Governing browsing with Copilot in Microsoft Edge from Intune

Browsing with Copilot reads the page a user is on. That makes it a data governance decision wearing a browser setting’s clothes, and the Edge 149 administrative templates that landed in Intune give you the controls to make it deliberately rather than by default.

What actually arrived

The Microsoft Edge administrative templates in the Windows settings catalog were refreshed to Edge 149, which brought the Copilot governance policies with it. Microsoft sets out the feature and its controls in Configure browsing with Copilot. Find them in the Intune admin centre under Devices > Manage devices > Configuration > Create > New policy > Windows 10 and later > Settings catalog, then search the Microsoft Edge category.

The one that matters

Most of that list is user experience. Two entries are not.

AllowBrowsingWithCopilot and its allow and block lists decide whether page content leaves the page. Everything else on the list changes what a tab looks like.

The distinction matters because the block list is where your internal applications belong. A line-of-business app rendered in Edge is a web page as far as browsing with Copilot is concerned. So is your ticketing system, your HR portal, and whatever internal site holds the data your DLP programme exists to protect.

A block list that reflects your estate

Start from your internal DNS rather than from imagination. The sites worth blocking are the ones that were never designed to be read by anything other than the person signed into them.

1. Internal line-of-business applications, including anything on a private hostname.
2. Admin portals. Your own tenant’s admin centres, and any third-party console holding customer data.
3. HR, payroll and finance systems.
4. Anything already covered by a Purview DLP policy. If the content warranted a DLP rule, it warrants a Copilot block.

Then decide the default. Blocking everything and allowing exceptions is defensible on a regulated estate and unworkable on most others, because the value of the feature is that people do not have to think about it.

Checking what is deployed

Settings catalog policies are configuration policies in Graph, so you can audit which of these you have actually set rather than trusting memory.

1# Requires Microsoft.Graph.DeviceManagement.
2Connect-MgGraph -Scopes ‘DeviceManagementConfiguration.Read.All’
3
4$needles = @(
5    ‘browsingwithcopilot’
6    ‘copilotnewtabpage’
7    ‘copilotaddressbar’
8    ‘m365linksautoopencopilot’
9    ‘ntpfeedtab’
10)
11
12Get-MgBetaDeviceManagementConfigurationPolicy -All |
13    ForEach-Object {
14        $policy   = $_
15        $settings = Get-MgBetaDeviceManagementConfigurationPolicySetting `
16                        -DeviceManagementConfigurationPolicyId $policy.Id -All
17
18        foreach ($s in $settings) {
19            $json = $s.SettingInstance | ConvertTo-Json -Depth 12
20            foreach ($n in $needles) {
21                if ($json -match $n) {
22                    [PSCustomObject]@{
23                        Policy  = $policy.Name
24                        Setting = $n
25                    }
26                }
27            }
28        }
29    } |
30    Sort-Object Policy, Setting -Unique |
31    Format-Table -AutoSize

An empty result is the answer most tenants will get, and it means browsing with Copilot is running on its defaults everywhere.

One more from the same release

Edge 149 also added MAMWithDeviceDLP, which allows MAM enrolment when a managed device already has a Purview DLP policy configured. If you have been unable to combine app protection policies with device-level DLP without one blocking the other, that is the setting to look at.

What I would do

Set AllowBrowsingWithCopilot deliberately rather than leaving it at the default, whichever way you decide. A default is a decision nobody has written down, and this is not a feature you want to be explaining after the fact.

Then build the block list from the DLP policies you already have. That list has already been through a conversation about what is sensitive, which means you are reusing a decision rather than making a new one, and it will be easier to defend than a list somebody assembled from memory on a Friday.

The rest of the policies are user experience. Set them once, put them in the same profile, and stop thinking about them.