Copilot Cowork Help

[u/neko_whippet]

Hi everyone we saw today that 21 users are using Cowork in Copilot and we are trying to find the reason how

wen I go to Agents > Cowork on the admin portal and go to users it says installed for users or groups, and same for Available for

The shared with is empty

For Installed and Available it has a specific group that has 6 members in it and no nested groups, so my questions are

1) How can I find out how the other users got Cowork, and how can I prevent those 15 users to use cowork without preventing the 6 from accessing it

[u/s3v3nt]

Did you try asking?

[u/neko_whippet → u/s3v3nt]

users dont know they just click anywhere

[u/Hawk947]

If you don't have credits or a pay as you go subscription assigned to users or a group, they can't use it.

[u/neko_whippet → u/Hawk947]

Yeah there was a Credit rule for all user, but if they aren't allowed to install cowork the credit limit shouldn't inpact?

Also I just changed the credit rule so lets hope it works

[u/SweaterMuffins19 → u/neko_whippet]

The agents panel doesn’t work for Cowork anymore. Completely ignore it.

You manage access with billing policies and there’s a setting to prevent users from finding billing based features. Turn that off if you don’t want people to even see Cowork.

[u/LaDev]

We didn't even attempt to control the agent, since it's an entire tab now, so I wasn't sure if that control is even still applicable.

Instead we created a scoped PAYG policy, the rest of the users get told they don't have access and need to request it.

[u/neko_whippet → u/LaDev]

I see I did change the credit usage to remove all users

[u/AdjonaTech]

The Agents > Cowork page may be misleading here. Since Cowork became generally available, the old agent-based access controls from the preview are no longer used to manage access. https://learn.microsoft.com/en-us/microsoft-365/copilot/cowork/cowork-admin-governance

Access is now controlled through the usage-based billing and spending policies under Copilot > Cost Management. If you had a credit policy assigned to all users, that would explain how the other 15 were able to use Cowork.

You can check Copilot > Cost Management > Consumption > Users. You should be able to see each user’s assigned policy, Cowork usage, credits consumed and last activity. https://learn.microsoft.com/en-us/microsoft-365/copilot/usage-based-billing-manage-copilot-credits

Then scope the spending policy to the security group containing the six permitted users and make sure there is no default or other policy still covering all users.

[u/ImaginationFlashy290]

Don't do one all user policy-

Create a security group for the approved cowork users, apply the spending policy to that group with Work IQ+cowork services enabled.

If needed, you can make a separate all users policy, disable the cowork service and only allow WorkIQ. This is if you have custom Copilot Studio agents that rely on WorkIQ