Microsoft excludes Domain Exclusion from MS 365 Copilot – days after rolling it out

AI AND ML

Perhaps an allow list of domains might be better?

Microsoft has abruptly withdrawn Domain Exclusion for Microsoft 365 Copilot, days after touting it as a way to stop the assistant grounding its answers in unwanted websites. If you had a list of sources you didn't trust, you're out of luck for now.

Microsoft announced Domain Exclusion last month. The idea was simple and sensible: Copilot can consult the public web when answering questions, but that also gives it ample opportunity to suck in nonsense. Administrators were to be given some control over the sources it used.

Health warnings about AI output only go so far when Microsoft wants businesses to put Copilot into critical workflows. As the company put it, "admins need practical controls that help web-grounded experiences stay aligned with organizational policies, compliance expectations, and trusted source strategies."

Enter Domain Exclusion, which was designed to let organizations bar up to 1,000 web domains from influencing Copilot responses. Administrators could create the list from a CSV file using PowerShell.

Microsoft stated: "By helping admins reduce the influence of unwanted or non-compliant web sources, Domain Exclusion supports a more governed approach to AI adoption."

Except it no longer does. In an update this week, Microsoft said the feature "has been rolled back at this time."

The company did not give a reason for the abrupt rollback, only stating: "We understand the importance of this capability and are actively evaluating next steps."

The control was welcome, but its block list design promised administrators an endless game of Whac-A-Mole. A ceiling of 1,000 domains looks modest beside the size of the public web, and staff could potentially use Copilot to retrieve information from sites that organizational policies barred them from visiting directly.

An allow list of approved sources would turn that burden around, limiting Copilot to sites the organization already trusts.

At the time of Microsoft's announcement, one commenter remarked: "I really wish this was the other way around: Off, but add an allow list. The On, but disable some means we'd have to know which sites were 'bad.' Seems backwards to do it that way." ®