How to Enable and Manage the Copilot Icon in SharePoint Online: A Complete Admin Guide

Copilot in SharePoint shows up as an agent icon in the SharePoint global header. From there, users can ask questions, summarise content, and create pages, lists and files using natural language. This guide covers every control that decides whether the icon appears, what it opens, and who manages it, at the tenant, site and user levels.

The Control Layers at a Glance

Layer	Control	Who manages it	Tool	Effect on the icon
User	Microsoft 365 Copilot license (M365_COPILOT_SHAREPOINT service plan)	License admin	M365 admin center / Graph PowerShell	No license, no icon
Tenant	KnowledgeAgentScope + selected sites list	SharePoint admin	PowerShell only	Decides which sites get Copilot (honoured until 1 Nov 2026)
Site	Restricted Content Discovery (RCD)	SharePoint admin (can be delegated)	SharePoint admin center / PowerShell	RCD On = Copilot and AI actions hidden on that site
Site	Site AI settings	Site owner	Site → Settings → Site AI	Chooses the agent behind the icon and can hide Copilot for visitors

Rule of thumb: the icon appears only when every layer allows it. A user-level "yes" can't override a site-level "no".

Prerequisites

Requirement	Detail
License	An active Microsoft 365 Copilot license. Everyday Copilot in SharePoint capabilities are included, and users don't need a separate opt-in.
Admin role	SharePoint Administrator for tenant and RCD settings. Site owner for Site AI settings.
Module	SharePoint Online Management Shell 16.0.26615.12013 or later
Cloud	Not currently supported in GCC, GCC High, DoD, air-gapped clouds, or Microsoft 365 operated by 21Vianet
Advanced work (optional)	Usage-based billing with Copilot Credits, set up through a spending policy in the M365 admin center

Step 1 – Assign and Verify the License

Assign the Microsoft 365 Copilot license in the M365 admin center, then confirm the SharePoint service plan is active:

Connect-MgGraph -Scopes "User.Read.All" -NoWelcome
$upn = "user@contoso.com"
Get-MgUserLicenseDetail -UserId $upn | ForEach-Object {
    $_.ServicePlans | Where-Object { $_.ServicePlanId -eq "0aedf20c-091d-420b-aadf-30c042609612" }
} | Select-Object ServicePlanName, ProvisioningStatus

Expected result: M365_COPILOT_SHAREPOINT → Success.

Step 2 – Enable Copilot at the Tenant Level (PowerShell)

There's no admin-center UI for this control. Connect from Windows PowerShell 5.1:

Connect-SPOService -Url https://contoso-admin.sharepoint.com
Get-SPOTenant | Select-Object KnowledgeAgentScope, KnowledgeAgentSelectedSitesList

Scope value	Meaning	Best for
NoSites (default)	Off on every site	Tenants not ready to roll out
IncludeSelectedSites	On only for listed sites (allow-list)	Pilots and phased rollouts
ExcludeSelectedSites	On everywhere except listed sites (block-list)	Broad rollout with a few sensitive sites held back
AllSites	On everywhere	Full rollout

Option A – Enable on All Sites

Set-SPOTenant -KnowledgeAgentScope AllSites
Get-SPOTenant | Select-Object KnowledgeAgentScope

Option B – Pilot on Selected Sites (Allow-List)

Set-SPOTenant -KnowledgeAgentScope IncludeSelectedSites

# Initial list
Set-SPOTenant -KnowledgeAgentSelectedSitesList @(
    "https://contoso.sharepoint.com/sites/Engineering",
    "https://contoso.sharepoint.com/sites/HRPortal"
)

# Add more sites later - always use Append
Set-SPOTenant -KnowledgeAgentSelectedSitesList @("https://contoso.sharepoint.com/sites/Marketing") `
              -KnowledgeAgentSelectedSitesListOperation Append

Option C – Enable Everywhere Except Sensitive Sites (Block-List)

Set-SPOTenant -KnowledgeAgentScope ExcludeSelectedSites
Set-SPOTenant -KnowledgeAgentSelectedSitesList @("https://contoso.sharepoint.com/sites/Finance")

Turn It Off for the Whole Tenant

Set-SPOTenant -KnowledgeAgentScope NoSites

Managing the Sites List Safely

Operation	Effect
Overwrite (default)	Replaces the entire list
Append	Adds sites to the existing list
Remove	Removes sites from the existing list

Gotchas:

• Because the default operation is Overwrite, running Set-SPOTenant -KnowledgeAgentSelectedSitesList "url" without Append wipes every other site from the list.
• The list can't hold more than 100 site URLs.
• The list parameter only works when the scope is IncludeSelectedSites or ExcludeSelectedSites.
• In multi-geo tenants, run the commands in each geo.

# Always back up before changing the list
$list = (Get-SPOTenant).KnowledgeAgentSelectedSitesList
$list | Out-File .\KnowledgeAgentSites_backup.txt
$list.Count
$list -contains "https://contoso.sharepoint.com/sites/Engineering"

Step 3 – Control a Single Site with Restricted Content Discovery

RCD is a site-level switch. When it's On, Copilot in SharePoint and AI actions don't appear on the site, whatever the other settings are. Site permissions stay the same.

UI: SharePoint admin center → Sites → Active sites → select the site → Settings tab → Restrict content discovery → On/Off → Save.

# Check
Get-SPOSite -Identity https://contoso.sharepoint.com/sites/Finance | Select-Object RestrictContentOrgWideSearch

# Hide Copilot on the site
Set-SPOSite -Identity https://contoso.sharepoint.com/sites/Finance -RestrictContentOrgWideSearch $true

# Show Copilot again
Set-SPOSite -Identity https://contoso.sharepoint.com/sites/Finance -RestrictContentOrgWideSearch $false

Tips:

• For many sites at once, use Reports → Catalog management → Actions to apply RCD to catalog groups in bulk.
• To let site admins manage RCD themselves, run Set-SPOTenant -DelegateRestrictedContentDiscoverabilityManagement $true. They'll need to give a justification for each change.
• Changes take time to propagate, especially on large sites.

Step 4 – Manage the Icon as a Site Owner (Site AI Settings)

Go to the site → Settings (gear) → Site AI.

Setting	What it does	When to use it
Main agent	Chooses what opens from the header icon: Copilot in SharePoint or a custom site agent	Point visitors to a curated agent, such as a training or policy assistant
Hide Copilot for visitors	Hides the Copilot button on site pages for visitors only. Owners and members still see it.	Read-only portals and intranet landing pages
Advanced document processing / autofill	Shares Copilot Credits with the site for advanced autofill columns and faster processing	Libraries that need metadata extraction at scale

Tip: if you choose a custom agent, keep its .agent file in a stable library and make sure visitors can read it. If the file is moved or deleted, the header icon has nothing to open.

Step 5 – Verify with a Read-Only Script

param(
    [Parameter(Mandatory)] [string]$AdminUrl,
    [Parameter(Mandatory)] [string]$SiteUrl
)

$SiteUrl = $SiteUrl.TrimEnd('/')
Connect-SPOService -Url $AdminUrl
$tenant = Get-SPOTenant
$site   = Get-SPOSite -Identity $SiteUrl
$inList = ($tenant.KnowledgeAgentSelectedSitesList | ForEach-Object { $_.TrimEnd('/') }) -contains $SiteUrl

switch ($tenant.KnowledgeAgentScope) {
    "AllSites"             { $scopeOk = $true }
    "IncludeSelectedSites" { $scopeOk = $inList }
    "ExcludeSelectedSites" { $scopeOk = -not $inList }
    default                { $scopeOk = $false }
}

if ($scopeOk -and -not $site.RestrictContentOrgWideSearch) {
    $status = "Copilot icon enabled for licensed users"
} else {
    $status = "Copilot icon hidden - review tenant scope or RCD"
}

[pscustomobject]@{
    TenantScope              = $tenant.KnowledgeAgentScope
    SiteInSelectedList       = $inList
    RestrictContentDiscovery = $site.RestrictContentOrgWideSearch
    Status                   = $status
} | Format-List

PowerShell Connection Tips

Symptom	Fix
NativeInterop.API threw an exception / No valid OAuth 2.0 authentication session exists	Run the module in Windows PowerShell 5.1, opened from the Start menu, not from inside PowerShell 7
Module installed but "no valid module file was found"	Use Save-Module -Path C:\PSMods, then import the .psd1 by its full path
A parameter cannot be found that matches 'KnowledgeAgentScope'	Remove old module versions and install the latest

Important: What Changes After 1 November 2026

With Copilot in SharePoint now generally available, Microsoft is retiring the preview-era PowerShell controls (KnowledgeAgentScope, KnowledgeAgentSelectedSitesList, KnowledgeAgentSelectedSitesListOperation).

Period	How availability is managed
Until 1 Nov 2026	Tenant PowerShell scope + RCD + Site AI settings
After 1 Nov 2026	Site AI settings + Restricted Content Discovery only

Migration checklist:

1. Export your current scope and sites list.
2. If you use an allow-list, find the sites outside it that must stay hidden, and apply RCD to them before the cut-off.
3. If you use a block-list, apply RCD to every site on it.
4. Brief site owners on the Site AI panel, since they now control the header agent.
5. Review Copilot Credits spending policies if you plan to use advanced work.

Recommended Management Model

Goal	Use
Roll Copilot out to everyone	License + leave RCD Off
Hide Copilot on sensitive sites	RCD On (bulk through Catalog management)
Keep a portal clean for visitors	Site AI → hide Copilot for visitors
Show a curated assistant	Site AI → Main agent = custom agent
Allow large-scale AI work	Spending policy with Copilot Credits

References

• Get started with Copilot in SharePoint
• Restrict discovery of SharePoint sites and content
• Manage access to agents in SharePoint
• Set-SPOTenant
• Microsoft Copilot service plans

Disclaimer: This article is for educational purposes. All tenant names, URLs and accounts are illustrative (contoso). Test changes in a non-production tenant and follow your organisation's change process.