You ask Copilot a work question inside Microsoft 365 apps. It replies with a generic refusal: I cannot help with that. This happens even when the request is valid and within your organization’s data policies. The root cause is often a mismatch between Copilot’s grounding configuration and the data source you are trying to query. This article explains why Copilot blocks valid requests and provides the exact steps to resolve the issue across Microsoft 365 admin settings, user permissions, and app-level configurations.
Key Takeaways: Fixing Copilot Refusals for Valid Requests
- Microsoft 365 admin center > Copilot > Data sources: Controls which Microsoft Graph data Copilot can read for grounded responses.
- User license assignment > Copilot for Microsoft 365: Each user must have an active Copilot license assigned in the Microsoft 365 admin center.
- SharePoint site permissions > Read access: Copilot cannot access files, lists, or pages where the user lacks at least Read permission.
Why Copilot Refuses Valid Requests
Copilot uses Microsoft Graph to retrieve data from your tenant. When you ask a question about a document, a calendar event, or a chat thread, Copilot must authenticate against the user’s identity and then search the relevant data sources. If any part of this chain fails, Copilot returns a generic refusal instead of a specific error message.
The most common technical root causes are:
Data Source Configuration Blocks
In the Microsoft 365 admin center, an administrator can restrict which Microsoft Graph data sources Copilot can use. If SharePoint, Exchange, or Teams data is disabled, Copilot cannot answer questions that require that data. The result is always a refusal.
License Assignment Issues
Copilot for Microsoft 365 requires a per-user license. If the license is not assigned, not active, or expired, Copilot will refuse to process any request that requires access to Microsoft 365 data. The user sees the refusal message immediately after asking a question.
User Permission Gaps
Even with correct licensing and data source settings, Copilot respects existing SharePoint, OneDrive, and Teams permissions. If the user does not have Read or higher access to the specific file, folder, or site, Copilot cannot retrieve the content. It returns a refusal rather than showing an access error.
Steps to Resolve Copilot Refusals for Valid Requests
Follow these steps in order. Each step addresses one of the root causes described above. After each step, test Copilot with a simple request such as Summarize the last email from [name].
Step 1: Verify Copilot Data Source Settings in the Admin Center
- Sign in to the Microsoft 365 admin center
Go to admin.microsoft.com and sign in with a Global Admin or Copilot Admin role. - Open Copilot settings
In the left navigation, select Settings then Org settings. Scroll down and select Copilot. - Check Data sources
Under the Data sources tab, ensure Microsoft Graph is enabled. The toggle should show On. If it is Off, turn it On and select Save. - Confirm specific data connectors
Below the main toggle, verify that SharePoint, OneDrive, Exchange, and Teams are all enabled. If any are disabled, enable them and save again.
Step 2: Confirm the User Has a Valid Copilot License
- Go to Billing > Licenses
In the Microsoft 365 admin center, select Billing in the left navigation, then Licenses. - Select Copilot for Microsoft 365
From the list of products, choose Copilot for Microsoft 365. Check the Assigned count. If it is zero, assign licenses. - Assign a license to the affected user
Go to Users > Active users. Select the user who sees the refusal. Select the Licenses and apps tab. Check the box for Copilot for Microsoft 365 and select Save changes. - Wait 15 minutes
License changes propagate within 15 minutes. After that time, ask the user to sign out of all Microsoft 365 apps and sign back in.
Step 3: Check User Permissions on the Target Data
- Identify the data source Copilot tried to query
Ask the user for the exact question they asked. For example, Find the Q3 budget spreadsheet in the Finance SharePoint site. - Verify SharePoint site permissions
Go to the SharePoint site in question. Select Settings (gear icon) > Site permissions. Confirm the user is listed as a member or visitor with at least Read permission. - Check file-level permissions
If the file is in a shared library, select the file and choose Manage access. Ensure the user has Direct access or is part of a group with access. - Test with a known accessible file
Ask the user to open a file they own in OneDrive and ask Copilot to summarize it. If Copilot succeeds, the original refusal was due to permissions on the target data.
If Copilot Still Refuses After the Main Fix
Copilot Returns Generic Output Instead of Tenant-Specific Data
If Copilot answers but gives a generic response such as I can help with that in a general sense, the issue is likely the Microsoft Search configuration. Go to the Microsoft 365 admin center > Search & intelligence > Customizations. Ensure that the search scope is set to Your organization and not Everyone. If it is set to Everyone, Copilot may treat the request as a web search and respond generically.
Copilot Refuses on Mobile but Works on Desktop
This indicates a mobile app permission or version issue. Update the Microsoft 365 mobile app to the latest version from the App Store or Google Play. Then sign out and sign back in. The mobile app must have the same Copilot license as the desktop version. If the license is missing, the mobile app falls back to the free Copilot experience, which refuses tenant-specific requests.
Copilot Refuses After a Recent Tenant Migration
If your organization recently migrated from one tenant to another, Copilot data source settings may not have carried over. Re-run Step 1 and verify all data connectors are enabled. Additionally, check that the new tenant has the correct domain verified in Microsoft 365 admin center > Settings > Domains. An unverified domain blocks Copilot from accessing Graph data for that domain.
Copilot Refusal Reasons: Comparison of Common Scenarios
| Item | Data Source Disabled | License Missing | Permission Denied |
|---|---|---|---|
| Description | Admin disabled Microsoft Graph or a specific data connector in Copilot settings | User does not have an active Copilot for Microsoft 365 license assigned | User lacks Read or higher permission on the file, site, or list Copilot tries to access |
| Where to fix | Microsoft 365 admin center > Settings > Org settings > Copilot > Data sources | Microsoft 365 admin center > Billing > Licenses > Copilot for Microsoft 365 | SharePoint site or OneDrive folder > Manage access |
| Refusal message | I cannot help with that | I cannot help with that | I cannot help with that |
| Test method | Ask a question about any tenant file | Ask a question about any tenant file | Ask about a specific file the user owns |
After applying the correct fix, Copilot should respond with relevant data from your tenant. If the refusal persists, repeat all three steps in order. The most common oversight is leaving one data connector disabled after enabling Microsoft Graph. Double-check each connector individually.
You can now identify and resolve the three main causes of Copilot refusals: disabled data sources, missing licenses, and insufficient permissions. Test your fix with a simple request about a file you own in OneDrive. For advanced troubleshooting, review the Microsoft 365 Copilot audit logs in the Microsoft 365 admin center under Health > Audit to see exactly which data source returned the refusal.