Table of Contents
Introduction
Microsoft Copilot is changing its URL, and if your firewall doesn't know about it, your users might lose access.
Starting September 2026, Microsoft will begin redirecting Copilot users from m365.cloud.microsoft to copilot.cloud.microsoft. The redirect will happen automatically — but there's one catch: your security controls need to allow the new destination.
If copilot.cloud.microsoft is blocked by your firewall, proxy, secure web gateway, URL filtering, tenant restrictions, or app control policies, users could lose access to the Copilot web app after the redirect.
What's Changing
Microsoft is consolidating its cloud endpoints under the cloud.microsoft domain. For Copilot, this means:
- Old URL:
m365.cloud.microsoft - New URL:
copilot.cloud.microsoft - Redirect type: Automatic
- Timeline: September 2026 (initial), October 2026 (remaining users)
Microsoft recommends allowing the entire *.cloud.microsoft domain rather than selectively allowing individual application URLs. This approach simplifies management and ensures compatibility with future Microsoft services that adopt the domain.
The redirect remains within the *.cloud.microsoft domain and retains its security, compliance, and enterprise allow-listing properties. Organizations that follow Microsoft's recommended network configurations for Microsoft 365 Copilot may not need additional changes.
The Risks: When Firewalls Don't Follow
If copilot.cloud.microsoft is blocked in your environment, several things can happen:
- Users lose access to the Copilot web app after the redirect
- Microsoft 365 web experiences may also be disrupted
- Authentication flows may fail
- IT support tickets will spike as users report "Copilot stopped working"
Organizations currently blocking copilot.cloud.microsoft won't avoid the change permanently. Microsoft says these organizations will be redirected later in October. If access isn't allowed by then, disruption is likely.
Who Is Affected
This change affects any organization that uses Microsoft Copilot on the web. Specific risk factors include:
- Organizations with strict firewall rules that only allow the old domain
- Proxy configurations that filter by URL category
- Secure web gateways with allowlists that need updating
- Companies blocking Copilot to prevent personal account sign-ins
- Environments with tenant restrictions that need adjustment
What IT Teams Must Do
Microsoft is urging IT administrators to review their network configurations immediately to ensure continued access. Here's the checklist:
Pre-Redirect Checklist for IT/ Security Teams
- Test connectivity to
copilot.cloud.microsoftusing the Microsoft 365 Connectivity Test tool - Review firewall rules to confirm the new URL isn't blocked
- Check proxy settings and URL filtering policies
- Review secure web gateway and URL category restrictions
- Check legacy URL allow/block lists for outdated entries
- Verify Conditional Access policies don't inadvertently block the new domain
- Review app control policies and tenant restrictions
- Coordinate with network and security teams to ensure alignment
- Ensure
*.cloud.microsoftis permitted where required
Microsoft provides a Connectivity Test tool to verify access from your environment. Use it to confirm copilot.cloud.microsoft is reachable before the redirect applies to your organization.
Tenant Restrictions: The Right Way to Block Personal Accounts
Some organizations block Copilot because of concerns about employees signing in with personal Microsoft accounts. Microsoft's recommendation is clear: don't simply block the new URL.
Instead, use Tenant Restrictions as the targeted control. This allows you to:
- Prevent authentication with personal Microsoft accounts
- Preserve access to Microsoft 365 and Copilot services through the web
- Maintain compliance with your organization's security policies
Existing tenant policies and the account switcher between personal and work/school accounts are expected to continue working. Administrators should test the redirect before the October transition rather than relying on the old m365.cloud.microsoft address remaining available.
Timeline: Don't Wait Until October
Microsoft has laid out a clear timeline for the redirect:
Copilot URL Redirect Timeline
copilot.cloud.microsoft is already accessible
Don't wait for users to report that Copilot stopped working. Test the new endpoint before Microsoft flips the switch.
Microsoft has advised organizations that cannot complete the required configuration before the redirect to contact their Microsoft account representative to discuss available options.
Final Thoughts
The Microsoft Copilot URL change is a network and security configuration issue, not a Copilot problem. Organizations that proactively update their firewall, proxy, and security gateway rules will experience a seamless transition. Those that don't may face user disruption and support tickets.
Key takeaways:
- New URL —
copilot.cloud.microsoft(fromm365.cloud.microsoft) - Timeline — September 2026 (initial), October 2026 (remaining)
- Test connectivity — Use Microsoft's Connectivity Test tool
- Review controls — Firewall, proxy, SWG, URL filtering, tenant restrictions
- Allow
*.cloud.microsoft— Microsoft recommends the entire domain - Use Tenant Restrictions — For blocking personal accounts, not URL blocking
- Don't wait — Test before the redirect reaches your organization
If your organization needs assistance with network configuration, firewall rule updates, or Microsoft 365 security controls, contact SystemLogicIT for expert guidance across the United States and United Kingdom.