Governing the Microsoft 365 Copilot auto-install: what to check before July
Microsoft is rolling out automatic Copilot app installation to commercial Windows devices through July 2026. Three admin control layers to apply now, and what the rollout actually means for your data governance.
Microsoft kicked off a phased automatic installation of the Microsoft 365 Copilot app across commercial Windows devices on 4 June 2026 (message centre reference: MC1152323). If your tenant is outside the European Economic Area and runs Microsoft 365 Apps, the app will appear on users’ desktops without anyone clicking anything.
That’s not necessarily a problem, but it is a governance event — and the default is opt-out, not opt-in. Here’s what I audit and configure whenever a client asks about this.
What the rollout actually covers
The installation targets commercial Windows devices that already have Microsoft 365 Apps (Word, Excel, Outlook, and so on) installed. It runs in three waves:
| Phase | Channel | Window |
|---|---|---|
| 1 | First Release (Targeted Release) | 3–14 June 2026 |
| 2 | Current Channel | 15 June – 1 July 2026 |
| 3 | Monthly Enterprise + Semi-Annual channels | 2–20 July 2026 |
Two firm limits: the EEA is excluded by design (Microsoft’s regulatory position), and the installer checks for an eligible M365 Apps licence before doing anything — devices without Microsoft 365 Apps are unaffected.
Critically, installing the app does not grant usage rights on its own. Users without a paid Microsoft 365 Copilot add-on licence get access to Copilot Chat — the free AI assistant grounded in public web results, similar to Copilot.Microsoft.com. Full Copilot, the one that reads your SharePoint files, Teams chats, and mailbox, still requires the paid licence. That distinction matters when you’re writing the change advisory.
Why governance still matters even without the paid licence
Even at the free tier, the auto-install creates new surface to manage:
- The app pins itself to the M365 app launcher, which is a visible change for users who weren’t expecting it — helpdesk tickets tend to follow.
- If self-service purchases are enabled in your tenant, users can buy the paid add-on themselves before you’re ready to support it.
- The governance baseline you set now is exactly what you’ll build the paid rollout on later — better to get it right while the stakes are lower.
If you haven’t yet done a Microsoft Purview data readiness review for Copilot — understanding which sensitive files are broadly accessible in SharePoint, checking DLP policy coverage, reviewing sensitivity labels — the auto-install is the right nudge to start that work before you light up the paid tier.
Three control layers
1. Microsoft 365 Admin Center toggle (tenant-wide)
The fastest stop: Settings → Org settings → Microsoft 365 Copilot → Allow auto-installation of the Copilot app is enabled by default. Turning it off prevents the app from being pushed to devices in the current rollout wave.
Use this lever when your tenant isn’t ready for Copilot at all and you want a clean pause with no exceptions.
2. Microsoft 365 Apps Admin Center (per-channel control)
For more granular control — allowing the First Release ring while holding everyone else — go to Customization → Device Configuration → Modern App Settings, select Microsoft 365 Copilot app, and uncheck Enable automatic installation of the Microsoft 365 Copilot app.
This integrates with your existing Office update channel configuration, so you can scope the block to specific channels that aren’t ready yet without touching the tenant-wide toggle.
3. Group Policy / Intune Settings Catalog
For Intune-managed devices, the setting lives in the Settings Catalog at:
Microsoft 365 Apps for enterprise → Update → Disable Microsoft 365 Copilot auto-install
For domain-joined or hybrid-joined devices, update your Microsoft 365 Apps Administrative Templates (ADMX/ADML) to version 5243.1000 or later and enable:
Administrative Templates → Microsoft 365 Copilot → Prevent automatic installation of the Microsoft 365 Copilot app
This is the right layer when you want to scope control to specific Entra ID groups in Intune, or to individual OUs in a hybrid GPO model — useful for piloting Copilot with a target group while blocking all other devices.
# Quick inventory: list Intune device configuration profiles and recent changes
# Useful for confirming a new M365 Apps policy was deployed as expected
# Requires: Microsoft.Graph.DeviceManagement module
Connect-MgGraph -Scopes "DeviceManagementConfiguration.Read.All"
Get-MgDeviceManagementDeviceConfiguration |
Select-Object DisplayName, CreatedDateTime, LastModifiedDateTime |
Sort-Object LastModifiedDateTime -Descending |
Format-Table -AutoSizeMonitoring the rollout
After setting your policy, track progress in the Microsoft 365 Apps health dashboard in the Apps Admin Center — it shows which devices have the Copilot app installed and on which update channel. Follow the MC1152323 thread in your Message Center for follow-on announcements.
The Apps Admin Center also lets you audit add-in and app installation state across the estate, which is useful if Phase 1 already ran before you applied the block and you want to confirm the policy caught Phase 2 and Phase 3 devices.
The takeaway
The toggle is on by default, the rollout has already started, and Phase 2 hits on 15 June. Check your tenant posture now — either let the rollout proceed with a communication plan ready, or use one of the three control layers above to stay in front of it. Either path is fine; the one to avoid is finding out after 2,000 users ask what the new app on their taskbar is.
Sources & further reading: Manage Microsoft 365 Copilot Chat, MC1152323 message centre archive, Microsoft 365 Copilot governance guide — June 2026, Opt-out walkthrough (LazyAdmin).