Blocking Co Pilot for Students under 13

[loxford01]

Is there a way to possibly to block Co Pilot for students under 13, supposedly in year 7/8 in Microsoft 365 admin center? 

[psydii]

Start here: Microsoft 365 Copilot Chat for Students 13+ | Microsoft Community Hub

[Davit2005]

Licensing options?

 

Years back I used to license users with a script and it was possible to limit applications that way. You could then have for instance banned users and jus allocate to a AD group for more control if needed.

Edited September 3, 2025 by Davit2005

[loxford01]

I've run some PS scripts to change under 13 accounts in entra ID to minor and it does block co pilot but then also prevents these students from logging into office.com and using other services linked to their account like Onedrive, Satchel, Teams etc, effectively making the account unusable for normal school work. So the minor setting is not a practical solution, and we've had to revert all under 13 accounts back to nonadult so they can continue to use office 365. We may have to now block co pilot url through our web filtering for these students instead. Microsoft need to offer a better workaround that doesnt block other 365 apps. 

This might be helpful for other 365 tenants who are thinking of blocking co pilot for minors. 
 

[Max_Power]

We found the way to do it was to allow access for students old enough rather than block for those not old enough.

 

In Entra we use "Age Group" and "Legal age group classification" properties under 'Parental controls' and set to NotAdult - which equals 13-18 years old.

We set this for pupils in year 9 and above which gives them access to Copilot. 

 

For all other year groups we leave this unconfigured and therefore it doesn't provide access to Copilot and their accounts continue to work as normal for everything else. 

[loxford01]

Thanks, will try that as a workaround. Does this also then block the following co pilot URLs for under 13? Edge browser also has the co pilot icon and can initiate a chat for students so need to look at GPO to block this as well. Microsoft guidance aint helpful 

 

m365.cloud.microsoft/chat

copilot.microsoft.com/chats

copilot.cloud.microsoft

copilot.microsoft.com

[MYK-IT]

On 09/09/2025 at 13:01, loxford01 said:

I've run some PS scripts to change under 13 accounts in entra ID to minor and it does block co pilot but then also prevents these students from logging into office.com and using other services linked to their account like Onedrive, Satchel, Teams etc, effectively making the account unusable for normal school work. So the minor setting is not a practical solution, and we've had to revert all under 13 accounts back to nonadult so they can continue to use office 365. We may have to now block co pilot url through our web filtering for these students instead. Microsoft need to offer a better workaround that doesnt block other 365 apps. 

This might be helpful for other 365 tenants who are thinking of blocking co pilot for minors. 
 

All our students are currently set as Minor, but can access Office 365 - perhaps you need to check the MinorWithParentalConsent field / value

 

Our students are currently as follows; with plans to update Year 9 upwards.

 

Age group - Minor
Consent provided for minor - Granted
Legal age group classification - MinorWithParentalConsent

 

user resource type - Microsoft Graph v1.0 | Microsoft Learn

 

Must admit, we're going through the Copilot / Copilot Chat and Ai Policy minefield too! And you can still access/use Copilot without signing in altogether! (with limitations).

Edited September 10, 2025 by MYK-IT

[loxford01]

Yes, I just figured that out with the PS script. The minor with parent consent has also now worked for us, and now they can access 365 but with Copilot blocked. I agree its a pain going through each block and then a year later will have to revert the changes when they are 13. It would have just been easier to have an entra global option for this rather than play around with scripts. 

[mavhc]

Get-mgUser -All | Where-Object -FilterScript { ($_.JobTitle -eq 'Student') -and ($_.DisplayName -match 'something')} | ForEach-Object { update-mgUser -userid $_.Id -AgeGroup 'NotAdult' -ConsentProvidedForMinor 'NotRequired' }

[saintoctopus]

Hello - I'm trying to set our 13+ to have access to CoPilot - how long after setting the NotAdult property does it trickle through?

[mavhc]

It's The Cloud, no one knows if you're in a queue or it's failed. But probably <24 hours

[Publisher2519]

Please check this 

 

Edited October 20, 2025 by Publisher2519

[5tu]

On 10/09/2025 at 14:46, MYK-IT said:

All our students are currently set as Minor, but can access Office 365 - perhaps you need to check the MinorWithParentalConsent field / value

 

Our students are currently as follows; with plans to update Year 9 upwards.

 

Age group - Minor
Consent provided for minor - Granted
Legal age group classification - MinorWithParentalConsent

 

user resource type - Microsoft Graph v1.0 | Microsoft Learn

 

Must admit, we're going through the Copilot / Copilot Chat and Ai Policy minefield too! And you can still access/use Copilot without signing in altogether! (with limitations).

 

Just looking at this now myself.  Thought I'd test a couple of student accounts by manually applying settings in Entra before rolling out org wide via Powershell, but.... on our tenancy the "Consent provided for minor" drop down is greyed out on all Entra user accounts.  Anyone else seeing the same?

 

 

[mavhc]

On 22/10/2025 at 15:48, 5tu said:

 

Just looking at this now myself.  Thought I'd test a couple of student accounts by manually applying settings in Entra before rolling out org wide via Powershell, but.... on our tenancy the "Consent provided for minor" drop down is greyed out on all Entra user accounts.  Anyone else seeing the same?

 

 

What happens if you pick an age group?

[loxford01]

I had the same greyed out. The only way around it is to apply through PowerShell scripts. Test it on a few before rolling out to all students. 

 

Minor with consent granted 

# Import CSV with Year 7 & 8 usernames
$students = Import-Csv "E:\scripts\Year7_8_Students.csv"

foreach ($student in $students) {
    try {
        # Set AgeGroup to Minor and grant consent for Microsoft services
        Update-MgUser -UserId $student.UserPrincipalName `
            -AgeGroup "Minor" `
            -ConsentProvidedForMinor "granted"

        Write-Host "✅ Updated $($student.UserPrincipalName) → Minor (Consent Granted)"
    }
    catch {
        Write-Warning "❌ Failed to update $($student.UserPrincipalName): $_"
    }
}

[5tu]

On 24/10/2025 at 20:55, mavhc said:

What happens if you pick an age group?

 

Remains greyed out @mavhc

 

Thanks for the script @loxford01

[Dipl0]

Hey guys, 

 

Thought I'd give me 2 cents and then ask for some help! So firstly you need to set your tenant as K12. I did try the powershell script that Microsoft suggest you're supposed to use but that just wasn't playing ball and then I came across some articles referring to how I couldn't run it that way with edu tenants...I mean that makes no sense but moving on. In the end you can actually go to Admin Center > Org Settings > Microsoft Education Tenant Identifier and set this to your type of institution. Do be aware that if you select K-12, if you haven't set the age group or consent it will block office.com and copilot for everyone. With K12 the default is block unless consented. Higher is allowed unless under the age group or not consented. Other I'm not sure on.

 

Anyway so I had a play with my test account. At first I could set as Minor which would block office.com and copilot, if I consented it would allow copilot and office.com so I was getting a bit annoyed. Overnight however, I set the account this morning to Minor and Consent Granted which seemed to allow office.com but block copilot. Hazzah! I scripted it and put all yr 7/8s to be "AgeGroup Minor" and "ConsentProvidedForMinor" to be Granted. (Our AUP includes consent for 365 services but not copilot). 

 

The below code works but I did realise I haven't put logging and when it errors it still spits out "Updated agegroup" even though it hasn't so just be aware of that. The CSV but have userPrincipalName, AgeGroup and Consent as the headers if you want to use my exact script.

 

$users=Import-Csv ".\StudentsAgeGroups.csv"

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "User.ReadWrite.All","Directory.ReadWrite.All"

foreach ($user in $users) {
    $userPrincipalName = $user.UserPrincipalName
    $ageGroup = $user.AgeGroup
    $Consent = $user.Consent
    try {
        # Update the AgeGroup attribute
        Update-mguser -UserID $userPrincipalName -AgeGroup $ageGroup -ConsentProvidedForMinor $Consent
        Write-Output "Updated AgeGroup for user: $userPrincipalName to $ageGroup"
    } catch {
        Write-Output "Failed to update AgeGroup for user: $userPrincipalName. Error: $_"
    }
}

 

 Now this is where I'm stuck. 

 

For Year 9+ we want copilot available. So for them I did what's suggested which is made their agegroup "NotAdult" (Essentially 13-17 Year olds) and set consent to None, as that's specifically consent for minors so didn't seem relevant. 

 

Now they can access office.com but copilot is still showing as "Coming Soon".

 

So my thinking is 1 of 3 things. 

1. Wait

2. Changing the tenant identifier has also disabled copilot somehow

3. I'm missing something else that needs to be added.

 

I'd really appreciate some insight into how you've resolved this! This has been an absolutely minefield with Microsofts advice not working and having to rethink the solution!

[loxford01]

2 hours ago, Dipl0 said:

Hey guys, 

 

Thought I'd give me 2 cents and then ask for some help! So firstly you need to set your tenant as K12. I did try the powershell script that Microsoft suggest you're supposed to use but that just wasn't playing ball and then I came across some articles referring to how I couldn't run it that way with edu tenants...I mean that makes no sense but moving on. In the end you can actually go to Admin Center > Org Settings > Microsoft Education Tenant Identifier and set this to your type of institution. Do be aware that if you select K-12, if you haven't set the age group or consent it will block office.com and copilot for everyone. With K12 the default is block unless consented. Higher is allowed unless under the age group or not consented. Other I'm not sure on.

 

Anyway so I had a play with my test account. At first I could set as Minor which would block office.com and copilot, if I consented it would allow copilot and office.com so I was getting a bit annoyed. Overnight however, I set the account this morning to Minor and Consent Granted which seemed to allow office.com but block copilot. Hazzah! I scripted it and put all yr 7/8s to be "AgeGroup Minor" and "ConsentProvidedForMinor" to be Granted. (Our AUP includes consent for 365 services but not copilot). 

 

The below code works but I did realise I haven't put logging and when it errors it still spits out "Updated agegroup" even though it hasn't so just be aware of that. The CSV but have userPrincipalName, AgeGroup and Consent as the headers if you want to use my exact script.

 

$users=Import-Csv ".\StudentsAgeGroups.csv"

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "User.ReadWrite.All","Directory.ReadWrite.All"

foreach ($user in $users) {
    $userPrincipalName = $user.UserPrincipalName
    $ageGroup = $user.AgeGroup
    $Consent = $user.Consent
    try {
        # Update the AgeGroup attribute
        Update-mguser -UserID $userPrincipalName -AgeGroup $ageGroup -ConsentProvidedForMinor $Consent
        Write-Output "Updated AgeGroup for user: $userPrincipalName to $ageGroup"
    } catch {
        Write-Output "Failed to update AgeGroup for user: $userPrincipalName. Error: $_"
    }
}

 

 Now this is where I'm stuck. 

 

For Year 9+ we want copilot available. So for them I did what's suggested which is made their agegroup "NotAdult" (Essentially 13-17 Year olds) and set consent to None, as that's specifically consent for minors so didn't seem relevant. 

 

Now they can access office.com but copilot is still showing as "Coming Soon".

 

So my thinking is 1 of 3 things. 

1. Wait

2. Changing the tenant identifier has also disabled copilot somehow

3. I'm missing something else that needs to be added.

 

I'd really appreciate some insight into how you've resolved this! This has been an absolutely minefield with Microsofts advice not working and having to rethink the solution!

We have left year 9 and above Age Groups set to None. You can try NonAdult with Consent granted and that might enable co pilot for year 9 and above. 

[5tu]

 

 

This IT Admin-focused workshop walks through how to configure Microsoft 365 Copilot Chat, from your tenant all the way to the end-user experience. We cover the latest features now available — including the new 13+ student configuration options, CSV, SDS and Powershell uploads, Copilot agents & extensibility, and updated licensing & security controls. By the end, you’ll be able to confidently deploy, manage, and optimize Copilot Chat in your environment so your users can safely harness AI productivity from day one.

Edited December 10, 2025 by 5tu

[DrCheese]

On 05/12/2025 at 11:23, Dipl0 said:

Now they can access office.com but copilot is still showing as "Coming Soon".

 

Same here - Students set to "Not adult" but seems to be stuck on this. Edu Tenant type is K12 so.. it should just work. Did you find a solution at all?

[Dipl0]

3 hours ago, DrCheese said:

 

Same here - Students set to "Not adult" but seems to be stuck on this. Edu Tenant type is K12 so.. it should just work. Did you find a solution at all?

Yeah the solution was waiting...of course it was...basically Thursday afternoon I enabled the K12 switch. Was still working fine. Overnight it synced and blocked all access. 

 

Friday I put in place year 7/8 minor and Consent Granted (this is important as without this it blocks the office.com app page) and non adult for all other years. 

 

Nothing happened, come Monday it was all working perfectly...

 

The Microsoft Minute Strikes again. 

[Dipl0]

On 05/12/2025 at 14:08, loxford01 said:

We have left year 9 and above Age Groups set to None. You can try NonAdult with Consent granted and that might enable co pilot for year 9 and above. 

Only issue with this is that it likely means your tenant identifier isn't set meaning in theory if someone slips through the net they will have access to copilot. 

 

Also might also be worth noting that by using the K12 identifier and classifying your students as non adult they are set to more tighter data control, no data sharing and their inputs aren't used to train the AI. I'll try and find the Microsoft article that showed that. 

 

It's probably worth doing to tick an extra box and it seems they're using that identifier in other ways to protect underage students data.