AdamFowlerIT.com

I’ve been looking at the recent announcement that the Microsoft 365 Copilot app is being renamed to the Microsoft Copilot app, along with the ability to use both work and personal accounts from the same application.

As I posted on LinkedIn:

Microsoft is doing to Copilot what they did to Teams – bring the personal (consumer) and work versions into a single app.

As per Message Center MC1454108 – The Microsoft 365 Copilot App will be renamed the Microsoft Copilot app.

Before this app rename, the ability to pick both personal and work accounts from the one app has gone live (for me at least), the hint on this was seeing ‘Work’ next to my account on the bottom left.

The app experience is different to Teams currently, where Teams will open a second window with the other account. Copilot however, closes off the window/account completely and reloads with the newly selected account. There appears to be a few bugs around account management so we’ll see if this experience changes.

The other big catch here is personal Copilot can now be accessed via https://copilot.cloud.microsoft/ – so if you’re blocking copilot.microsoft.com etc via these instructions https://learn.microsoft.com/en-us/copilot/manage#how-to-ensure-users-access-copilot-chat you’ll need to ensure you’re blocking it using ‘Tenant Restrictions’ – read the MC article for administrator advice!

For me at least, the account switching experience is already live. The first hint was seeing “Work” appear next to my account in the bottom left of the application. Unlike Teams, which happily opens another window when switching between work and personal accounts, Copilot completely unloads the current account and reloads the application against the selected identity.

There’s still a few rough edges around account switching, but that’s not what caught my attention. The line that interested me from the Message Center article was:

Admins can continue to limit Microsoft account (personal) access to the Copilot app using Tenant Restrictions.

On the surface that sounds simple enough. Organisations that don’t want users accessing consumer Copilot can use Tenant Restrictions and carry on as normal.

The more I thought about it though, the less obvious it became how Microsoft expects this to work and I didn’t really know anything about what Tenant Restrictions actually were.

Tenant Restrictions aren’t a Copilot control

Historically, Tenant Restrictions have been an identity control. They’re used to control where users can authenticate, and which tenants they can access from managed devices and networks. They are not a Copilot-specific setting, nor is there much granual app defining.

Now that Microsoft is merging the work and personal experiences into a single application, what does “limit Microsoft account (personal) access” actually mean in practice? Is the Copilot application itself checking Tenant Restrictions and preventing the account from being added?

The Message Center post doesn’t really explain the mechanics behind it, so I started learning about tenant restrictions, and testing.

What I found

After some testing, it appears there is more involved than simply enabling Tenant Restrictions. Frustratingly, when I asked M365 Admin Center Copilot for Message Center around how to do this, it described a way to achieve this using Conditional Access – by using an ‘Account Type’ field and defining that as a Microsoft Account. Sadly this doesn’t actually exist after I attempted recreating the steps it described, which a different Copilot confirmed for me.

The scenarios covered by Tenant Restrictions are listed here – Copilot isn’t mentioned, but “Authentication and data plane protection for Microsoft tenant or consumer accounts” is. A scenario that isn’t supported is “Per-user tenant restrictions for Microsoft accounts.” – so if you want to be more granular than blocking all consumer accounts, you’re out of luck.

The actual steps as far as I can work out are:

1. Create a Tenant Restriction in Entra, that defines the ‘Microsoft Account’ tenant by using it’s GUID 9188040d-6c67-4c5b-b112-36a304b66dad, and block access to it. The steps for this are laid out at Configure Tenant Restrictions – Microsoft Entra ID – Microsoft Entra External ID | Microsoft Learn

2. As per the documented “Tenant restrictions v2 on the client side“, you need clients to obey the configured tenant restriction. There are multiple methods of achieving this:

Option 1: Use universal tenant restrictions v2 as part of Microsoft Entra Global Secure Access. Included in Entra Suite, which is included in Microsoft 365 E5 licensing now, is the first barrier. The second barrier is actually adopting and rolling out Global Secure Access which is a rather large project to take on just to protect from this scenario. If you’re already onboard great, you probably just need to turn on or configure Global Secure Access and Universal Tenant Restrictions – Global Secure Access | Microsoft Learn and you’re done.

Option 2: Set up tenant restrictions v2 on your corporate proxy. For companies actually using a proxy, this seems to be just blocking the sign in URLs used by Microsoft Accounts, maybe with an element of finding those URLs in header requests too. I didn’t think we’d be going into the depths of the network traffic world to solve this scenario, but it seems complex and again doesn’t just target Copilot. A user logging into Hotmail is out, for example.

Option 3: Enable tenant restrictions on Windows-managed devices (preview). Moving on from the point that this is only in preview, this is where Intune or Group Policy can set a registry setting to define the tenant the device sits in, and list any tenants to block. Another scenario that doesn’t cover unmanaged devices, and I don’t have a Mac to see how that side of it would work when deploying settings via Intune, but this one I can actually try without requiring the complexity of options 1 and 2.

I thought my group policy poking around days were long gone, but under Computer Configuration > Administrative Templates > Windows Components > Tenant Restrictions is a single option called Cloud Policy Details. Here you define your own Azure AD Directory ID (someone add this to your list to update to Entra ID!) and the Policy GUID, which is obtained from the first step once you’ve added the Microsoft Accounts tenant in Entra.

Once those controls were in place, the personal account sign-in started failing. Instead of receiving a friendly message explaining why access was blocked, applications would start hitting authentication loops, throwing generic sign-in errors and repeatedly prompting for credentials.

The Copilot app behaved in much the same way, although I could sometimes get a prompt in between sign-in windows.

The end result was that the account couldn’t successfully authenticate, but the experience didn’t feel like a deliberate block. It felt more like authentication was breaking somewhere along the way.

So what is actually happening?

M365 Copilot and Copilot Chat appears to no longer have any native ability to prevent consumer access in what was once an enterprise only application, since the Copilot app also exists and served that purpose.

Instead, Copilot relies on the underlying Microsoft identity platform. When those identity controls prevent authentication, Copilot simply inherits whatever behaviour occurs when sign-in fails.

If that’s what’s happening, Microsoft’s statement is technically correct. Tenant Restrictions can be used to limit access to personal accounts in the Copilot app. What I’m less convinced about is whether administrators reading that statement would understand the controls involved, or the unfriendly user experience that currently results from them.

I am sure this space will evolve and change rapidly, but it is a new risk that has been introduced and to be aware of.

Quick one today – if you are trying to configure a spending policy for Copilot Cowork and see the error ‘Failed to assign Contributor on /subscriptions/… Request failed with status 403, this thankfully isn’t too cryptic in what it needs – the user performing this request needs to have at least Contributor access on the Azure Subscription that the policy is pointing to.

Microsoft have a tutorial on how to grant this here: https://learn.microsoft.com/en-us/azure/role-based-access-control/quickstart-assign-role-user-portal

During my testing, this applied when there was an existing spending policy already created by someone else, and other user wanted to make changes.

Giving a user the AI Administrator role should allow a user to create/modify spending policies and avoid the above issue as per https://learn.microsoft.com/en-us/microsoft-365/copilot/usage-based-billing-manage-copilot-credits:

Global administrator and Billing administrator roles have access to add, select, and change billing methods, and set billing methods in policies.

AI administrator and License administrator roles have access to create spending policies, manage limits and alerts, and view the Cost management dashboard. They can’t set or modify the billing method.

… but despite an account having AI Administrator, I still ran into the issue. On top of this, the Cowork Copilot Settings deployment essentials advised there was no AI Administrator role in the org, yet when using the ‘Review and assign role’ button it then showed that I did in fact, have AI Administrator. Despite refreshing it didn’t update the 0 value for ‘AI Administrators in your org’ and had waited 24 hours already, so there appears to be a few bugs around in the early days of this release.

… and probably other Samsung / Android phones.

There’s varied information online around how to do this and it’s often missing a key aspect. Here’s the steps that worked for me when wanting to do a factory reset of a Samsung A70 when I didn’t have the password of the Samsung account signed in:

1. Phone starts in an on state.

2. Plug in the phone to a PC via USB. Without this, I couldn’t get this to work. I didn’t have to install any software but did get the Windows USB ‘ding’ sound

3. Power off the phone. Doesn’t matter if you hold volume down + power, or hold power and press the ‘Power off’ option on screen – just get the phone to a full ‘off’ state.

4. While holding the Volume Up button, also hold down the power button. The first Samsung splash screen should show, and before it gets to the second (that would normally just say SAMSUNG) you should be presented with the Unix looking options under an “Android Recovery” menu. You’re in!

5. Use the volume up/down buttons to navigate to the option ‘Wipe Data/Factory Reset’, and use the power button to select it. From the sub menu asking you to confirm if you want to ‘Wipe all user data?’ select ‘Yes’ (volume and power buttons again). You’ll see some on screen info telling you it’s doing the factory reset.

6. This should only take a second, then from the main menu select ‘Reboot System Now’

The phone should be in a proper factory reset state after this and forget the Samsung account. If it has a Google account still stuck that’s an entirely different problem that I didn’t have to solve sorry!

Warning: This post will contain descriptive elements of physical harm I have been through, caused by gravity and the laws of physics. It’s also long for a blog post. Enjoy!

The first incident

The bad run for me started in late October 2025. Our family, along with another family, went to a caravan park for the school holidays, as we sometimes do. The kids enjoy riding around on scooters, and a few years ago I’d bought a couple of electric scooters from JB Hi-Fi going out cheap. We’d ridden them several times without incident before.

This time was different, and I am glad it was myself rather than one of the kids. I was cruising in a straight line down the road, and thought I’d see how fast they went. They’re capped out at 25km/hr and when you’re on a scooter with just a helmet to protect you, that feels fairly fast and exposed. I stopped accelerating and started to let it just roll, and thought to look back to see where everyone was. I couldn’t see, so I looked back harder, twisting my shoulders in the process. It was at this moment that either the balance change, or a small pebble on the road, made the scooter immediately fall under me. I flew over the handlebar which felt like slow motion in my mind with the thought ‘this is happening’ as an acceptance of the predicament I found myself in.

I hit the ground with my right shoulder/arm and proceeded to tumble. I tumbled once, I tumbled twice, and prepared to land and get up, but instead the momentum took me for a third tumble. I landed pretty cleanly, and despite feeling a bit knocked about and a little winded, felt like I did a good job of the fall. A passer by asked if I was OK, and I said that I was as I got up, walked to the side of the road and then had a little lie down. I knew I’d hit several parts of my right side but no body part was in excruciating pain and everything appeared to still be moving.

After a few moments I got up and started to walk the electric scooter back to the accommodation. My arm felt a bit dead, and more feelings of ache crept into my body. After reporting the incident to my wife, I thought I just needed a bit of rest.

I started to experience random spasms in my arm which made me yell out in pain. The deadness in my arm (along with the several other numb and aching areas of my body) was similar to how I felt after getting hit by a car a few years back, so I assumed all I needed was some physio and time to recover. This happened on a Saturday, and I was back home Monday when I went to see a physio about it. I couldn’t really rotate my arm being being in ‘handshake mode’ and I assumed this was due to the muscles locking up post-incident.

The physio did a few initial checks on my still dead arm, and came to the conclusion that there was a chance my arm was broken and I should go get X-rays before she worked on it. I booked an appointment and drove to the radiology place nearby. The X-ray revealed a fracture in my arm, and that I needed to go to hospital. I then drove to the hospital and was eventually triaged to go to a nearby clinic who could treat me. After getting to that clinic and having them look at the X-ray to confirm that yes it was fractured, because of where it was (Radial Head), all I could do was put it in a sling and rest it for a few weeks. It was at that point I felt rather light headed, realising this was the first time I’d broken a bone and that I actually wasn’t invincible, but instead a frail human just like everyone else. After gathering myself, I went home to feel sorry for my predicament.

I wondered how I was going to work – and in reality, I couldn’t do much. I couldn’t type, or use a mouse. My arm had to be rested in the sling for up to 5 weeks. After a week, I found that I had an old ergonomic trackball and I could hold that against my chest to drive a mouse, and type left handed. Surprisingly it worked reasonably well and I could at least do most elements of my job again. Over the next few weeks my arm eventually recovered to full function, albeit occasional small elbow pains and not really being able to lean on that elbow as things internally seem to have shifted.

The Second Incident

I thought the worst was behind me and now I could get back into everything. It was the start of February 2026 – I’d just started to get back into Badminton before the crash (only one game!) and my arm seemed well enough to get into it. I’d sold the escooters on Facebook and forbid their usage by myself or any family member. These actions however, did not protect me from the second incident.

It was ~4am when my eldest son woke me up, standing next to my bed. If you’ve been woken up by a child before this way, it is a horrific way to be woken up (at least for me it is), as you’re violently woken into a scenario that needs action. This particular night-terror was a blood nose that wouldn’t stop. Holding a bunch of bloodied tissues to his face, my son didn’t know what to do. I ushered him back to his room and grabbed a frozen face mask from the freezer to put on his head and cool him down. I went out of the room and cleaned the trail of blood he’d created on his journey to my bedroom. When I got back, he had a new wad of bloodied tissues and said with major concern ‘Why won’t it stop?’ while taking the tissues off his nose again. I grabbed the bloodied tissues and reassured him it would stop, and that he just needed to cool down, rest, and give it some time.

It was as this moment that I felt a slight tinge of light headedness. Maybe a 1/10 on the scale, similar to the feeling you might get if you are lying down and get up too fast. I dismissed it, and rushed out of the room to remove the item from my son’s sight to hopefully help the stress level. I stepped out of the room…

Then I was dreaming. I can’t remember the dream, but it was a quick one. It was also a dream where you were coming out of it and knew you were dreaming, so I thought I must have gone back to sleep. I opened my eyes. I could see the tiles outside my son’s room. Except, there was blood on them. I’d already cleaned the blood though, did I miss this somehow? And why was I looking down on it? I went to bend back up, only to realise that I was not standing. I was instead lying on the ground. I got up and saw a lot more blood. It was all over me. I looked back to my son’s room and he was standing at the door. He asked ‘Are you OK?’ and I said I didn’t know (later I would learn that he heard me fall, came out to see me convulsing on the ground, then snoring – for maybe 20 seconds). I staggered back to my room where I turned on the light and exclaimed to my wife ‘Something bad happened!’. I still had no idea what events had even occurred. Did I have a heart attack? The shock was setting in.

I lied back on the bed, feeling my face was numb but not sore. I must have just hit my head. My wife ran off to get me something frozen to put on my face and clean up the blood. When she came back, I was definitely in shock with my body shaking uncontrollably, like a shiver that kept coming and going. I’d worked out that a lot of the blood was above my left eye, so that’s where I was holding the ice pack – except it was now dripping down my face again. My wife made the call that we needed to go to the hospital, so she woke up her mother to look after the kids while we drove off to get me fixed up.

At the hospital, I was triaged again. This time they just put a big bandage over my eyebrow, got me a hospital bed, and I waited in the waiting room trying to work out what was going on, along with my supportive wife. We’d got to the conclusion that I’d blacked out and smashed my face onto the tiles that go throughout our house. I’d always had a bit of an aversion to suffering associated with blood – I’d had plenty of blood noses in my life and those didn’t worry me much. What did worry me was injections, having blood taken, or seeing others struggling with simple medical procedures. I remember one time at a hospital helping my mum with an emergency back issue. I was watching someone who had to have an injection in their stomach. They were freaking out about it. I started to get light headed and break out in a sweat. I had to get a nurse to provide me a bed as I was about to faint at what I saw, which was more about the person suffering than a simple injection. We weren’t even at the hospital for me! Rather embarassing.

It took 7 hours of waiting in the hospital’s waiting room before I was seen by a doctor. After an ECG test that showed everything was fine, they had a look at my main wound. A gaping hole above my eye, which I could not bear to think about. I was beside myself having this injury, caused by something I didn’t feel I could control – a complete blackout. I’d never blacked out in my life before either, so this was a new one. The doctor’s shock reaction upon seeing the wound didn’t help, as she poured antiseptic in to prevent infection. My wife had a look at what was going on and exclaimed ‘Wow!’ – where I begged her to not react or say anything more. I couldn’t cope with this. She took a photo and remained silent. I would later discover that her ‘Wow’ was due to being able to see the top of my eyeball moving around through the wound. Something I am glad I wasn’t aware of at the time, and I still struggle with the concept now. She has that photo still for anyone interested to see. Personally, I have declined this offer.

As the doctor could see I wasn’t coping, she organised laughing gas for me. Another first – I was a bit nervous on taking it but I needed help. After breathing it in, I did calm down. Under the effects of Nitrous Oxide, I found I couldn’t focus on the 1 problem we were dealing with, but instead I was aware of everything going on. I could hear people talking in the next room, and I started cracking jokes. I was fully aware of what I was saying and events occurring, but I didn’t care as much on how I was seen or the stitches that were now being fed through my eyebrow. That is, until I realised that hadn’t happened yet and a needle that felt very close to my eyeball, full of anaesthetic, was being pushed into me. As I thought my eyeball was about to get pierced by stitches I freaked out again, but then eventually calmed down a bit and exclaimed that ‘I was a big boy now’.

Stitches done, and having to sadly hand the gas back after a few last puffs, I grew concerned again. That was my major wound done – but I’d have to have the stitches taken out later. How bad would the scar be? That part didn’t bother me too much. What did bother me was another medical procedure in my near future, shaped by a past where I had 42 staples in my leg that were removed one by one with large amounts of pain (but this stitch removal turned out to be a painless non event!). There was also something else – my teeth.

Somewhere in the above story, I’d also realised that I’d smashed my teeth. Again they didn’t hurt, but the fear of how they would be reconstructed was sitting heavy with me. The day after my hospital visit, I went to the dentist. Still very shaken from the events so far, I received another anaesthetic and had my front 2 teeth reconstructed with filling. It’d get me by for the short term, but I’d need more work done later. Again, dentistry work sits in the zone of ‘I don’t like that at all and I’m starting to freak out thinking about it’. The dentist visit wasn’t particularly painful but I was still worried about what I’d have to go through in the future. Plus, my bite had changed. I couldn’t chew food like I could before, as my teeth hit in a different spot. After a week of not being able to chew like the good old days, I went back and had the teeth ground back to improve my bite. That seemed to sort it until I organise the bigger work required.

All this happend on a Thursday/Friday. After the weekend, I went back to work. Sure I was feeling sorry for myself, bandaged up, but physically I could work. I started on the Monday morning and had a good hour or two. Then I started getting light headed, scared, and upset. I wasn’t really sure why this was happening. I took the rest of the day off and went to see my doctor the next morning. I found out that I had a concussion also, which I didn’t even think about (add this to the list of firsts).

As per the University of Queensland:

Oh, I was ticking a lot of those boxes. I had this weird unsettled stomach feeling. I knew I was thinking and responding slower than normal. I had difficulty concentrating. I was highly emotional about it all.

I was also struggling with what happened. I blacked out and did this much damage to myself. How could I prevent it? If I got up in the night, I was in fear that it’d just happen again. I learnt from my doctor that I really needed to just rest my brain and eyes to recover, and it could take up to a month. I had some time off work again to do this, but it probably took that month before I started feeling close to normal again. I had to be gentle with my head as I could feel it wasnt right, like my brain was bruised. I missed out on go-karting for my son’s birthday because of it.

How Am I Now?

It’s been 2 months since Incident 2, and I’m mostly OK again. I still get worried about moving around at night, and if I need to deal with blood from my sons (which is almost a daily occurrence one way or anther without exaggeration) I take things carefully. I have this underlying concern that I could just back out at any time beyond my control, but I think about that less as time progresses. My teeth still need proper fixing, and my eyebrow scar often stings with pain (which makes me feel a bit like Harry Potter and his lightning bolt scar). My face has changed, my bite has changed, my elbow has changed, my mind has changed. But change is inevitable, sometimes good, sometimes bad, and sometimes just different. I wanted to note down my story as a bit of therapy – there is something cathartic about noting things of concern for me. There is no other choice but to continue on and make the most of everything.

Family, friends, life.