M365 - Allow CoPilot for 13+ students

[mikkydoos]

Hi all,

 

We want to enable allowing CoPilot chat for students years 9-13.

 

The only meaningful thing I can find to allow it is downloading a spreadsheet of users and updating the age field in their Azure user...  setting to NotMinor.

I've done this manually with a couple of users and it still won't let them access.

 

Preferably I'd like set an attribute with our MIS sync to set the age.

 

 

Has anyone done this successfully... ?

 

If so,   how?

 

 

 

Cheers in advance     

[MYK-IT]

Our students are part of associated year-based security groups which helps when assigning the Azure attributes (to be automated using SalamanderSoft moving forwards).

 

Essentially, you need to set:

 

Age Group = NotAdult

Consent Provided for Minor = Granted

 

I had this set, waited but students could still not access Copilot Chat via https://copilot.microsoft.com (e.g. Your education account .. is not yet supported).

 

Then someone from Microsoft EDU suggested going via https://office.com and it works...

 

Another issue i have noted, is if you use web-based Outlook https://outlook.com , the left hand shortcut bar (which shows calendar, people etc) has Copilot icon.. which when you click appears to be Copilot Chat (sometimes it actually displays it is) but it's not! As we found out when someone wanted an image generated and it failed due to not being licensed for Copilot - plus an "Upgrade Copilot" prompt appears top right!)

 

You may also have to check Microsoft 365 Admin Centre > Copilot Settings and check the various settings and permissions - specially "Allow Copilot access for your users")

 

Not sure if this helps... but hopefully so!

Edited June 3 by MYK-IT

[MYK-IT]

Couldn't edit my original reply. but just wanted to add that direct URL is https://m365.cloud.microsoft/chat

Edited June 9 by MYK-IT

[mikkydoos]

Thanks @MYK-IT

 

How are you actually setting the properties for:

 

Age Group = NotAdult

Consent Provided for Minor = Granted

 

Is this via Salamander ?

 

I can't see how you would set this via security group membership.

 

 

 

 

 

[MYK-IT]

5 minutes ago, mikkydoos said:

Thanks @MYK-IT

 

How are you actually setting the properties for:

 

Age Group = NotAdult

Consent Provided for Minor = Granted

 

Is this via Salamander ?

 

I can't see how you would set this via security group membership.

 

 

 

 

 

Hi @mikkydoos,

 

Currently, I've set the user properties via a PowerShell script. I've run once for all existing students, then only will need to execute again if a new student starts mid-term etc.(if not automated via Salamander by then!)

 

For example,

 

Quote

 

Connect-MgGraph -Scopes User.ReadWrite.All, Group.Read.All -UseDeviceCode

 

# Year 7 → Minor
$year7 = Get-MgGroup -Filter "displayName eq 'Year 7 Pupils'"
$members7 = Get-MgGroupMember -GroupId $year7.Id -All

foreach ($user in $members7) {
    Update-MgUser -UserId $user.Id -AgeGroup "Minor"
}

 

# Year 9 → NotAdult
$year9 = Get-MgGroup -Filter "displayName eq 'Year 9 Pupils'"
$members9 = Get-MgGroupMember -GroupId $year9.Id -All

foreach ($user in $members9) {
    Update-MgUser -UserId $user.Id -AgeGroup "NotAdult"
}

 

 

 

[mikkydoos]

Thats great. Thanks @MYK-IT

[mikkydoos]

I'm syncing with Locker. Support have given me an automated solution.

[Bumhug360]

Do you have active directory running on a DC? If so it can take up to a week for ages to sync correctly even though you have set it up in Azure. This drove us to the point of insanity before we found it

[mikkydoos]

Cheers @Bumhug360

 

 

We do.  Anything else I need to do ?

 

Does this need setting up on the AD side in Locker too ?

 

 

 

 

[Bumhug360]

Way we have done it is PowerShell script, students are in a security group for their intake year so we set everyone in that group to NotAdult which worked for us, then set new users manually which isn't ideal

 

Import-Module ActiveDirectory
Import-Module Microsoft.Graph.Users
 
$GroupDN = "CN=groupname ,OU=,DC=,"
 
$adUsers = Get-ADGroupMember -Identity $GroupDN -Recursive |
  Where-Object { $_.objectClass -eq 'user' } |
  ForEach-Object {
      Get-ADUser $_.DistinguishedName -Properties UserPrincipalName, SamAccountName
   }
 
foreach ($adUser in $adUsers) {
   $upn = $adUser.UserPrincipalName
 
   if ([string]::IsNullOrWhiteSpace($upn)) {
      Write-Warning "Skipping $($adUser.SamAccountName) - no UPN"
      continue
   }
 
   try {
      Update-MgUser -UserId $upn -AgeGroup "NotAdult"
      Write-Host "Updated $upn"
   }
   catch {
      Write-Warning "Failed for $upn"
   }
}

 

[mikkydoos]

Where does the AD side of it apply ?

 

 

 

[Bumhug360]

It doesn't. Its hard to explain as it makes no sense 🤪

 

ageGroup cannot be set in AD, it can only be set via Entra. If the account is cloud only the changes work instantly, if the account is AD based it can take a few days for the change to kick in. Why? Good question, you are using cloud based tools that are authenticating via Entra so the fact that the account is managed via AD should make no difference at all, yet for some reason after a few days it will just work.

 

It drove us mad trying to get this to work, months of trying different things all appearing to make no difference at all, we would even leave it over night and no change following morning, then for no reason and when all the settings would say it shouldn't work it would start working, couple hours later it wouldn't be working again. Documentation on this is very poor, chatgpt was what tipped us off to the up to 7 days though cant seem to track a source for it. We ran the script before a half term, when kids came back it was all working

[mikkydoos]

Thanks @Bumhug360

 

That makes sense (or not  )

 

I ran this yesterday so I'll check throughout the week.