Copilot Service Plan Turned Off but Feature Still Works: Fix

You disabled the Copilot service plan in the Microsoft 365 admin center, yet users in your tenant can still access Copilot features inside Word, Excel, or Teams. This mismatch between configuration and actual user experience creates confusion about whether licensing or policy enforcement is actually working. The root cause is a delay in how Microsoft 365 applies service plan changes across its infrastructure and how cached tokens on client devices override the new policy. This article explains why the Copilot service plan toggle appears ineffective and provides the exact steps to force the change across your tenant.

Why the Copilot Service Plan Toggle Does Not Immediately Disable the Feature

When you uncheck the Copilot service plan under a user’s license in the admin center, Microsoft 365 queues the change for propagation. This process can take up to 24 hours in large tenants due to replication across Microsoft’s directory service. During this window, users who already have an active authentication token continue to see Copilot as available because their client app checks the token’s claims, not the live license state. The token remains valid until it expires, which by default is 60 to 90 minutes for Microsoft 365 apps. Additionally, cached web content in the browser or the Office app’s local state can retain Copilot UI elements even after the service plan is removed. The feature appears to work because the client does not re-validate the license on every action. Only when the token expires or the user signs out and back in does the client see the disabled plan.

Another factor is that the Copilot service plan is tied to a specific SKU, such as Microsoft 365 E5 or Copilot for Microsoft 365. If you removed the plan from the license but the user still has an active session from before the change, the client app uses the old token. The admin center also does not revoke existing sessions automatically. You must manually invalidate the user’s tokens to enforce the change immediately.

Steps to Force Copilot Service Plan Changes Across Your Tenant

Use the following methods to make the disabled Copilot service plan take effect immediately. Start with the admin center, then use PowerShell for bulk enforcement, and finally clear client caches.

Method 1: Verify and Reapply the Service Plan Change in the Admin Center

1. Open the Microsoft 365 admin center
   Go to Billing > Licenses. Select the license that includes Copilot, such as Microsoft 365 E5 or Copilot for Microsoft 365.
2. Locate the Copilot service plan
   In the license details page, scroll to the service plans list. Find Microsoft Copilot or Copilot for Microsoft 365. Ensure the checkbox is unchecked.
3. Assign the modified license to users
   Go to Users > Active users. Select a user who still sees Copilot. Click Licenses and apps. Uncheck the Copilot service plan again if it appears checked. Click Save changes. Repeat for each affected user.
4. Wait 30 minutes and test
   Ask the user to sign out of all Microsoft 365 apps and sign back in. If Copilot still appears, proceed to Method 2.

Method 2: Remove the Copilot Service Plan Using PowerShell

PowerShell directly modifies the license assignment and bypasses the admin center’s propagation queue. You need the Microsoft Graph PowerShell module.

1. Install the Microsoft Graph module
   Open PowerShell as administrator and run: Install-Module Microsoft.Graph -Scope CurrentUser. Confirm the installation.
2. Connect to your tenant
   Run: Connect-MgGraph -Scopes User.ReadWrite.All, Organization.Read.All. Sign in with a global admin account.
3. Get the user’s current license details
   Run: Get-MgUserLicenseDetail -UserId user@domain.com. Note the SkuId and the ServicePlanId for Copilot. The Copilot service plan ID is e2e4c3b9-3b7e-4b3a-8c1a-1b2c3d4e5f6a for Copilot for Microsoft 365, but verify this in your tenant.
4. Disable the Copilot service plan
   Run the following script, replacing placeholders with your values:

   $UserId = "user@domain.com"
   $SkuId = "your-sku-id"
   $ServicePlanId = "copilot-service-plan-id"
   
   $License = @{
       AddLicenses = @(
           @{
               SkuId = $SkuId
               DisabledPlans = @($ServicePlanId)
           }
       )
       RemoveLicenses = @()
   }
   
   Set-MgUserLicense -UserId $UserId -BodyParameter $License

   This command adds the license again but with the Copilot plan disabled.

5. Verify the change
   Run: Get-MgUserLicenseDetail -UserId user@domain.com | Select-Object -ExpandProperty ServicePlans | Where-Object {$_.ServicePlanId -eq $ServicePlanId}. The ProvisioningStatus should show Disabled.

Method 3: Force Client Token Refresh for All Affected Users

1. Sign out of all Microsoft 365 apps
   In each app Word, Excel, Teams, and Outlook, go to File > Account > Sign out. Close all Office applications.
2. Clear browser cache and cookies
   For web access to Microsoft 365, clear the browser cache and cookies for the login.microsoftonline.com and office.com domains. Restart the browser.
3. Revoke existing refresh tokens via PowerShell
   Run: Revoke-MgUserSignInSession -UserId user@domain.com. This forces the user to re-authenticate on next sign-in.
4. Sign back in and test
   The user must sign in again with their work account. Copilot should no longer appear in the ribbon or the Copilot pane.

If Copilot Still Works After These Fixes

Copilot Icon Appears but Returns an Error When Clicked

The icon may remain due to cached UI assets in the Office app. Run the Office Repair tool: go to Control Panel > Programs > Microsoft 365 > Change > Quick Repair. This removes cached add-in data. If the icon persists, use Online Repair.

User Has a Second License That Includes Copilot

A user may have multiple licenses assigned, such as Microsoft 365 E5 and a separate Copilot for Microsoft 365 add-on. Disabling the plan on one license does not affect the other. Review all licenses assigned to the user in Users > Active users > Licenses and apps. Uncheck Copilot on every license that includes it.

Copilot Is Enabled via a Group Policy or Configuration Profile

If you use Intune or Group Policy to control Office features, a policy may override the license state. Check Microsoft 365 admin center > Settings > Org settings > Copilot. Ensure the toggle for Allow Copilot is set to Off. Also check Intune > Apps > App configuration policies for any policy that enables Copilot.

Admin Center vs PowerShell: Service Plan Enforcement Comparison

Item	Admin Center	PowerShell
Propagation speed	Up to 24 hours for large tenants	Immediate on the license object
Bulk user support	Manual per user	Scriptable for all users
Token revocation	Not included	Requires separate Revoke-MgUserSignInSession cmdlet
Error handling	Limited to UI validation	Detailed error output in console

Use the admin center for single-user changes when you can wait for propagation. Use PowerShell when you need immediate enforcement across multiple users. Always combine either method with client token revocation to ensure the change is visible to the user immediately.

You can now enforce the Copilot service plan change immediately using PowerShell and token revocation. For future changes, revoke user sessions right after modifying the license to avoid the delay window. As an advanced tip, create a scheduled PowerShell script that runs daily to verify that no user has a disabled plan but an active token, and automatically revoke sessions for any mismatch.