Disable consumer Copilot, keep the paid Copilot: runbook

A business pays for Microsoft 365 Copilot seats for the staff who need them. Then a Copilot app turns up pinned on new Windows 11 devices, Edge grows a Copilot button, and someone signs into Word with a personal account and finds a different Copilot again. The question lands in the IT inbox in the same words every time: how do we remove the consumer Copilot without breaking the one we pay for? Admin forums are full of that exact thread, and the answers are fragmented because each reply covers one surface and misses the other four.

This runbook covers every surface in one place, with the policy names as they stand in August 2026, verified against Microsoft Learn. The short version up front: none of these controls touches the paid Microsoft 365 Copilot experience. Removing the consumer product and keeping the commercial one are fully compatible goals, because since late 2024 they have been separate apps with separate sign-in models.

Know which Copilot you are removing

Two different products called Copilot can appear on a work device. The Microsoft Copilot app (package name Microsoft.Copilot) is the consumer experience. It only works with personal Microsoft accounts; a user who tries to sign in with a work (Microsoft Entra) account is bounced out to the browser. The work experience lives in a different app, confusingly also called Microsoft Copilot (previously the Microsoft 365 app, package Microsoft.MicrosoftOfficeHub). That app hosts Copilot Chat, the web-grounded chat with enterprise data protection included with most business licences, and for staff with the paid Microsoft 365 Copilot add-on it also carries the work-scoped experience grounded in their email, chats and documents.

The practical consequence: the consumer app can be removed outright without any effect on paid Copilot, because the paid product never runs inside it. The real job is removing the consumer app itself, then closing the consumer entry points in Edge and Office that follow personal account sign-ins.

Windows 11: remove the consumer Copilot app

Microsoft shipped a purpose-built policy for this in 2026: RemoveMicrosoftCopilotApp, available on Windows 11 24H2 and later. In Intune it sits in the settings catalog under Windows AI; in Group Policy it maps under Windows Components > Windows AI. The CSP path is ./Device/Vendor/MSFT/Policy/Config/WindowsAI/RemoveMicrosoftCopilotApp (a user-scope variant also exists), with a value of 1 to enable removal.

• The policy is deliberately conservative. It only uninstalls the consumer app where the user did not install it themselves and has not launched it in the last 28 days. It targets the preinstalled clutter, not apps people actively chose.
• Users can still reinstall the app from the Microsoft Store after the policy removes it. On its own, this policy is a cleanup, not a block.
• The legacy Turn off Windows Copilot policy (TurnOffWindowsCopilot) is deprecated and does not apply to the current Copilot app. If it is still lingering in a baseline, it is doing nothing useful.

To prevent installation and block launch, Microsoft's documented answer is an AppLocker packaged-app rule: publisher CN=MICROSOFT CORPORATION, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US, package name MICROSOFT.COPILOT, package version * and above. With that rule denied, the consumer app cannot be installed where absent and cannot be launched where present. Pairing the AppLocker rule with RemoveMicrosoftCopilotApp gives both removal and a lock on the door.

For a one-off cleanup on specific devices, PowerShell works: Get-AppxPackage -Name "Microsoft.Copilot" piped to Remove-AppxPackage. Just be clear that a script only removes what is there today; without the policy or AppLocker rule, the app can come back on the next feature update or user reinstall.

The Copilot key on newer keyboards

Devices sold since 2024 often carry a dedicated Copilot key. Rather than leaving it dead after removing the consumer app, remap it to the work Copilot app with the SetCopilotHardwareKey policy (user scope, Windows 11 22H2 with KB5044380 and later; Group Policy path User Configuration > Administrative Templates > Windows Components > Windows Copilot > Set Copilot Hardware Key). The value is the target app's AUMID; for the Microsoft Copilot work app that is Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe!Microsoft.MicrosoftOfficeHub. The key then opens Copilot Chat under the user's work identity, which is exactly where a licensed user should land.

Microsoft Edge: one current policy, two page-context policies

Edge is where most stale advice lives. The current control for the Copilot button in the Edge for Business toolbar is Microsoft365CopilotChatIconEnabled, introduced in Edge 139. From Edge 141 it is the only policy that governs the button; the older HubsSidebarEnabled policy stops affecting Copilot from that version, and disabling it also removes every sidebar app, so treat it as a legacy blunt instrument rather than a Copilot control.

• Microsoft365CopilotChatIconEnabled set to Disabled removes the Copilot Chat button from the toolbar for Entra profiles. Note it applies to licensed and unlicensed users alike, so scope it carefully if paid users should keep the button.
• EdgeEntraCopilotPageContext controls whether Copilot Chat can read webpage or PDF content for users signed in with their work account. Disable it to keep browsing context out of prompts without removing chat itself.
• CopilotPageContext does the same job for the consumer Copilot when someone is signed into Bing with a personal Microsoft account inside an Edge work profile. This is the one that specifically fences off the consumer product in Edge.

Office apps: the ribbon button versus Connected Experiences

In Word, Excel and PowerPoint there are again two Copilots to keep straight. The paid Microsoft 365 Copilot features follow the licence: no licence, no paid features, nothing to remove. The consumer Copilot appears in Office only when someone signs in with a personal Microsoft account carrying a Microsoft 365 Personal or Family subscription, which makes it an account-type problem (next section) rather than a ribbon problem.

The common mistake on this surface is reaching for the Allow the use of additional optional connected experiences in Office policy and setting it to Disabled. That does suppress Copilot's web grounding, but it also switches off a raft of unrelated connected experiences across Microsoft 365, and Microsoft's documentation flags exactly this side effect. The scoped alternative is the Allow web search in Copilot policy in the Cloud Policy service (managed from the Microsoft 365 Apps admin center, or the settings area of the Copilot Control System page), which turns off Bing-backed web queries in Copilot Chat without collateral damage. There is also a Pin Microsoft Copilot Chat cloud policy for scoping the in-app Chat entry point to specific groups.

Account types: cut consumer Copilot off at sign-in

Every consumer Copilot surface follows a personal Microsoft account. The durable control is therefore to manage whether personal accounts can sign in to Microsoft 365 apps on managed devices at all, which Microsoft's guidance points at tenant restrictions v2 in Microsoft Entra. With that in place, the consumer Copilot in Office and Edge simply has no identity to run under. The consumer app on Windows needs no equivalent, since it refuses work accounts by design.

Microsoft 365 admin center: pinning and app availability

The admin center's pin control (Copilot > Settings > Pin Microsoft Copilot Chat) decides whether Copilot Chat is pinned in Outlook and Teams. Two things changed in January 2026 that old threads miss: since 28 January 2026 the setting no longer governs the Microsoft Copilot app itself, and Chat can no longer be unpinned from that app's navigation. To remove Chat access for unlicensed users properly, manage the Copilot app through Integrated Apps instead: restrict installation to a security group containing only Microsoft 365 Copilot licensed users. That keeps the app for paid seats and removes it for everyone else. Blocking the app tenant-wide blocks licensed users too, which is usually not the intent. Blocked users see an organisational-policy message, and the admin center lets you attach a link to an internal policy page so they know why.

The runbook, in order, with propagation delays

1. 1Inventory first: confirm who holds Microsoft 365 Copilot licences, and use Intune discovered apps to see where Microsoft.Copilot is installed.
2. 2Deploy the AppLocker deny rule for MICROSOFT.COPILOT so removals stick and new devices never install it. Applies at policy refresh; allow a restart cycle.
3. 3Enable RemoveMicrosoftCopilotApp for the fleet. Takes effect at the next Intune check-in, which is usually within about eight hours on a healthy device.
4. 4Remap the Copilot key with SetCopilotHardwareKey to the work Copilot app's AUMID.
5. 5Set the Edge policies: Microsoft365CopilotChatIconEnabled per your licensing decision, plus the two page-context policies. Edge applies policy on restart after its next sync.
6. 6Scope the Copilot app in Integrated Apps to licensed users, and set the pin control for Outlook and Teams. Microsoft documents pinning changes as taking up to 48 hours.
7. 7Apply the Cloud Policy settings for web search and Chat pinning in Office apps. Cloud Policy is fetched when apps launch; expect a day for full coverage.
8. 8Configure tenant restrictions v2 if personal-account sign-in should be blocked on managed devices.
9. 9Pilot with one group, verify each surface, wait the full 48 hours before declaring the rollout done. Most "the policy doesn't work" threads are propagation impatience.

Frontrow covered the April 2026 change that first gave admins a supported uninstall path in its update note at /insights/copilot-april-2026-australia-updates; this runbook is the full-fleet version of that advice. The one decision the tooling cannot make is who should keep the paid experience, which is a licensing question, not a policy one.