Copilot Doesn’t Need New Conditional Access. It Needs You to Actually Have the Old Ones
A pattern I keep running into: someone asks how to “put Copilot behind Conditional Access,” assuming it needs its own bespoke policy set. It doesn’t. Copilot rides on Microsoft Graph, so it inherits whatever Conditional Access you’ve already configured. This piece goes deep on the mechanics: how that inheritance actually works, the three ways admins target Copilot-related services, how to find the exact service principals in your own tenant, what genuinely changes by licence tier, why Copilot Chat is probably already active in your org whether you bought a licence or not, and where Conditional Access is heading next with agent identities.