For organizations, this is more than a layout tweak. Enabling it creates a second locally stored browser profile inside Copilot, complete with browsing history, cookies, and autofill data. Microsoft says that data is held under %localappdata%\Microsoft\Copilot\User Data, separate from the familiar Microsoft Edge profile locations many IT teams already inventory, protect, or clear during device remediation.
Neowin first reported the rollout details, while Microsoft’s own policy documentation confirms that the Copilot app now has a BrowsingEnabled policy for controlling access. The practical implication is clear: administrators who want to evaluate or contain the change should do so before the broader rollout begins, rather than treating it as another cosmetic Copilot update.
Copilot gets a browser pane, not a browser handoff
When enabled, clicking a link shared in a Copilot chat opens the destination in a right-side pane within the Copilot desktop application. Multiple pages can remain open as tabs, users can resize the pane, and the browser view can be expanded to full screen.
The design keeps the original Copilot conversation visible while a user reviews a source, a vendor support page, or a generated HTML file. Microsoft explicitly says the feature is for displaying websites and Copilot-generated HTML rather than introducing another method of prompting or directing the AI.
Users will still have routes out to a traditional browser. The Copilot link menu includes an external-browser option, and users can copy a URL manually. Microsoft says a tab-level right-click command to open the current page externally is due on September 21, 2026.
That distinction matters operationally. Copilot is not replacing Edge, Chrome, Firefox, or another installed browser. It is inserting a lightweight browsing experience into the path between an AI answer and the source material behind it. For users who routinely open cited links, that could reduce context-switching. For help-desk and compliance teams, it also means the same web task may leave artifacts in a place they are not yet managing.
The policy is a Copilot policy, despite Edge documentation references
Microsoft’s Message Center notice directs administrators toward Edge policy documentation as part of its implementation guidance. But the controlling setting is not the similarly named Edge policy governing Browsing with Copilot inside Microsoft Edge.
The relevant desktop-app setting is BrowsingEnabled, documented by Microsoft Learn under Microsoft Copilot policies. On Windows, it is delivered through CopilotApp.admx, appears in Group Policy under Administrative Templates/Microsoft Copilot/Browsing, and writes to:
HKLM\SOFTWARE\Policies\Microsoft\Copilot
The registry value is a REG_DWORD named BrowsingEnabled; a value of 1 enables the capability. On macOS, the preference key uses the same name.
This is an important separation. The Edge policy AllowBrowsingWithCopilot controls a different product behavior: whether Copilot can be invoked in Microsoft Edge, subject to web-domain allow and block lists. It does not control whether the standalone Copilot app opens a page in its own side pane. Administrators should not assume existing Edge Copilot restrictions will govern this new Copilot-app browser.
Microsoft’s policy record says BrowsingEnabled is supported in Copilot version 152 or later on both Windows and macOS, and that it supports dynamic policy refresh. In practice, that should let administrators change the setting without a full application redeployment cycle, although organizations should validate actual client behavior in their own managed configuration before relying on that for incident response.
“Opt-in now” becomes “enabled unless disabled” later
The rollout language contains a detail administrators should not overlook. Microsoft says selected devices can be opted into testing now. Yet the corresponding Microsoft Learn documentation says browsing capabilities are available when BrowsingEnabled is enabled or not configured, and are disabled only when the policy is explicitly set to off.
Those statements are not necessarily contradictory. The opt-in phase appears to be a controlled availability period before the app component is broadly deployed. But once the broader rollout reaches eligible clients, the documented default means organizations that do not want Copilot to host web pages internally may need to set BrowsingEnabled to 0 deliberately.
That creates a familiar enterprise-management trap: a feature begins as a preview that requires action to turn on, so it is easy to leave unaddressed; later, its policy semantics make “unconfigured” equivalent to enabled. Microsoft has not published a more specific phased-rollout schedule than “late November,” nor has it identified which device-management products receive ready-made configuration templates first. The Message Center notice tells organizations to use their device-management system but does not spell out an Intune settings-catalog path or configuration-profile template.
For Windows administrators using Group Policy, the policy location and registry setting provide a workable path. For cloud-managed fleets, the immediate task is to confirm that the current Copilot ADMX-backed policy can be deployed through the organization’s management tooling, then test it on devices running the necessary Copilot build.
A sensible pilot should include at least three scenarios:
- Test that links from standard Copilot responses open in the side pane only on the intended pilot devices.
- Verify that setting
BrowsingEnabledto disabled prevents the pane from opening after policy refresh and an application restart if needed. - Confirm that browser data created inside Copilot is handled by endpoint cleanup, forensic collection, profile migration, and support procedures.
A new local data store changes endpoint assumptions
Microsoft’s compliance disclosure is unusually direct: the feature stores browsing history, cookies, and autofill information locally in the Copilot user-data directory. The company compares the storage mechanism to Microsoft Edge, but the location is distinct enough to matter.
Endpoint teams often have established controls for Edge profiles: roaming-profile exclusions, profile cleanup routines, backup rules, data-discovery scans, browser-extension policy, and incident-response collection procedures. None of those controls should be assumed to extend automatically to %localappdata%\Microsoft\Copilot\User Data.
The data types are also more sensitive in combination than they may appear separately. Browsing history can reveal access to internal portals, customer systems, HR services, financial tools, or security consoles. Cookies can retain authenticated web sessions, depending on the site’s own session design and device controls. Autofill can preserve form values or identifiers. Microsoft has not said in MC1474455 whether the Copilot pane supports the same extension model, cookie-management interfaces, data-export functions, or profile-isolation controls that users and administrators expect in Edge.
That missing detail is the central compliance question, not whether Copilot’s pane looks like a smaller browser. Organizations subject to retention, eDiscovery, regulated-data, or strict shared-device requirements should determine what reaches this folder, how long it remains there, and whether their existing security products inspect it.
Microsoft says the feature does not add a new way to generate or steer AI. That is accurate as far as the announced interface goes. But it does create a new place where AI-referred web activity and local browsing artifacts meet, which is a meaningful endpoint-management change even if the underlying Copilot prompt flow is unchanged.
What IT teams should do before November
The immediate choice is whether to test the capability on selected clients or preemptively disable it until documentation and support processes catch up. A pilot makes sense for organizations that use Copilot heavily for research, service-desk workflows, or document review and want to measure whether keeping sources alongside chat improves work without creating unmanaged local data.
Organizations with tighter browser governance may reach the opposite conclusion. If users must access web content only through a sanctioned browser configuration, then Copilot’s embedded pane needs a documented security and compliance assessment before it becomes generally available. Setting the Copilot-specific policy to disabled is more reliable than relying on a user to choose “External browser” for every link.
The November rollout will determine how visible this becomes to ordinary users. But the most consequential change is already documented: Microsoft Copilot is gaining a browser data store and a browsing policy of its own. Administrators who inventory that profile path and decide the BrowsingEnabled default now will avoid discovering it later through a support ticket, a profile-cleanup failure, or an endpoint investigation.