric and is indicated in the per-user Last activity date (UTC). | | To learn more about Copilot in Excel features, refer to [Get started with Copilot in Excel - Microsoft Support](https://support.microsoft.com/office/get-started-with-copilot-in-excel-d7110502-0334-4b4f-a175-a73abdfc118a). |

+| PowerPoint | All Copilot in PowerPoint features are automatically included in the Microsoft 365 Copilot usage report. Usage of any Copilot in PowerPoint feature counts towards the Active users metric and is indicated in the per-user Last activity date (UTC). | | To learn more about Copilot in PowerPoint features, refer to [Welcome to Copilot in PowerPoint - Microsoft Support](https://support.microsoft.com/office/welcome-to-copilot-in-powerpoint-57133c75-24c0-4519-8096-d0dadf25fb8d). |

+| OneNote | All Copilot in OneNote features are automatically included in the Microsoft 365 Copilot usage report. Usage of any Copilot in OneNote feature counts towards the Active users metric and is indicated in the per-user Last activity date (UTC). | | To learn more about Copilot in OneNote features, refer to [Welcome to Copilot in OneNote - Microsoft Support](https://support.microsoft.com/office/welcome-to-copilot-in-onenote-34b30802-02ae-4676-a88c-82f8d5e586dd). |

+| Loop | All Copilot in Loop features are automatically included in the Microsoft 365 Copilot usage report. Usage of any Copilot in Loop feature counts towards the Active users metric and is indicated in the per-user Last activity date (UTC). | | To learn more about Copilot in Loop features, refer to [Get started with Microsoft 365 Copilot in Loop - Microsoft Support](https://support.microsoft.com/office/get-started-with-copilot-for-microsoft-365-in-loop-966eb1a2-b5ec-4532-8a9d-f1aaeda7f90e). |

+**Summary view** shows you the total usage of Microsoft 365 Copilot among Microsoft 365 productivity apps of the time frame.

+**Trend view** shows you the daily time trend of Microsoft 365 Copilot among Microsoft 365 productivity apps of the time frame.

+You can view a table list to show each Microsoft 365 Copilot enabled userΓÇÖs last activity date among Microsoft 365 Copilot products.

+You can also export the report data into an Excel .csv file by selecting the Export link. This exports the Microsoft 365 Copilot usage data of all users and enables you to do simple sorting, filtering, and searching for further analysis.

+| Last activity date (UTC (Universal Time Code)) | The latest date the user had activity in Microsoft 365 Copilot among all Microsoft 365 products, including any of the intentional activities, regardless of the selected time period of past 7/30/90/180 days. |

+To make the data in the Microsoft 365 Copilot report anonymous, you must be a global administrator. This will hide identifiable information (using MD5 hashes) such as display name, email, and Microsoft Entra Object ID in report and their export.

+### How is a user considered active in Microsoft 365 Copilot usage?

+To access accurate information on Microsoft 365 Copilot usage, use one of the following reports: the [Microsoft 365 Copilot usage report](microsoft-365-copilot-usage.md) in the Microsoft 365 Admin Center or the [Copilot Dashboard](/viva/insights/org-team-insights/copilot-dashboard) in Viva Insights.

+The user-level table in the report is configured to show all users who were licensed for Microsoft 365 Copilot at any point over the past 180 days, even if the user has since had the license removed or never had any Copilot active usage.

+### I assigned the Microsoft 365 Copilot license to users, but why is 'last activity date' for users empty in rare cases?

+1. The user used Microsoft 365 Copilot within a short time window (less than 24 hours) after the Microsoft 365 Copilot license was assigned.

+2. The user subsequently had no other Microsoft 365 Copilot usage up to the date on which the report is viewed.

+First, it offers a score, on a 100-point scale, to quickly assess how well people in your organization are adopting Microsoft 365 Copilot.

+> - You must be licensed with Microsoft 365 Copilot to use extensions for Microsoft 365 Copilot.

+Microsoft 365 Copilot is a new experience inside Microsoft 365 that combines the power of large language models with your data and apps in Microsoft 365 to capture natural language commands to produce content and analyze data. Extensions for Copilot are extensions that enable Copilot to access and use third-party apps, such as Jira, [Dynamics 365](/microsoft-365-copilot/extensibility/overview-business-applications), or Bing Web Search. Admins can manage extensions for Copilot in the same way as they manage any other app in the Integrated apps section of the Microsoft 365 admin center. This document explains how admins can enable, disable, assign, block, or remove extensions for Copilot for their organization, and about Copilot capabilities and data privacy.

+Extensions enhance the functionality of Copilot by adding search capabilities, custom actions, connectors, and APIs. *Declarative copilots* are custom versions of Microsoft 365 Copilot that combine instructions, knowledge, and skills to perform specific tasks or scenarios.

+For detailed information about how Microsoft 365 Copilot uses, protects, and shares organizational information to power extensibility, see [Data, Privacy, and Security for Microsoft 365 Copilot](/microsoft-365-copilot/microsoft-365-copilot-privacy).

+To start the template app, you have to be either a **report reader**, **Exchange administrator**, **Skype for Business administrator**, or **SharePoint administrator**.

+ **To fix this error:** Provide the credentials of a user who is either an **Exchange admin**, **Skype for Business admin**, **SharePoint admin**, **Global reader**, or **Report reader** to connect to the template app. See [About admin roles](../add-users/about-admin-roles.md) for more information.

+You have to be either an **Exchange admin**, **Skype for Business admin**, **SharePoint admin**, **Global reader**, **Report reader**, **Usage Summary Reports Reader** in order to establish the connection to the template app. See [About admin roles](../add-users/about-admin-roles.md) for more information. **Note:** **Global Reader** and **Usage Summary Reports Reader** only allow access to tenant level aggregates in Microsoft 365 usage analytics and they don't have the permission to view the user activity reports.

+description: "Learn how to secure Microsoft 365 Copilot Business Basic, Microsoft 365 Business Standard, and Microsoft 365 Business Premium."

+# Secure Microsoft 365 Copilot for small businesses

+This article explains the differences in security and compliance controls between Microsoft 365 Copilot in Microsoft 365 Business Basic, Microsoft 365 Business Standard, and Microsoft 365 Business Premium. This article doesn't attempt to describe the full capabilities of Microsoft 365 Copilot, or the full security and compliance features in Business Basic, Business Standard, and Business Premium.

+The following sections contain scenarios to help you better understand how security features in Business Basic, Business Standard, and Business Premium can help protect you when you're using Microsoft 365 Copilot.

+How can companies enable new levels of employee productivity with tools like Microsoft 365 Copilot while safeguarding company data and resources?

+- Use the following capabilities in **Business Basic** or **Business Standard** to make sure that unauthorized employees can't use Microsoft 365 Copilot to gain access to information or confidential data in files that they don't have access to:

+ - Protect against employee misuse of Microsoft 365 Copilot by creating conditions to grant internal access.

+How can companies ensure that sensitive or personal data isn't exposed when using Microsoft 365 Copilot?

+- Use the following capabilities in **Business Basic** or **Business Standard** to make sure that unauthorized employees can't use Microsoft 365 Copilot to gain access to information or confidential data in files that they don't have access to:

+ - Prohibit Microsoft 365 Copilot from including sensitive data that users don't have permissions to view in generated responses.

+- **Business Premium** further extends the protection of sensitive data by requiring sensitivity labels for Microsoft 365 content. These labels help ensure that only employees with specific permissions can use Microsoft 365 Copilot to access, generate, or share sensitive data. Matching sensitivity labels are automatically applied to any content generated by Microsoft 365 Copilot.

+ - Microsoft 365 Copilot automatically inherits and applies sensitivity labels that match any queried material or references.

+How can companies monitor interactions with Microsoft 365 Copilot and support related regulatory compliance or eDiscovery requests?

+ - Monitor, search, and export employee interactions with Microsoft 365 Copilot, and any content generated by Microsoft 365 Copilot.

+ - Define how long content generated by Microsoft 365 Copilot should be retained within Microsoft 365.

+ - Maintain a log of all Microsoft 365 Copilot interactions within the organization.

+- **Business Premium** further extends the support for investigations or other legal processes by asserting a legal hold on material associated with Microsoft 365 Copilot.

+The available security and compliance features related to Microsoft 365 Copilot in Business Basic, Business Standard, and Business Premium is summarized in the following tables:

+ |Sign in to Microsoft 365 Copilot with a single identity|Γ£ö|Γ£ö|Γ£ö|

+6. [Secure Microsoft 365 Copilot](m365bp-secure-copilot.md)

+3. On the billing account details page, select the **Associated billing tenants** tab, then select **Add an associated billing tenant**. In the **Add an associated billing tenant** pane, enter the tenant ID or domain name. The tenant ID must be in lower case. Enter a friendly name for the tenant.

+|Microsoft 365 Copilot | Yes | Yes |

+| Microsoft 365 Copilot | CFQ7TTC0MM8R | No |

+| Microsoft 365 F3 | CFQ7TTC0LH05 | No |

+| Microsoft Purview Discovery | CFQ7TTC0N8SL | Yes |

+| Power Automate RPA* | CFQ7TTC0LSGZ | No |

+| Power BI Premium (standalone)* | CFQ7TTC0H6RP | No |

+| Setting | Impact |

+> Not all VL subscriptions have a 90 day grace period. Some products and services, like PowerBI Premium P plans and some Microsoft 365 Copilot subscriptions bought through VL only have a 30 day grace period.

+- [Microsoft 365 Copilot](m365-dr-workload-copilot.md)

+Data moves are a back-end service operation with minimal impact to a customer's operations. For information related to specific workloads, customer administrators can refer to the ΓÇ£MigrationΓÇ¥ sections in the following Workload Data Residency Capabilities pages: [Exchange Online](m365-dr-workload-exo.md#migration), [SharePoint and OneDrive](m365-dr-workload-spo.md#migration-with-advanced-data-residency), [Microsoft Teams](m365-dr-workload-teams.md#migration), [Microsoft 365 Copilot](m365-dr-workload-copilot.md#migration-and-user-experience), [Microsoft Defender for Office P1](m365-dr-workload-mdo-p1.md#migration), [Office for the Web](m365-dr-workload-office-for-web.md#migration), [Viva Connections](m365-dr-workload-viva-connections.md#migration), [Viva Topics](m365-dr-workload-viva-topics.md#migration), [Microsoft Purview](m365-dr-workload-purview.md#migration), and [Other Services](m365-dr-workload-other.md).

+## Microsoft 365 Copilot

+- Any stored content of interactions with Microsoft 365 Copilot to the extent not included in the preceding commitments.

+|Privacy and Security Product Terms <br/> |Privacy and Security Terms for Microsoft 365 services provides some customer data location related commitments. The document can be found <a href="https://www.microsoft.com/licensing/terms/en-US/product/PrivacyandSecurityTerms/EAEAS" target="_blank">here</a>. The extract of the relevant section (on November 1, 2022) is:<br>**Office 365 Services.** If Customer provisions its _Tenant_ in Australia, Brazil, Canada, the European Union, France, Germany, India, Japan, Norway, Qatar, South Africa, South Korea, Sweden, Switzerland, the United Kingdom, the United Arab Emirates, or the United States, Microsoft stores the following Customer Data at rest only within that Geo: (1) Exchange Online mailbox content (e-mail body, calendar entries, and the content of e-mail attachments), (2) SharePoint site content and the files stored within that site, (3) files uploaded to OneDrive, and (4) Microsoft Teams chat messages (including private messages, channel messages, meeting messages and images used in chats), and for customers using Microsoft Stream (on SharePoint), meeting recordings, and (5) any stored content of interactions with Microsoft 365 Copilot to the extent not included in the preceding commitments.

+You can use the Microsoft 365 admin center to understand where your data for a given service is stored. As a _Tenant_ administrator you can find the actual data location by navigating to **Admin > Settings > Org Settings > Organization Profile > Data Location**. Currently the data location is available for Exchange Online, SharePoint, OneDrive, Microsoft Teams, Microsoft 365 Copilot, Exchange Online Protection, Viva Connections and Viva Topics. In addition to this resource, see the [Data Maps page](o365-data-locations.md).

+1. If a _Tenant_ subscribes to the _Multi-Geo_ service, then _Tenants_ user's data for Exchange Online, SharePoint, OneDrive, Microsoft Teams and Microsoft 365 Copilot can be assigned to _Satellite Geographies_.

+1. Product Terms: Exchange Online, SharePoint, OneDrive, Microsoft Teams and Microsoft 365 Copilot provisioned in Australia, Brazil, Canada, France, Germany, India, Japan, Qatar, South Korea, Norway, South Africa, Sweden, Switzerland, United Arab Emirates, United Kingdom, European Union and the United States have a commitment for customer data residency expressed in the [Product Terms](https://www.microsoft.com/licensing/terms/product/PrivacyandSecurityTerms/all). For more information, see the [Product Terms Data Residency page](m365-dr-product-terms-dr.md).

+1. _Multi Geo_ subscription: allows customers to assign data location for Exchange Online, SharePoint, OneDrive, Microsoft Teams and Microsoft 365 Copilot to any supported _Geography_. For more information, see [Multi Geo Data Residency](microsoft-365-multi-geo.md).

+| Microsoft 365 Copilot |X¹ |X² |X³ |

+| Country/Region | Exchange Online | SharePoint, OneDrive | Teams | Microsoft 365 Copilot | MDO P1 | Office for the web | Viva Connections | Viva Topics | Purview |

+1. Online

+- **Office 365 Services** If Customer provisions its tenant in Australia, Brazil, Canada, the European Union, France, Germany, India, Japan, Norway, Qatar, South Africa, South Korea, Sweden, Switzerland, the United Kingdom, the United Arab Emirates, or the United States, Microsoft stores the following Customer Data at rest only within that Geo: (1) Exchange Online mailbox content (e-mail body, calendar entries, and the content of e-mail attachments), (2) SharePoint site content and the files stored within that site, (3) files uploaded to OneDrive, (4) Microsoft Teams chat messages (including private messages, channel messages, meeting messages and images used in chats), and for customers using Microsoft Stream (on SharePoint), meeting recordings, and (5) any stored content of interactions with Microsoft 365 Copilot to the extent not included in the preceding commitments.

+ Title: Data Residency for Microsoft 365 Copilot

+description: Learn about data residency for Microsoft 365 Copilot.

+# Data Residency for Microsoft 365 Copilot

+Service documentation: [Microsoft 365 Copilot overview](/microsoft-365-copilot/microsoft-365-copilot-overview) and [Data, Privacy, and Security for Microsoft 365 Copilot](/microsoft-365-copilot/microsoft-365-copilot-privacy)

+Capability Summary: Microsoft 365 Copilot is an AI-powered productivity tool that coordinates large language models (LLMs), content in Microsoft Graph, and the Microsoft 365 apps that you use every day, such as Word, Excel, PowerPoint, Outlook, and Teams. This integration provides real-time intelligent assistance, enabling users to enhance their creativity, productivity, and skills.

+The following applications provide the ability to interact with Microsoft 365 Copilot: Microsoft Word, Excel, PowerPoint, Loop, Outlook, Teams (Chat, Meetings, Calls, Whiteboard), and OneNote.

+The content of interactions and the related semantic index with Microsoft 365 Copilot are stored at rest in the relevant _Local Region Geography_.

+## Data Residency Commitments Available for Microsoft 365 Copilot

+1. The Microsoft 365 Copilot subscription customer data is provisioned in _Local Region Geography_.

+Refer to the [ADR Commitment page](m365-dr-commitments.md#microsoft-365-copilot) to understand the specific data at rest commitments for Microsoft 365 Copilot. Examples of the committed data include:

+Multi-Geo capabilities in Microsoft 365 Copilot enable content of interactions with Microsoft 365 Copilot to be stored at rest in a specified _Macro Region Geography_ or _Local Region Geography_ location. Microsoft 365 Copilot uses the Preferred Data Location (PDL) for users and groups to determine where to store data. If the PDL isn't set or is invalid, data is stored in the _Tenant's Primary Provisioned Geography_ location. The _Geography_ where the content of interactions with Microsoft 365 Copilot are stored is determined by the PDL of the user interacting with Microsoft 365 Copilot. This means that the storage of content of interactions for users in different regions will be based on their respective PDL configurations.

+To find the current location of a user's content of interactions with Microsoft 365 Copilot by referencing the PDL configuration for that user. Refer to [Multi-Geo Testing](m365-multi-geo-user-testing.md)

+Two people are working together on a Microsoft Word document. User A authored the document and stored it in the OneDrive for Business personal storage site, which is located in France. User B is in Canada and asks Microsoft 365 Copilot to rewrite a paragraph in the document. The paragraph User B submitted as the prompt, as well as the rewrite options Microsoft 365 Copilot provides (the ΓÇ£content of interactionsΓÇ¥ in this case) are stored in Canada; the original document remains in France, as does any rewrite the user accepts into that document.

+Microsoft Teams meeting recording video location is determined by the user PDL that starts the recording, or when meetings have an automatic recording policy, the location is determined from the first person joining the meeting. When users in other regions interact with Microsoft 365 Copilot in Teams, those user prompts and corresponding responses are stored in the location of the user that asks the Microsoft 365 Copilot questions.

+When a user interacts with Microsoft 365 Copilot (using apps such as Word, PowerPoint, Excel, OneNote, Loop, or Whiteboard), we store data about these interactions. The stored data includes the user's prompt and Copilot's response, including citations to any information used to ground Copilot's response. We refer to the userΓÇÖs prompt and CopilotΓÇÖs response to that prompt as the ΓÇ£content of interactionsΓÇ¥ and the record of those interactions is the userΓÇÖs Copilot interaction history. For example, this stored data provides users with Copilot interaction history in [Microsoft Copilot with Graph-grounded chat](https://support.microsoft.com/topic/get-started-with-copilot-for-microsoft-365-5b00a52d-7296-48ee-b938-b95b7209f737) and [meetings in Microsoft Teams](https://support.microsoft.com/office/get-started-with-copilot-in-microsoft-teams-meetings-0bf9dd3c-96f7-44e2-8bb8-790bedf066b1). This data is processed and stored in alignment with contractual commitments with your organizationΓÇÖs other content in Microsoft 365, such as [Advanced data residency in Microsoft 365](advanced-data-residency.md).

+- Microsoft 365 Copilot [Data Location](m365-dr-workload-copilot.md#how-can-i-determine-customer-data-location)

+#### Limit access to Teams when frontline workers are off shift

+With the working time feature, you can use app protection policies to limit access to Teams for shift workers on BYOD or company-owned dedicated devices. This feature lets you can block access or show a warning message when frontline workers access Teams during nonworking time.

+To learn more, see [Limit access to Teams when frontline workers are off shift](flw-working-time.md).

+ Title: Limit access to Microsoft Teams when frontline workers are off shift

+audience: admin

+search.appverid: MET150

+description: Learn how to set up the working time feature to limit access to Teams when frontline workers are off shift.

+ms.localizationpriority: medium

+ - M365-collaboration

+ - m365-frontline

+appliesto:

+ - Microsoft Teams

+ - Microsoft 365 for frontline workers

+# Limit access to Microsoft Teams when frontline workers are off shift

+> [!NOTE]

+> This feature is currently being rolled out and might not be available in your organization yet. To stay on top of upcoming Teams features, check out the [Microsoft 365 Roadmap](https://www.microsoft.com/microsoft-365/roadmap).

+## Overview

+Working time is a feature that allows admins to limit access to Microsoft Teams for shift workers on Android and iOS mobile devices. These controls are designed for bring-your-own-device (BYOD) or company-owned dedicated device scenarios for frontline workers. [Learn more about frontline device scenarios](flw-devices.md#deployment-models).

+With this feature, you can block access to Teams or show a warning message when frontline workers who are off shift open Teams. Consider enabling working time for your frontline workforce if:

+- YouΓÇÖre concerned about frontline workers asking for pay outside of working hours if they access work apps.

+- Local laws and regulations require you to restrict access to work apps when employees are off shift.

+## How it works

+When a frontline worker clocks in to their shift and opens Teams, the app checks whether the worker is on or off shift.

+- If the worker is on shift, they can access Teams.

+- If the worker is off shift when Teams is open, the worker sees a block or warning screen.

+ - If you configured a block screen, the worker canΓÇÖt access Teams until they clock in to their shift.

+ - If you configured a warning screen, the worker can dismiss it and choose whether to use Teams at their discretion.

+- If a worker is using Teams while clocking out, the worker sees a block or warning screen for the app after they clock out.

+Along with working time, we recommend that you also set up quiet time to automatically mute Teams notifications when workers are off shift.

+## Set up working time

+Follow these steps to enable working time for your frontline.

+### Configure app protection policies for Android and iOS

+Use Microsoft Intune [app protection policies](/mem/intune/apps/app-protection-policies) to configure working time to block or warn access to Teams on Android and iOS devices. For more information about policy settings, see:

+- [Android app protection policy settings - Conditional launch](/mem/intune/apps/app-protection-policy-settings-android#conditional-launch)

+- [iOS app protection policy settings - Conditional launch](/mem/intune/apps/app-protection-policy-settings-ios#conditional-launch)

+### Connect your workforce management system (WFM) to the workingTimeSchedule API

+#### Create an application

+1. Create an application in Microsoft Entra for the [workingTimeSchedule](/graph/api/resources/workingtimeschedule?view=graph-rest-beta) Graph API.

+ When you register your application, make sure you choose the **Accounts in this organizational directory only (Single tenant)** option so that only users in your tenant can use the application. To learn more, see [Register an application with the Microsoft identity platform](/entra/identity-platform/quickstart-register-app).

+1. Add the hidden application permission for calling the Graph API using the required scope, `Schedule-WorkingTime.ReadWrite.All`.

+ 1. Sign in to your application in the Azure portal.

+ 1. Go to the **Manifest** tab. You'll see a JSON that contains the complete definition of your application.

+ 1. At the end of the manifest, add the `requiredResourceAccess` property.

+ This property specifies the set of permissions that your application requires access to. In other words, it contains all the APIs that your application can call. If this property is already present in the manifest, your API has some permissions already granted to it.

+ 1. Inside the `requiredResourceAccess` array, add an object with an ID of `00000003-0000-0000-0000-c000-0000000000000000` to specify permissions of the Graph application.

+ If you already have an object with this same ID inside your `requiredResourceAccess` array, you only need to add the following inside the `resourceAccess` array:

+ - An object with the ID of the new hidden permission, `0b21c159-dbf4-4dbb-a6f6-490e412c716e`.

+ - The type of permission. In this case, `Role`.

+ Here's an example of what the end of the manifest could look like:

+ ```json

+ {

+ ...

+ "preAuthorizedApplications": [],

+ "publisherDomain": "microsoft.onmicrosoft.com",

+ "replyUrlsWithType": [

+ {

+ "url": "https://localhost:44321/signin-oidc",

+ "type": "Web"

+ },

+ {

+ "url": "https://localhost:44321/",

+ "type": "Web"

+ }

+ ],

+ "requiredResourceAccess": [

+ {

+ "resourceAppId": "00000003-0000-0000-c000-000000000000",

+ "resourceAccess": [

+ {

+ "id": "0b21c159-dbf4-4dbb-a6f6-490e412c716e",

+ "type": "Role"

+ }

+ ]

+ }

+ ],

+ "samlMetadataUrl": null,

+ "signInUrl": null,

+ "signInAudience": "AzureADMyOrg",

+ "tags": [],

+ "tokenEncryptionKeyId": null

+ }

+ ```

+ 1. Save the changes.

+#### Grant tenant-wide admin consent to the application's hidden permission

+You must be a tenant administrator to perform this step.

+1. In your browser, go to [https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id={ClientAppId}&

+response_type=code&scope=https://graph.microsoft.com/.default](https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id={ClientAppId}&response_type=code&scope=https://graph.microsoft.com/.default).

+1. In the URL, replace `ClientAppId` with your app ID.

+1. In the consent dialog, choose **Accept** to grant tenant-wide admin consent to the new hidden permission for the application.

+#### Call Graph from the application

+Here's how to call Graph endpoints from the application using example code in C#.

+1. Create a new console project using .NET 6 or .NET 7 SDK.

+1. Install the `Microsoft.Identity.Client` NuGet package.

+1. Open the program.cs file, and copy and paste the following example code to it:

+ ```cs

+ using System.Text;

+ using Microsoft.Identity.Client;

+ var userId = "928bf23a-81e8-47c9-ad54-2c0206248afe";

+ var path = Path.Combine(Path.GetTempPath(),

+ "workingTimeTokenGenerator.txt");

+ string? accessToken;

+ if (!File.Exists(path) || (DateTime.UtcNow - new

+ FileInfo(path).LastWriteTimeUtc).TotalMinutes > 59)

+ {

+ var clientId = "00001111-aaaa-2222-bbbb-3333cccc4444";

+ var clientSecret = "Aa1Bb~2Cc3.-Dd4Ee5Ff6Gg7Hh8Ii9_Jj0Kk1Ll2";

+ var tenantId = "cad3e174-69d3-4707-abd2-f527f45c367a";

+ var scopes = new string[] { "00000003-0000-0000-c000-000000000000/.default" };

+

+ var app = ConfidentialClientApplicationBuilder.Create(clientId)

+ .WithClientSecret(clientSecret)

+ .Build();

+ var result = await app.AcquireTokenForClient(scopes)

+ .WithAuthority(AzureCloudInstance.AzurePublic, tenantId)

+ .ExecuteAsync();

+ accessToken = result.AccessToken;

+ File.WriteAllText(path, accessToken);

+ }

+ else

+ {

+ accessToken = File.ReadAllText(path);

+ }

+ int number;

+ while (true)

+ {

+ Console.WriteLine("Press 1 for startWorkingTime, 2 for endWorkingTime.");

+ var choice = Console.ReadLine();

+ if (!Int32.TryParse(choice, out number) || !new[] { 1, 2}.Contains(number))

+ {

+ Console.WriteLine("Out-of-range election.");

+ continue;

+ }

+ break;

+ }

+ Console.WriteLine("Performing request...");

+ var httpClient = new HttpClient();

+ var message = new HttpRequestMessage

+ {

+ Method = HttpMethod.Post,

+ RequestUri = new

+ Uri($"https://graph.microsoft.com/beta/users/{userId}/solutions/schedule/{(number == 1 ? "startWorkingTime" : "endWorkingTime")}")

+ };

+ message.Headers.Add("Authorization", $"Bearer {accessToken}");

+ message.Content = new StringContent("", Encoding.UTF8,

+ "application/json");

+ var response = await httpClient.SendAsync(message);

+ if (!response.IsSuccessStatusCode)

+ {

+ string? content = null;

+ try

+ {

+ content = await response.Content?.ReadAsStringAsync();

+ }

+ catch

+ {

+ }

+ Console.WriteLine($"Graph returned a non success status code:

+ {response.StatusCode}. Reason phrase: {response.ReasonPhrase}." +

+ (content is null ? "Unable to get the response body." :

+ $"Content: {content}"));

+ }

+ else

+ {

+ Console.WriteLine($"Graph returned a success status code:

+ {response.StatusCode}.");

+ }

+ Console.WriteLine("Press any key to exit.");

+ _ = Console.ReadKey();

+ ```

+1. In the code, change the following:

+ - `tenantId`: Replace with your tenant ID.

+ - `clientId`: Replace with the ID of your application.

+ - `clientSecret`: You must add a client secret in the *authentication* section of your application. You can also choose to use a security certificate and change the code accordingly.

+ - `userId`: Replace with the user to which you want to apply the inWorkingTime or outOfWorkingTime policy.

+## Set up quiet time

+This step is optional but recommended.

+Configure quiet time policies in Intune to automatically mute Teams notifications for frontline workers during nonworking hours. Learn more about how to [create quiet time policies](/mem/intune/apps/apps-quiet-time-policies).

+## Frequently asked questions

+**Do I need to use the Shifts app in Teams to take advantage of this feature?**

+No, this feature relies on the clock in/out signal from your WFM.

+**Can I use working time if I don't have a clock in/out system in place?**

+No, a clock in/out signal is required to use this feature.

+## Related articles

+- [workingTimeSchedule](/graph/api/resources/workingtimeschedule?view=graph-rest-beta)

+We've added Microsoft Copilot opportunities to Sales Advisor to help you identify customers who are eligible to buy Microsoft 365 Copilot. Microsoft Copilot is an AI companion that works everywhere you do and intelligently adapts to your needs.

+|Loop component experiences across Microsoft 365 | Cloud Policy | **Create and view Loop files in Microsoft apps that support Loop** | Applies to: <br/> - Outlook integration<br> - OneNote integration<br> - Whiteboard integration<br> Does **NOT** apply to:<br> - Loop workspaces<br> - Teams integration<br> - Copilot pages |

+|Copilot pages integration | Cloud Policy | **Create and view Loop files in Microsoft 365 Copilot Chat** | Applies to Pages in Copilot Chat |

+|Teams integration | SharePoint property | See [Settings management for Loop components in Teams](#settings-management-for-loop-functionality-in-teams) | Teams only checks the settings in this row. |

+|Enable Loop components everywhere | **Create and view Loop files in Microsoft apps that support Loop** = Enabled (or Not Configured)<br/>**Create and view Loop files in Microsoft 365 Copilot Chat** = Enabled (or Not Configured)<br/>[Teams-only] `Set-SPOTenant -IsLoopEnabled $true`, `Set-SPOTenant -IsCollabMeetingNotesFluidEnabled $true` |

+|Enable Loop components everywhere, but Disable integration in Communication app (Outlook, Teams) | **Create and view Loop files in Microsoft apps that support Loop** = Enabled (or Not Configured)<br/>**Create and view Loop files in Microsoft 365 Copilot Chat** = Enabled (or Not Configured)<br/>**Create and view Loop files in Outlook** = Disabled<br/>[Teams-only] `Set-SPOTenant -IsLoopEnabled $false`, `Set-SPOTenant -IsCollabMeetingNotesFluidEnabled $false` |

+|Disable Loop components everywhere | **Create and view Loop files in Microsoft apps that support Loop** = Disabled<br/>**Create and view Loop files in Microsoft 365 Copilot Chat** = Disabled<br/>[Teams-only] `Set-SPOTenant -IsLoopEnabled $false`, `Set-SPOTenant -IsCollabMeetingNotesFluidEnabled $false` |

+- **Create and view Loop files in Microsoft 365 Copilot Chat**

+ - For **Create and view Loop files in Microsoft 365 Copilot Chat**

+ - **Enabled**: Copilot pages experience is available to the users.

+ - **Disabled**: Copilot pages experience isn't available to the users.

+ - **Not configured**: Copilot pages experience is available to the users.

+- Available on Whiteboard apps on Windows, Surface, iOS, Android, and web. iOS and Android are "view and edit," but users can't paste new ones.

+The .loop files appear on Office.com and OneDrive, such as in the Recent and Recommended areas. They also appear in the Loop app. Users can search for content in .loop files from Loop, Office.com, and OneDrive. The .loop files can be restored to previous versions from OneDrive. To create Loop components, chat or email creators must have a OneDrive account. Without a valid OneDrive account, chat or email creators might still be able to collaborate on a component created by other users who have a valid OneDrive account, but can't create their own Loop components.

+- When you click on the hyperlink or browse to a .loop file in OneDrive and click it to open, it opens in a separate browser tab in the Loop component viewer and editor. You'll still be able to edit the file if you have edit permissions.

+- External recipients of emails aren't able to view or collaborate on a Loop component unless your organization has enabled sharing with the recipients of that email.

+## Related articles

+- [Teams Assignments LTI](#teams-assignments-lti)

+## Teams Assignments LTI

+The Microsoft Teams Assignments LTI brings the Learning Accelerators: Reading Progress, Math Progress. Search Progress and Speaker Progress along with Microsoft Forms, Whiteboard, OneNote Pages, and all of the new generative AI features of Teams Assignments to your LTI v1.3 Advantage compliant LMS.

+The integration allows you to Connect Class Teams and add Teams Assignments right into your LMS assignments list where students can launch and complete them and sync grades and feedback automatically back to the LMS.

+- [Microsoft Assignments integration with Canvas](teams-assignments-with-canvas.md).

+- [Microsoft Assignments integration with Schoology Learning](teams-assignments-with-schoology.md).

+More LMS support coming soon! Please sign up for more information on current and future LMS integration previews at http://aka.ms/LMSPreview

+## Teams Meetings LTI

+## Teams Classes LTI

+# Use Microsoft Teams Assignments LTI® app with Canvas

+By installing and using the Assignments integration, educators and students can transmit grades to the LMS where the terms of use and privacy policy of that application apply.

+### Option 1: Deployment to all courses in a Canvas Sub-Account with option for left nav placement visible or hidden by default in course menus

+1. Select the **Admin** link in the global navigation, and then select the Sub-Account to which you wish to deploy the app.

+1. In the apps list, search for **Microsoft Teams Assignments**, and click the **Show All Keys** button to see additional pages of results in the view.

+1. Enable the inherited dev key for the **Microsoft Teams Assignments** app in the list. There will be two versions of the Microsoft Teams Assignments app listed:

+ - To deploy the app visible in the Course Navigation for all courses by default, enable the **"Microsoft Teams Assignments"** app with ID **170000000001876**

+ - To deploy the app with the Course Navigation placement hidden by default, enable the **"Microsoft Teams Assignments (Course Nav Disabled)"** app with ID **170000000001877**

+1. Toggle the **State** switch to **On** for the app version you wish to deploy.

+1. Copy the ID you've enabled to the clipboard: You will need this app ID in step 12 below (or Option 2 step 4).

+1. In the **Client ID** textbox, enter the app ID you enabled in step 6 above and then Click **Submit**

+If you choose not to install the app for all courses in an Sub-Account as described in steps 9 to 13, then you or each course teacher must install the app for individual courses.

+1. In the **Client ID** textbox, enter the app ID you enabled in step 6 above (**170000000001876** or **170000000001877**), and then select **Submit**.

+- Cookies should be allowed for Microsoft Assignments app.

+- Popups shouldn't be blocked for Microsoft Assignments app.

+- Educators and Learners can contact support, or give feedback directly from the app through the help and feedback menu.

+

+- On their first access of any Teams Assignments flow, users must sign in using their Microsoft 365 account.

+## Recommended browser settings

+- Cookies should be allowed for Microsoft Assignments app.

+- Popups shouldn't be blocked for Microsoft Assignments app.

+> [!NOTE]

+>

+> - Cookies aren't allowed by default in the Chrome browser incognito mode and will need to be allowed.

+> - The Microsoft Assignments LTI app also works in the InPrivate mode in Microsoft Edge browser. Ensure that you haven't blocked cookies, which are allowed by default.

+## Getting help for admins and educators

+- Canvas and Microsoft 365 admins can contact Microsoft [Education Support](https://aka.ms/edusupport) to help resolve configuration and deployment issues, for themselves or on behalf of users.

+- Admins can learn about [other Microsoft 365 and Teams LMS integrations](https://aka.ms/LTIAdminDocs) available.

+- Educators can take the [Teams Assignments LTI Microsoft Learn course](https://aka.ms/AssignmentsLTICourse) to learn to use the integration and get more help on Microsoft Teams Assignments.

+- Educators and Learners can contact support, or give feedback directly from the app through the help and feedback menu

+

+ Title: "Understand app assignments using Microsoft Intune"

+audience: ITPro

+description: Understand app assignments using Microsoft Intune.

+ms.localizationpriority: high

+- highpri

+keywords:

+# Understand app assignments using Intune

+When you set an application's assignment, you're setting whether the app will be **Required**, **Available for enrolled devices**, **Available with or without enrollment**, or **Uninstalled**. Each of these options has additional suboptions, such as availability, installation deadline, and restart grace period.

+> [!NOTE]

+> App assignment options are dependent on the app platform (the platform of the device where the app will be installed). Not all app types support all assignment intents.

+| Assignment | Description |

+|||

+| Required | The app is installed on devices for the selected groups. Some platforms may have additional prompts for the end user to acknowledge before app installation begins. |

+| Available for enrolled devices | Assign the app to groups of users whose devices are enrolled with Intune. The users can install the app from the Company Portal app or website. |

+| Available with or without enrollment | Assign this app to groups of users whose devices aren't enrolled with Intune. Users must be assigned an Intune license. |

+| Uninstall | The app is uninstalled from devices in the selected groups if Intune has previously installed the application onto the device via an **Available for enrolled devices** or **Required** assignment using the same deployment. |

+> [!NOTE]

+> You can assign apps based on your intent. For example, if your intent is to have the app available for a group to install, you can assign the app as **Available for enrolled devices** or **Available with or without enrollment**. If you must have the app installed for users, groups, or devices, such as Microsoft Outlook or the Company Portal, you can set the app assignment to be **Required**.

+## Include or exclude assignments

+To set the availability of an app, you include and exclude app assignments to a group of users or devices by using a combination of include and exclude group assignments. This capability can be useful when you make the app available by including a large group, and then narrow the selected users by excluding a smaller group. The smaller group might be a test group or an executive group.

+Important scenarios exist when including or excluding app assignments:

+- Exclusion takes precedence over inclusion in the following same group type scenarios:

+ - Including user groups and excluding user groups when assigning apps

+ - Including device groups and excluding device group when assigning apps

+ For example, if you assign a device group to the **All corporate users** user group, but exclude members in the **Senior Management Staff** user group, **All corporate users** except the **Senior Management staff** get the assignment, because both groups are user groups.

+- Intune doesn't evaluate user-to-device group relationships. If you assign apps to mixed groups, the results may not be what you want or expect.

+ For example, if you assign a device group to the **All Users** user group, but exclude an **All personal devices** device group, **All users** get the app. The exclusion doesn't apply. As a result, it's not recommended to assign apps to mixed groups.

+When assigning groups, groups that have already been assigned or selected are disabled. To select a disabled group, you can remove it from the app's assigned list.

+## User versus device context

+When an app is assigned as **Available for enrolled devices**, it's deployed in device context. Device content is where the managed app is installed directly to the device by Intune.

+When an app is deployed in user context, the managed app is installed for that user on the device where you've selected the **Available with or without enrollment** assignment type. The user's context is recognized by the user's identity using Microsoft Entra ID. The user context is used to recognize how the app is managed, as opposed to device context. App installation on the user's device happens when the user signs in to the device.

+> [!NOTE]

+> The device context assignment is higher priority than a user context assignment.

+As a best practice, create and assign apps specifically for your user groups. Make sure to separate your user groups from device groups.

+Intune provides precreated **All Users** and **All Devices** groups when creating policies in the Microsoft Intune admin center. The groups have built-in optimizations for your convenience. It's highly recommended that you use these groups to target all users and all devices instead of any "all users" or "all devices" groups that you might create yourself.

+## End user app process

+End users at your organization use the Company Portal to view and manage apps that you've assigned from Intune. End users must first sign in to the Company Portal. Then, they can find and install the apps that they need. End users can also use the Company Portal to view the managed apps that they have installed on their device, check the device status, and uninstall apps.

+When you assign a managed app from Intune, you select whether you want the app **Available** or **Required**. Available apps are selected by you or your organization, and are appropriate and useful for work or school. These apps are optional to install, and are the only apps you find in the Company Portal to install. Required apps are necessary for members of your organization to accomplish their work or tasks at your organization. These apps are automatically installed for end users without intervention.

+Apps are made available to end users based on their device type. For example, if your end users are using the Company Portal website on a Windows device, you have access to Windows apps, but not iOS apps.

+End users can also use the Company Portal to view their device compliance status. Device compliance is listed with a status of **Can access company resources**, **Checking access**, or **Can't access company resources**.

+> [!NOTE]

+> End users can request an app for work or school. For more information about how end users request apps, see [Request an app for work or school](/mem/intune/user-help/install-apps-cpapp-windows#request-an-app-for-work-or-school).

+ Title: "Understand app deployment using Microsoft Intune"

+audience: ITPro

+description: Understand app deployment using Microsoft Intune.

+ms.localizationpriority: high

+- highpri

+keywords:

+# Understand app deployment using Intune

+After you add an app to Intune, you can use Intune to assign the managed app to groups of users or devices. To deploy a managed app, you start by targeting a group. Microsoft Entra ID is used, and can help determine any type of conditional access. Then, the request is passed through authentication and authorization before reaching the location where the app will be installed from, such as the Apple App Store. Next, the app is installed on the end user's device based on any app configuration policies that have been created for the app and deployed to the user or device.

+> [!TIP]

+> To see where app protection and compliance policies fit into the overall Intune architecture, see [High-level architecture for Microsoft Intune](/mem/intune/fundamentals/high-level-architecture).

+This architecture diagram includes application management details available in Microsoft Intune.

+## Platform specific app settings

+App capabilities provided by Microsoft Intune differ depending on the device platform that the setting applies to. However, there are some app commonalities that all platforms offer. The following table provides details about app settings that are important for you to be aware of.

+| Platform | App setting details |

+|||

+| All platforms | To receive app updates on devices that aren't enrolled with Intune, device users must go to their organization's Company Portal and manually install app updates. |

+| All platforms | For almost all app types and platforms, Available assignments are only valid when assigning to user groups, not device groups. Win32 apps can be assigned to either user or device groups. |

+| All platforms | The app is only displayed as available if the user logged into the Company Portal is the primary user who enrolled the device and the app is applicable to the device. |

+| Android | Apps deployed as Required to corporate-owned work profile and corporate-owned fully managed devices can't be uninstalled manually by the user. |

+| Android | For unenrolled Android devices, you can use managed Google Play to deploy store apps and line-of-business (LOB) apps to users. Once deployed, you can use Mobile Application Management (MAM) to manage the applications. Managed Google Play apps targeted as Available with or without enrollment will appear in the Play Store app on the end user's device, and not in the Company Portal app. |

+| Android | If you deploy an Android app as Available with or without enrollment, reporting status will only be available on enrolled devices. |

+| Android Enterprise | For Android Enterprise personally owned work profile, when managed Google Play pre-production track apps are assigned as required, create two identical user groups and assign the pre-production track as "available" to one and "required" to the other. The result is that the pre-production track successfully deploys to the device. |

+| iOS | For managed iOS store apps only, when you add these apps to Microsoft Intune and assign them as Required, the apps are automatically created with both Required and Available intents. |

+| iOS | iOS Store apps (not iOS/iPadOS VPP apps) that are targeted with required intent will be enforced on the device at the time of the device check-in and will also show in the Company Portal app. |

+| iOS | When conflicts occur in Uninstall on device removal setting, the app isn't removed from the device when the device is no longer managed. |

+| iOS/iPadOS | assign iOS/iPadOS and Android apps (line-of-business and store-purchased apps) to devices that aren't enrolled with Intune. |

+| iOS/iPadOS | o configure what happens to managed apps when devices are no longer managed, you can select the intended setting under Uninstall on device removal. |

+| iOS/iPadOS | If you have created an iOS/iPadOS VPN profile that contains per-app VPN settings, you can select the VPN profile under VPN. When the app is run, the VPN connection is opened. |

+| iOS/iPadOS | To configure whether a required iOS/iPadOS app is installed as a removable app by end users, you can select the setting under Install as removable. |

+| iOS/iPadOS | You can prevent the iCloud backup of the managed iOS/iPadOS app. |

+| macOS | You can prevent the iCloud backup of the managed macOS app. |

+ Title: "Understand app management using Microsoft Intune"

+audience: ITPro

+description: Understand app management using Microsoft Intune.

+ms.localizationpriority: high

+- highpri

+keywords:

+# Understand app management using Intune

+Before you configure, protect, or assign apps to be managed by Intune, you first need to determine your management deployment model. Intune supports mobile device management (MDM), mobile application management (MAM), and both MDM + MAM. Devices that are enrolled with Intune use MDM. MDM enables organizations to protect and secure their resources and data on enrolled devices. Apps that are managed (MAM) on their own without device management (MDM), can be configured and protected using Intune. MAM enables you to manage and protect your organization's data within the managed apps application you deploy using Intune.

+## App management using managed devices

+Devices enrolled with Intune (or another Mobile Device Management service) are managed devices. Using Intune, if you assign an app to a managed device, you have full assignment capabilities, including assigning apps to the user and the device. You can assign protected apps to the user and device. You can also assign apps based on intent. For example, if your intent is to have the app available for the user to install, you can assign the app as **Available**. If you must have the app installed on the user device, such as Microsoft Outlook or the Company Portal, you can select the app assignment to be **Required**. Additionally, on managed devices, you can uninstall apps and receive app updates from Intune. Also, end users can install available apps from the Company Portal app on their device or from the web-based Company Portal.

+> [!NOTE]

+> Mobile Device Management (MDM) is where users enroll their devices in Intune. MDM enables organizations to protect and secure their resources and data on enrolled devices. After a device is enrolled, it is a managed device and can receive your organization's policies, rules, and settings. For example, you can install specific apps, create a password policy, install a VPN connection, and more.

+## App management using unmanaged devices

+Devices that aren't enrolled in a Mobile Device Management service such as Intune, have different app management capabilities. Using Intune, managed apps that are installed on an unmanaged device use the user's identity (Microsoft Entra ID) to help manage the apps. You can assign an app to a user based on their identity, but you can't assign the app specifically to the user's device when the devices isn't managed. You can assign apps with the **Available** intent. However, you can't assign apps as **Required**. Additionally, apps that are managed using the user's identity can't be uninstalled using Intune, or receive app updates from Intune. Also, end users can't use the Company portal app on their devices to install apps. Instead, end users must install available apps from the web-based Company Portal.

+> [!NOTE]

+> Apps that are managed without device management using MAM, can be configured and protected using Intune. MAM enables you to manage and protect your organization's data within an application. MAM without MDM is popular for organizations that enable members of their organization to work remotely on their own devices (BYOD).

+ Title: "Assign and deploy apps using Microsoft Intune"

+audience: ITPro

+description: Assign and deploy apps using Microsoft Intune.

+ms.localizationpriority: high

+- highpri

+keywords:

+# Assign and deploy apps using Microsoft Intune

+Once you've [set up and deployed the capabilities of Intune](/microsoft-365/solutions/apps-guide-overview#deploying-intune), [added apps to Intune](/microsoft-365/solutions/apps-add-overview), [configured app policies using Intune](/microsoft-365/solutions/apps-config-overview), and [secured and protected your apps using Intune](/microsoft-365/solutions/apps-protect-overview), you can begin the process to assign and deploy apps to end user's devices using Intune.

+Managed apps use configuration and protection policies. You assign these managed apps to users and devices via a unified endpoint management provider, such as Intune. In addition, you create app configuration policies and app protection policies in Intune and assign them to users and devices at your organization. These policies and apps work together to configure and protect your organization's data.

+The Microsoft Intune service supports two Mobile Application Management (MAM) configurations. The first MAM configuration is MAM without device management, where the device is often the user's personal device. When MAM is used with personal devices, only organization-related access and data are managed. This configuration allows your organization's apps to be managed by Intune, but doesn't enroll the devices to be managed by Intune. The second MAM configuration is MAM with device management. This configuration allows both your organization's apps and devices to be managed. MDM, in addition to MAM, makes sure that the device is protected. For more information, see [Mobile Application Management configurations](/microsoft-365/solutions/apps-guide-overview#mobile-application-management-configurations).

+> [!IMPORTANT]

+> MAM in Intune is designed to protect organization data at the application level, including custom apps and store apps. App management can be used on organization-owned devices and personal devices.

+The content provided in this solution helps you understand the different aspects of assigning and deploying apps for each of the supported platforms (Android/Android Enterprise, iOS/iPadOS, macOS, and Windows 10/11). You'll understand app management for both managed and unmanaged devices, app assignments and capabilities based on platform, and the steps you should consider when assigning apps.

+> [!NOTE]

+> If you are new to Microsoft Intune and need to understand how to move your organization to Intune, see [Migration guide: Set up or move to Microsoft Intune](/mem/intune/fundamentals/deployment-guide-intune-setup).

+## Benefits of assigning and deploying apps

+Intune offers several advantages when assigning and deploying apps to your organization. The following list provides the benefits:

+- [App-level data protection](#app-level-data-protection)

+- [Multiple platform support](#multiple-platform-support)

+- [Automated app updates](#automated-app-updates)

+- [App versatility](#app-versatility)

+### App-level data protection

+By assigning and deploying apps from Intune, you can protect your organization's data at the app-level. Intune applies this protection using app protection policies. By implementing app-level policies, you can restrict access to company resources and keep data within the purview or scope of your IT department. You can use Intune app protection policies independently of any mobile-device management (MDM) solution. This independence helps you protect your company's data with or without enrolling devices in a device management solution. In addition, organizations can protect their data using Intune app management with and without Mobile Device Management (MDM) at the same time. For example, consider an end-user (employee or organization member) that uses both a phone issued by the company, and their own personal tablet. The organization issued phone is enrolled in MDM and protected by app protection policies, while the personal device is protected by app protection policies only.

+You can also protect data at the app-level using selective wipe. When a device is lost or stolen, or if the employee leaves your organization, you want to make sure company app data is removed from the device. However, you might not want to remove personal data on the device, especially if the device is an employee-owned device. To selectively remove company app data, you can create a wipe request for a selected user.

+> [!NOTE]

+> Managed apps are enhanced by being integrated to support the [Intune App SDK](/mem/intune/developer/app-sdk) or wrapped using the [Intune App Wrapping Tool](/mem/intune/developer/apps-prepare-mobile-application-management). This integration allows managed apps to support Microsoft Intune's app protection policies and app configuration policies. For a list of apps that support both app configuration and app protection policies, see [Microsoft Intune protected apps](/mem/intune/apps/apps-supported-intune-apps).

+### Multiple platform support

+There are four platforms where you can assign and deploy apps that you've added to Intune. In addition, you can monitor app assignments to ensure end users at your organization successfully have the apps they need to accomplish their work.

+You can assign and deploy apps based on the following available platforms:

+- Android/Android Enterprise

+- iOS/iPadOS

+- macOS

+- Windows 10/11

+Each platform offers different app management capabilities. For a more information about supported platforms, see [App management capabilities by platform](/mem/intune/apps/app-management#app-management-capabilities-by-platform).

+### Automated app updates

+Many app types that are used in Intune support automatic updates. These apps ensure that members of your organization are using the latest and most secure versions of their apps. By using Intune, you can select apps from the related app platform store, such as the Apple App store, the Google Play store, and the Microsoft store. Intune supports automated app updates for built-in apps that include curated apps, such as Microsoft 365 apps and third-party apps for iOS/iPadOS and Android devices. Also, Intune supports automated app updates for web apps.

+> [!IMPORTANT]

+> An app written in-house or as a custom app must be updated manually.

+### App versatility

+Intune supports a variety app types and app functionality. For example, Intune supports store apps by platform. Intune integrates with Apple apps store, the Google Play store, and the Microsoft store to seemlessly allow you to find apps in the store and add them to Intune before assigning them to members of your organization. Also, Intune supports [Windows apps (Win32)](/mem/intune/apps/apps-win32-add) along with [Win32 app supersedence](/mem/intune/apps/apps-win32-supersedence), [Enterprise App Catalog apps (Win32)](/mem/intune/apps/apps-add-enterprise-app), [cross platform web apps](/mem/intune/apps/web-app), and many store apps that integrate with Microsoft technologies. For a list of app types, see [Specific app type details](/mem/intune/apps/apps-add#specific-app-type-details). In addition, Intune supports creating and assigning configuration policies that help to ensure an app is installed on end users' devices based on your organization's requirements. The same is true when applying app protection policies to your organization's users and devices. To better understand app types, purchases, and licenses, see [Purchase and add apps for Microsoft Intune](/microsoft-365/solutions/apps-guide-overview).

+> [!IMPORTANT]

+> You can use Intune to help enforce a [Zero Trust](/security/zero-trust/zero-trust-overview) security strategy for your organization. Zero Trust is an approach to use when designing and implementing a set of security principles. For more information, see [Zero Trust with Microsoft Intune](/mem/intune/fundamentals/zero-trust-with-microsoft-intune) and [Zero Trust identity and device access configurations](/microsoft-365/security/office-365-security/zero-trust-identity-device-access-policies-overview).

+## Prerequisites

+Before you can assign apps using Microsoft Intune, you must follow a few prerequisites to set up Intune, as well as understand key app management concepts.

+> [!NOTE]

+> If you're new to Intune, start with the [Microsoft Intune free trial](/mem/intune/fundamentals/free-trial-sign-up). Trying out Intune is free for 30 days. When you complete the sign-up process, you'll have a new tenant that you can use to evaluate Intune. A tenant is a dedicated instance of [Microsoft Entra ID](/azure/active-directory/fundamentals/active-directory-whatis) (Microsoft Entra ID) where your subscription to Intune is hosted. You can then configure the tenant, which involves many capabilities that you can use to protect your organization. One of those involves adding and configuring apps for Intune.

+Follow these steps if you haven't already set up Intune and added the apps you need to manage and protect:

+1. [Set up and deploy Intune](/microsoft-365/solutions/apps-guide-overview#deploying-intune&preserve-view=true)

+2. [Purchase and add apps for Microsoft Intune](/microsoft-365/solutions/apps-guide-overview)

+3. [Configure apps using Microsoft Intune](/microsoft-365/solutions/apps-config-overview)

+4. [Secure and protect apps using Microsoft Intune](/microsoft-365/solutions/apps-protect-overview)

+> [!IMPORTANT]

+> To use Microsoft Intune beyond the free trial, you'll need to acquire a license from Microsoft. For more information about licenses that include Microsoft Intune, see [Microsoft Intune licensing](/mem/intune/fundamentals/licenses).

+>

+> Although many apps that you can deploy to the members of your organization are free, some apps may require either a license, subscription, or account for each user to use the app. For more information about app licenses, see [Understand app licenses used in Intune](/microsoft-365/solutions/apps-license-overview).

+## What's in this solution

+This solution helps you understand the concepts related to assigning apps using Microsoft Intune. In addition, this solution provides recommended steps to follow when assigning apps to devices and members of your organization. Once you've completed the above [prerequisites](#prerequisites), you're ready to assign apps to your organization using Intune. In addition, using configuration and protection policies as part of your app management efforts allows members of your organization to safely use apps. By managing apps at your organization, you help to protect and secure your organizationΓÇÖs data.

+To learn about app deploying using Intune, see the following articles:

+- [Understand app management](apps-assign-management.md)

+- [Understand app assignments](apps-assign-assignments.md)

+- [Understand app deployment](apps-assign-deployment.md)

+To follow the recommended steps when assigning managed apps to your organization using Intune, see the following articles:

+- [Step 1. Confirm users and devices](apps-assign-step-1.md)

+- [Step 2. Assign apps to groups](apps-assign-step-2.md)

+- [Step 3. Verify app assignments](apps-assign-step-3.md)

+- [Step 4. Troubleshoot app deployment issues ](apps-assign-step-4.md)

+[:::image type="content" source="../medi)

+After you've completed the above steps, you're ready to manage and monitor the managed apps your organization uses.

+ Title: "Step 1. Confirm users, devices, and groups"

+audience: ITPro

+description: Step 1. Confirm users, devices, and groups.

+ms.localizationpriority: high

+- highpri

+keywords:

+# Step 1. Confirm users, devices, and groups

+Before you assign apps to users, groups, or devices at your organization, confirm the list of users and devices at your organization, as well as the groups of users and devices, that you have already set up in your Intune tenant. You can use this list to create groups and assign apps.

+The way you assign an app depends on whether you are [managing only the enrolled devices](apps-assign-management.md#app-management-using-managed-devices) (MDM), [managing only apps](apps-assign-management.md#app-management-using-unmanaged-devices) (MAM), or managing both the devices and apps (MAM+MDM). For more information about these configurations, see [Mobile Application Management configurations](apps-guide-overview.md#mobile-application-management-configurations).

+If you are managing devices at your organiztion (MDM) using Intune, you can assign a managed app to the managed devices using either the **Available for enrolled devices** app assignment or the **Required** app assignment. If you are managing only apps (MAM) without enrolling devices, or need to assign apps to members of your organization that have both managed devices (enrolled) and unmanaged devices (not enrolled), you can assign a managed app to the user using the **Available with or without enrollment** assignment.

+You can view a list of end users that have been added to Microsoft Intune by selecting the **User** workload in Intune portal.

+> [!NOTE]

+> A workload is a main area of a service. When you sign in to Intune, you see these workloads in the left navigation pane. For example, **Devices**, **Apps**, **Users**, and **Groups** are all workloads.

+These users are members of your organization that have devices and/or apps associated with your Intune tenant. Users are stored in Microsoft Entra ID. Microsoft Entra ID controls access to resources and authenticates users. For example, a Microsoft Entra user can do such things are seamless sign-on to your on-premises and cloud resources, which include your Intune tenant. Also, you can apply conditional access for Microsoft Entra user. For more information about Microsoft Entra, see [What is Microsoft Entra ID](/entra/fundamentals/whatis) and [Microsoft Entra ID](/entra/identity).

+> [!NOTE]

+> You can also give individual users [additional permissions](/mem/intune/fundamentals/users-add#grant-admin-permissions) to access Intune. As a best practice, we recommend that only a few people in your organization are assigned the Global administrator role to help prevent unauthorized access.

+Groups of users and devices are displayed and managed by selecting the **Groups** workload. The **Groups** workload displays details about the Microsoft Entra groups included in Intune. As an Intune admin, you use groups to manage users and devices.

+The devices you have enrolled in Intune are displayed and managed in the **Devices** workload. This section of Intune allows you to quickly see the number of devices that are managed for each platform. Selecting a platform allows you to see additional details. Also, you can check whether you have any profiles with errors or conflicts, see a count of noncompliant devices for your tenant, and see if there are any Windows device with update errors or conflicts.

+If you haven't already added users to your Intune tenant, you can add them using several different methods within your Intune tenant.

+## Add users to Intune

+As part of setting up Intune, you may have already added users to your Intune tenant. If not, you can add either mulitple users or single users. Adding a user to Intune creates a new Microsoft Entra ID account.

+- [Add multiple users to Intune](#add-multiple-users-to-intune)

+- [Add a single users to Intune](#add-single-users-to-intune)

+> [!NOTE]

+> After adding a user to Intune, you should also assign an Intune licence to the user. For more information, see [Assign Intune licenses to multiple users](/mem/intune/fundamentals/quickstart-create-user#assign-intune-licenses-to-multiple-users) and [Assign a license to an individual user](/mem/intune/fundamentals/quickstart-create-user#assign-a-license-to-an-individual-user).

+### Add multiple users to Intune

+The most efficient way to add users is in bulk in the Intune admin center. Adding users to your Intune tenant involves creating and uploading a *.csv* file containing the full list of members for your organization. For more information about downloading the *.csv* file, understanding the fields within the *.csv* file, and uploading the *.csv* file, see [Add multiple Intune users in the Microsoft Intune admin center](/intune/fundamentals/users-add#add-multiple-intune-users-in-the-microsoft-intune-admin-center).

+Other ways to add users to your tenant include the following methods:

+- [Add multiple users from your on-premises Active Directory](/mem/intune/fundamentals/users-add#sync-active-directory-and-add-users-to-intune).

+- [Invite multiple Microsoft Entra B2B users](/entra/external-id/tutorial-bulk-invite).

+### Add single users to Intune

+If you need to add individual users to your Intune tenant, you can create a new user. For more information, see [Add individual Intune users in the Microsoft Intune admin center](/mem/intune/fundamentals/users-add#add-individual-intune-users-in-the-microsoft-intune-admin-center).

+## Enroll devices with Intune

+To assign apps to devices managed by Intune, the device must be enrolled with Intune. For more information about device enrollment, see [Enrollment guide: Microsoft Intune enrollment](/mem/intune/fundamentals/deployment-guide-enrollment).

+## Create groups for Intune

+As part of setting up Intune, you may have created groups for your Intune tenant. By using groups within Intune, you can quickly assign apps to the right members of your organization. Additionally, you can exclude specific members of your organization from recieving an app assignment.

+When you create a new group in Intune, you can choose to create a **Security** group or a **Microsoft 365** group. For members of your organization, it is recommended that you create **Security** groups to provide group members access to applications, resources, and assign licenses. Group members can be users, devices, service principals, and other groups. The other group option is a **Microsoft 365** group. **Microsoft 365** groups provide collaboration opportunities when writing documents, creating spreadsheets, working on project plans, scheduling meetings, or sending email. This type of group can include people outside your organization.

+You can set the **Mebership type** for your group of users to be either as **Assigned**, **Dynamic User**, or **Dynamic Device**. **Assigned** users and devices must be manually added and removed from a static group. Groups where the **Membership type** is **Dynamic User** or **Dynamic Device** automatically add users or devices to user groups or device groups based on an expression you create.

+If you haven't created any Intune groups, create them now. For more information, see [Add groups to organize users and devices](/mem/intune/fundamentals/groups-add).

+## Next step

+[:::image type="content" source="../medi)

+Continue with [Step 2](apps-assign-step-2.md) to assign apps to groups using Microsoft Intune.

+ Title: "Step 2. Assign apps to groups"

+audience: ITPro

+description: Step 2. Assign apps to groups.

+ms.localizationpriority: high

+- highpri

+keywords:

+# Step 2. Assign apps to users, groups, and devices

+Working with managed apps in Intune involves several steps. You should complete the following steps before assigning apps to members of your organization:

+- [Acquire the apps your organization needs](/microsoft-365/solutions/apps-purchase-overview) based on [platform](/microsoft-365/solutions/apps-purchase-store#add-store-apps-based-on-platform)

+- [Add the apps to Intune](/microsoft-365/solutions/apps-add-overview)

+- [Create and assigned an app configuration policy](/microsoft-365/solutions/apps-config-overview) for each app

+- [Create and assigned an app protection policy](/microsoft-365/solutions/apps-protect-overview) for each app

+You may find it easiest to group the apps you want to assign based on the platforms your organization supports. For instance, if you're organization support iOS devices, you should focus on assigning each of your iOS apps before assigning apps for another platform, such as Android. Also, you may find it helpful to follow an app policy naming convention, so you can clearly track your app policies.

+> [!NOTE]

+> If you need to know [core and advanced app settings](/mem/intune/apps/apps-supported-intune-apps#core-app-settings) for Microsoft apps that have been designed to support Intune, see the [Microsoft apps](/mem/intune/apps/apps-supported-intune-apps) list. For a list of other apps that support Intune, see [Partner productivity apps](/mem/intune/apps/apps-supported-intune-apps#core-app-settings).

+## Specific apps to assign

+If you've already purchased and added an app to Intune, you may still need to assign it to your members of your organization. When you add an app to Intune, you can immediately set the app assignment. However, you can add an app without assigning it to members of your organization, where you may want to create app configuration, protection, and conditional access policies related to the app.

+There are specific apps that you'll want to require on a user's device, such as the Company Portal, Microsoft Outlook, Microsoft Edge, Microsoft Teams, and Microsoft 365 apps.

+> [!NOTE]

+> If the user modifies a required app, such as deleting it, Intune will automatically reinstall the app. For more information about required apps, see [Installing, updating, or removing required apps](/mem/intune/apps/apps-add#installing-updating-or-removing-required-apps).

+### Company Portal

+If your organization is managing apps with Intune, you need to use the Company Portal. End users at your organization use the Company Portal to securely access company data and do common tasks. End users can access these tasks and information using either the Company Portal app, Company Portal website, or Intune app. The Company Portal supports iOS/iPadOS, Linux, macOS, and Windows devices. The Intune app supports Android devices.

+Intune allows you to customize the Company Portal so that it better supports your organization. Specifically, you can set the Company Portal branding, support information, enrollment, privacy, notifications, device categories, app sources, and self-service actions.

+> [!NOTE]

+> The "Company Portal" is commonly used as the descriptor for the Intune app, Company portal app, and the Company portal website.

+>

+> You don't need to use the Company Portal if you are only managing devices (MDM). If you are using **MAM** or **MDM + MAM**, you need to use the Company Portal.

+### Microsoft Outlook

+Microsoft Intune makes it easy to provide Microsoft Outlook to your end users at your organization. Outlook provides secure email, calendar, contacts, and files. You can choose to add app configuration and protection policies for Microsoft Outlook to iOS/iPadOS or Android devices. For related information, see [Microsoft apps](/mem/intune/apps/apps-supported-intune-apps#microsoft-apps) and [Configure Microsoft Outlook](/microsoft-365/solutions/apps-config-step-2).

+### Microsoft 365 Apps

+Microsoft 365, formerly known as Microsoft Office, is a suite of productivity apps that include Microsoft Word, Excel, PowerPoint, Teams, and more. Assigning Microsoft 365 apps to the devices and users at your organization is the recommended way to install Microsoft 365 apps. You can deliver Microsoft 365 apps to Windows, iOS, Android, and macOS platforms.

+### Microsoft Edge

+Microsoft Edge for iOS and Android is designed to enable users to browse the web and supports multi-identity. Users can add a work account, as well as a personal account, for browsing. There's complete separation between the two identities, which is similar to what is offered in other Microsoft mobile apps.

+### Microsoft Teams

+Microsoft Teams is the hub for team collaboration in Microsoft 365 that integrates the people, content, and tools your team needs to be more engaged and effective.

+## Other apps to assign

+You can add apps to Intune that support management capabilities using the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). Once you add an app to Intune, you can assign the app to devices and users. Intune helps install the app on your users' devices.

+For more information about the different types of apps you can manage with Intune, see [Managed app types](/microsoft-365/solutions/apps-type-overview#managed-app-types).

+## Assign app process

+After you've added an app to Microsoft Intune, you can assign the app to users and devices. It's important to note that you can deploy an app to a device whether or not the device is managed by Intune. Instead of the *device* being managed by Intune, the *app* would be managed by Intune.

+Apps are handled differently when assigning an app to a user versus assigning the app to a device. If your organization only manages apps using Intune, rather than enrolling and managing devices, you assign apps to users or groups of users. This is the Mobile Application Management (MAM) approach to securing and protecting your organization using Intune. If your organization manages both devices and users, you can follow the MDM + MAM approach to management.

+> [!NOTE]

+> To compare the available options when assigning managed apps to enrolled devices versus devices not enrolled with Intune, see [Options when assigning managed apps](/mem/intune/apps/apps-deploy#options-when-assigning-managed-apps).

+You can assign an app to members of your organization when you add the app to Intune, or later after you have assigned the app policies. For details about assigning managed apps from Intune, see [Assign an app](/mem/intune/apps/apps-deploy#options-when-assigning-managed-apps).

+## Next step

+[:::image type="content" source="../medi)

+Continue with [Step 3](apps-assign-step-3.md) to verify and monitor app assignments using Microsoft Intune.

+ Title: "Step 3. Verify and monitor app assignments"

+audience: ITPro

+description: Step 3. Verify and monitor app assignments.

+ms.localizationpriority: high

+- highpri

+keywords:

+# Step 3. Verify and monitor app assignments

+Microsoft Intune provides a variety of reports to help monitor apps. These reports help you understand whether apps are licensed, installed, protected, configured, or restricted. You can also monitor individual apps and monitor apps on individual devices.

+## Understand app reports

+You can use reports in Intune to help verify and monitor app licenses. You can also determine which apps are discovered and installed on a device. If you've applied app policies, you can determine which apps are configured and protected that use those policies. Intune also provides a report to help you determine which apps are restricted on a device and which apps are co-managed by both Intune and Configuration Manager.

+### App licenses report

+Intune provides a list of all the app licenses your tenant currently has in use. For more information about app licenses for Intune, see [Monitor app licenses used in Intune](/microsoft-365/solutions/apps-license-manage#monitor-app-licenses-used-in-intune). For more information about the **App licenses** report, see [Monitor app information and assignments with Microsoft Intune](/mem/intune/apps/apps-monitor).

+### Discovered apps report

+To determine a list of detected apps that are on Intune enrolled devices for your tenant, you can view a list of discovered apps. The **Discovered apps** report refreshes every seven days from the time of enrollment (not a weekly refresh for the entire tenant). For more information, see [Intune discovered apps](/mem/intune/apps/app-discovered-apps#monitor-discovered-apps-with-intune).

+> [!NOTE]

+> For personal devices, Intune never collects information on applications that are unmanaged. On corporate devices, any app, whether it's a managed app or not, is collected for this report.

+### App install status report

+If you need a detailed list of apps that are either installed, in the process of being installed, or have failed installation, you can use the **App Install Status** report. This report provides the **Version**, **Publisher**, and **Platform** for each app. For more information, see [App Install Status report](/mem/intune/fundamentals/reports#app-install-status-report-operational).

+### App protection status report

+If you've applied an app protection policy to your managed apps, you can view an app protection status report. This report is helpful if you need to check app policy compliance or users that are affected by an app protection policy. This report provides a complete set of information, such as compliance state, app version, platform version, and the last sync timestamp. For more information, see [How to monitor app protection policies](/mem/intune/apps/app-protection-policies-monitor).

+### App configuration status report

+By assigning app configuration policies to the members of your organization, you can help eliminate app setup problems. The settings contained in the app configuration policy are automatically applied when the app is configured on the end user's device. You can view the **App Configuration Status** in the app monitoring section of Intune. The report provides details about each app, such as user, app, app version, last sync, and policy name. For more information about troubleshooting apps, see [Reports for managed apps](/mem/intune/fundamentals/filters-reports-troubleshoot#reports-for-managed-apps).

+### Devices with restricted apps report

+You can include a list of restricted apps when you create a device compliance policy for [Android device administrator devices](/mem/intune/protect/compliance-policy-create-android#device-security) or [iOS devices](/mem/intune/protect/compliance-policy-create-ios#device-security). A device that has at least one app installed which is found on the restricted apps list will be marked as noncompliant. For more information, see [Devices with restricted apps report](/mem/intune/fundamentals/reports#devices-with-restricted-apps-report-operational).

+### Co-managed workloads report

+The **Co-Managed Workloads** report allows you to get details about apps on Windows devices managed by both Intune and Configuration Manager. Co-management is best for environments that already manage devices using Configuration Manager, and want to integrate Microsoft Intune workloads. Co-management is the act of moving workloads from Configuration Manager to Intune and telling the Windows client who the management authority is for that particular workload. For more information, see [Co-managed workloads report](/mem/intune/fundamentals/reports#co-managed-workloads-report-organizational).

+## Monitor individual apps

+Intune provides app reports for individually selected apps. You can determine general app status, app install status for a device, and app install status for a user.

+### App status overview

+The **Overview** pane for an individual app provides details about the app as it relates to a devices and user. The app pane provides two charts, **Device status** and **User status**. Both charts provide five different app states (**Installed**, **Not Installed**, **Failed**, **Install Pending**, and **Not Applicable**). For an individual app, these charts can help confirm that all looks good, or that there are issues to resolve.

+### Device install status report

+The **Overview** pane for an individual app also includes a link to an app report related to the device with the app. The **Devices install status** report provides a list of devices and status information related to the specific app. App installation details related to the device includes UPN, Platform, Version, Status, Status details, and Last check-in. For more information, see [Device Install Status report for apps](/mem/intune/fundamentals/reports#device-install-status-report-for-apps-operational).

+### User install status report

+In addition, the **Overview** pane for an individual app includes a link to an app report related to the user of the app. The **User install status** report provides a list of users and status information related to the specific app. App installation details related to the user includes Name, UPN, Failures, Installs, Pending, Not Installed, and Not Applicable. For more information, see [User Install Status for apps report](/mem/intune/fundamentals/reports#user-install-status-for-apps-report-operational).

+## Monitor individual devices

+Intune provides app reports for individually selected devices.

+### Managed apps report

+The **Managed Apps** report provides a report of apps on a specific device. The state of the app includes **installed**, **not installed**, or **available for install**. The report provides additional details related to the device, include application, version, resolved intent, and installation status of the app. This report allows you to see installation and diagnostic details. For more information, see [Managed Apps report](/mem/intune/fundamentals/reports#managed-apps-report-operational).

+## Next step

+[:::image type="content" source="../medi)

+Continue with [Step 3](apps-assign-step-4.md) to troubleshoot app deployment issues using Microsoft Intune.

+ Title: "Step 4. Troubleshoot app deployment issues"

+audience: ITPro

+description: Step 4. Troubleshoot app deployment issues.

+ms.localizationpriority: high

+- highpri

+keywords:

+# Step 4. Troubleshoot app deployment issues

+Before an app protection policy can be used to protect an app on a device, the policy must be delivered and applied to the user at your organization. There are several timing reasons and remedies that impact app protection policy delivery.

+Common user state issues that impact the delivery of app protection policies:

+- **Issue**: Tenant not on-boarded.<br>

+ **Solution**: You must set up your tenant for Intune.

+- **Issue**: User isn't licensed.<br>

+ **Solution**: You must assign an Intune license to the user.

+- **Issue**: User isn't assigned app protection policies.<br>

+ **Solution**: You must assign app protection policy settings to the user.

+- **Issue**: User is assigned an app protection policy, but the related app isn't included in the policy.<br>

+ **Solution**: You must include the app that you want to protect in the app protection policy.

+- **Issue**: User successfully registered for Intune MAM, however they haven't had the app protection policy applied yet.<br>

+ **Solution**: Intune typically takes 30 minutes to register users.

+For specific timing for each of the above issues, see [Delivery timing summary](/mem/intune/apps/app-protection-policy-delivery#delivery-timing-summary).

+> [!IMPORTANT]

+> You can require that an Intune app protection policy is present for the client app before access is available to the selected applications. For more information, see [Require app protection policy](/entra/identity/conditional-access/concept-conditional-access-grant#require-app-protection-policy).

+## Troubleshoot app installation issues

+An app may fail to install for a variety of reasons. The following list provides possible reasons why an app installation might fail:

+- An installation file is deleted after the it's downloaded, but before the app is installed

+- The installation command for the app failed

+- The network connection was lost

+- The device was rebooted during the installation process

+- The device was busy

+- The user rejected the offer to install the app

+- The user explicitly uninstalled the app

+- The download of key installation files were deleted

+- The download of key installation files were stopped by the OS

+- The download services unexpectedly stopped

+- An issue occurred related to the app certificate

+- The app wasn't correctly signed

+- An issue occurred related to the VPP token

+- The app has a store related issue

+If you experience an app installation error, you can start by troubleshooting the error code that you receive. For more information, see [Intune app installation error reference](/troubleshoot/mem/intune/app-management/app-install-error-codes).

+For more information about troubleshooting Windows, iOS, macOS, and Android apps, see [App management troubleshooting documentation](/troubleshoot/mem/intune/app-management/app-management).

+## Limit app extensions

+You can limit Outlook add-ins and LinkedIn account connections as a method of protecting your organization's data. Outlook add-ins are available to integrate extended functionality for Outlook. These add-ins are available on the web. You can't directly manage these add-ins using Intune. However, you can remove specific roles for your end-users that prevent them from installing and side-loading add-ins.

+Additionally, you can disable LinkedIn account connections for your entire organization, or you can enable LinkedIn account connections for selected user groups in your organization. These settings affect LinkedIn connections across Microsoft 365 apps on all platforms (web, mobile, and desktop).

+For more information, see [Protecting application extensions](/mem/intune/apps/app-protection-policy-extensions).

+## After assigning and deploying apps using Intune

+Once you have reviewed and completed the steps provided in this solution, you're ready to manage and maintain the managed apps your organization uses.

+For more information about deploying Intune, see [Get started with your Microsoft Intune deployment](/mem/intune/fundamentals/get-started-with-intune).

+ Title: "Assign managed apps to your organization using Microsoft Intune"

+audience: ITPro

+description: Assign managed apps to your organization using Microsoft Intune.

+ms.localizationpriority: high

+- highpri

+keywords:

+# Assign managed apps using Intune

+Once you have followed the [prerequisites](apps-assign-overview.md#prerequisites) for managing apps at your organization, you're ready to assign and deploy your managed apps to your organization's users and devices.

+As part of the Intune set up process, you may have already added users to Intune and created groups in Intune. These groups allow you to assign policies, settings, apps, and other resources.

+Managed apps that you assign using Microsoft Intune are apps that have been enhanced to use the security and configuration capabilities of Intune. As the Intune administrator, you can specially configure your app policies to meet your organization's security requirements and protect internal data. Then, you can assign both the policies and apps to members of your organization and also devices enrolled at your organization. For example, if a member of your organization is signed in to one of these managed apps with their Microsoft Entra ID account, you (as the admin) can restrict certain features, such as copy and paste. Or, you may need to restrict accessing specific websites, transferring data between apps, saving files, or other operations. You may choose to protect apps using a PIN as an access requirement. Or, protect sensitive data by preventing screenshots, or requiring data to be encrypted. These types of restrictions prevent proprietary information from being shared outside of the app or organization. To maximize data protection, your organization might configure several of these apps to work together.

+Members of your organization know that they're using a managed app, because they must sign in when setting up access to an app that protects organization data. These users receive an on-screen message that tells them the app is protected by your organization. All members of your organization sign in to their managed apps using Microsoft Entra ID.

+## Understand Microsoft Entra ID

+Microsoft Entra ID, formerly known as Azure Active Directory (Azure AD), is a cloud-based identity and access management service that members of your organization can use to access resources, such as internal access to organizational data. Example resources include Microsoft 365, the Azure portal, and other SaaS applications.

+> [!NOTE]

+> Microsoft renamed Azure Active Directory (Azure AD) to Microsoft Entra ID to communicate the multicloud, multiplatform functionality of the products, alleviate confusion with Windows Server Active Directory, and unify the [Microsoft Entra](/entra) product family.

+Every Microsoft tenant, such as a tenant that uses Microsoft 365, Office 365, Azure, or Intune, is automatically a Microsoft Entra tenant. You can continue managing access to your integrated apps, including those that you add and deploy from Intune.

+> [!NOTE]

+> A tenant is a dedicated instance of Microsoft Entra ID where your subscription to Intune is hosted. You can configure your tenant, add users and groups, and assign licenses to users. When you're ready, using your tenant, you can help users enroll their devices and add apps that they need to begin the modern endpoint management process. As you continue, you can set configuration and protection policies, as well as other endpoint management capabilities.

+Registration in Microsoft Entra ID is a required step for Intune management. Before a device can enroll in Intune, the user of the device must authenticate and establish a device identity in your org's Microsoft Entra ID. This step grants the user single sign-on access to cloud-based work apps and other resources. It's important to know which identity option you're utilizing because it determines the enrollment methods you can use, and also determines the sign-in experience for the device user. Identity options include:

+- **Microsoft Entra registration** - This option is the device identity option available for personal and corporate-owned mobile devices. Users on these devices authenticate by signing in to work resources, like apps and web browsers, using their Microsoft Entra ID work account.

+- **Microsoft Entra joined** - This option is the device identity option available for corporate-owned Windows 10/11 devices utilizing co-management options. Users on these devices authenticate by signing in to the device using their Microsoft Entra ID work account.

+## Steps to assign apps to your organization

+This solution steps you through the process of assigning and deploying managed apps from Microsoft Intune to members of your organization. Once you've completed the [prerequisites](apps-protect-overview.md#prerequisites), you're ready to assign and deploy apps from Intune. By using managed apps, along with configuration and protection policies as part of your app management efforts, allows members of your organization to safely use apps. By managing apps at your organization, you help to protect and secure your organizationΓÇÖs data.

+Follow these steps to assign apps to members of your organization using Intune:

+1. [Confirm users, devices, or groups](apps-assign-step-1.md)

+2. [Assign apps to users, devices, or groups](apps-assign-step-2.md)

+3. [Verify and monitor app assignments](apps-assign-step-3.md)

+4. [Troubleshoot app deployment issues](apps-assign-step-4.md)

+[:::image type="content" source="../medi)

+Continue with [Step 1](apps-assign-step-1.md) to confirm users and devices using Microsoft Intune.

+| 2 | Set up apps | [Add](apps-add-overview.md), [configure](apps-config-overview.md), and [protect](apps-protect-overview.md) the apps your organization uses. When you're finished with this step, you'll have completed the following:<ul><li>Understand how to [add managed apps](apps-guide-overview.md)</li><li>Understand which apps to [add to your tenant first](apps-add-overview.md)</li><li>Understand how to [configure apps in Intune](apps-config-overview.md)</li><li>Understand how to [protect apps using Intune](apps-protect-overview.md)</li><li>Understand the [different levels of app protection](apps-protect-framework.md)</li></ul> |

+This Limited Time License is effective on your acceptance and terminates on the earlier of (i) 30 days following first general availability of a commercial release of the Features in a Microsoft product or a future Microsoft product or (ii) December 31, 2024.