How to Configure Copilot Plugin Allowlist for Microsoft 365 Users

You want to control which plugins Copilot can use in your organization. Without an allowlist, users can enable any plugin, including unverified or risky third-party plugins. This article explains how to create and apply a Copilot plugin allowlist using the Microsoft 365 admin center. You will learn the exact settings and PowerShell commands needed to enforce plugin restrictions.

What the Copilot Plugin Allowlist Does and Why It Exists

The Copilot plugin allowlist restricts which plugins Copilot can invoke during conversations. When enabled, only plugins on the allowlist are available. All other plugins are blocked. This feature exists to prevent data leakage, enforce compliance, and reduce attack surface. Without an allowlist, any user can connect Copilot to external services like Jira, Salesforce, or custom APIs. A misconfigured plugin could expose sensitive Microsoft 365 data to third-party servers. The allowlist gives IT administrators precise control. You define the plugins, and Copilot ignores everything else.

Prerequisites for Configuring the Allowlist

Before you start, confirm the following requirements are met:

• You must have the Global Administrator or Copilot Administrator role in Microsoft Entra ID.
• Your tenant must have Copilot for Microsoft 365 licenses assigned to users.
• You need access to the Microsoft 365 admin center at admin.microsoft.com.
• You must install the Microsoft Graph PowerShell SDK version 2.0 or later if using PowerShell.
• You need the plugin IDs for each plugin you want to allow. Obtain these from the Microsoft 365 admin center under Copilot > Plugin management.

Steps to Configure the Copilot Plugin Allowlist

There are two methods to configure the allowlist: through the admin center UI or using PowerShell. Both methods achieve the same result. Choose the one that fits your workflow.

Method 1: Using the Microsoft 365 Admin Center

1. Open the Microsoft 365 admin center
   Go to admin.microsoft.com and sign in with your Global Administrator or Copilot Administrator account.
2. Navigate to Copilot settings
   In the left navigation pane, select Copilot. Then click Plugin management.
3. Enable the allowlist
   On the Plugin management page, locate the Plugin allowlist section. Toggle the switch to On. This enables the allowlist mode.
4. Add allowed plugins
   Click Add plugins. A list of available plugins appears. Select the checkboxes next to the plugins you want to allow. You can search by plugin name. Click Add when done.
5. Review and save
   Verify the selected plugins appear in the allowed list. Click Save to apply the configuration. Changes take effect within 15 minutes for all users.

Method 2: Using PowerShell

1. Connect to Microsoft Graph
   Open PowerShell as an administrator. Run Connect-MgGraph -Scopes "Policy.ReadWrite.Copilot", "Plugin.ReadWrite.All". Sign in with your admin credentials.
2. Get the current Copilot policy
   Run $policy = Get-MgPolicyCopilotPolicy. This retrieves the existing policy object. If no policy exists, the command returns null.
3. Set the allowlist
   Run the following command: Set-MgPolicyCopilotPolicy -PluginAllowList @("plugin-id-1", "plugin-id-2"). Replace the placeholder IDs with actual plugin IDs. To get plugin IDs, run Get-MgCopilotPlugin.
4. Enable the allowlist enforcement
   Run Set-MgPolicyCopilotPolicy -PluginAllowListEnabled $true. This activates the allowlist. Without this step, the list is defined but not enforced.
5. Verify the policy
   Run Get-MgPolicyCopilotPolicy | Format-List. Confirm that PluginAllowListEnabled is True and PluginAllowList contains the correct IDs.

Common Mistakes and Limitations

The allowlist does not block all plugins

The allowlist only applies to plugins that Copilot can invoke. First-party Microsoft plugins like Bing Search and Microsoft Graph connectors are not affected. They are always available. To block them, use the Copilot data source settings instead.

Users still see blocked plugins in the Copilot interface

When a plugin is blocked, it still appears in the Copilot plugin picker but shows as disabled. Users cannot enable it. This is by design. To hide blocked plugins entirely, you must remove them from the tenant using the Plugin management page.

Allowlist changes take time to propagate

After saving the allowlist, it can take up to 30 minutes for the change to reach all users. Copilot caches the policy for performance. If you need immediate enforcement, ask users to restart the Copilot app or refresh the browser tab.

Plugin IDs change after updates

When a plugin publisher updates their plugin, the plugin ID may change. This removes the plugin from the allowlist. Monitor the plugin inventory regularly. Re-add the new plugin ID after updates.

Copilot Plugin Allowlist vs Plugin Blocklist: Key Differences

Item	Allowlist	Blocklist
Default behavior	All plugins blocked by default	All plugins allowed by default
Administration effort	Higher — you must list every allowed plugin	Lower — you only list blocked plugins
Security posture	Stronger — only known safe plugins are available	Weaker — new plugins are allowed until blocked
Best for	Highly regulated environments	General business with few restrictions

Choose the allowlist if your organization requires strict compliance. Use the blocklist if you trust most plugins but need to block a few specific ones.

You can now configure the Copilot plugin allowlist using either the admin center or PowerShell. Start by reviewing your current plugin inventory. Then enable the allowlist and add the plugins your users need. For ongoing management, check the plugin list weekly to catch ID changes from updates. Use the Microsoft Graph API to automate this check with a scheduled PowerShell script.