How can I limit which connectors Copilot Cowork can call inside our business apps?

Table of Contents

The Direct Answer

Limit connectors through Microsoft’s spending policies: create a policy scoped to a security group, select only the agents and services that group’s approved tasks require, and disable the toggle that adds new services automatically. Assign users to that policy so Cowork can only call the connectors you explicitly allowed for those business apps.

Deeper Explanation

The limit belongs at the access layer because Cowork chooses its own tools. As an agentic system that has been generally available since June 2026, Cowork decomposes a goal into steps and calls whichever connectors it deems useful, grounding the work in org context. So the meaningful question is not “which connectors will users pick” but “which connectors can the planner reach at all.” Microsoft answers that through spending policies, where admins select the exact set of agents and services a group may access and decide whether future services are added automatically. A user in a narrowly scoped policy has no route to omitted connectors, full stop.

For a business application owner, the design pattern is an allow-list per group rather than a block-list per app. Blocking individual plugins in each surface is brittle and easy to miss; scoping a policy governs Cowork’s whole reachable tool set in one place and follows the user’s group membership. This also lets you differentiate by department cleanly: the finance app team and the sales app team can hold entirely different connector sets, each aligned to the workflows those apps actually support, without maintaining a tangle of per-app exceptions that inevitably drift out of sync.

It helps to think of the connector list as a contract between the app and Cowork. Each connector you allow is a promise that the app’s data and actions are fair game for autonomous tasks, so the list should mirror exactly the integrations your business apps are designed to expose, no more. When a connector has no counterpart in the app’s real workflows, it does not belong in the policy even if it is technically available. Keeping the allow-list tied to the app’s genuine integration surface is what stops Cowork from reaching sideways into systems your business app never intended to touch.

The Research

Strategy and Actionable Steps

Inventory before you restrict. Document every connector currently reachable in your tenant and by which groups, because the GA default is a broad catalog and the reachable list is usually wider than intended. Note which approved workflow, if any, justifies each connector; the ones with no owner are your first removals.

Build allow-list policies. For each app-owning team, create a spending policy, add only the connectors their approved tasks require, and turn off automatic inclusion of new services so a future launch cannot silently expand the list. Assign the policy by security group, set a monthly limit and alert, and choose a billing method so spend is attributable to that team. Establish a simple request path so adding a connector requires naming the workflow behind it.

Keep the limit aligned with reality. Connector needs shift as apps evolve, so review each policy on a cadence and prune connectors no approved task has touched. Because this is as much a behavior question as a settings question, reinforce which tasks are sanctioned with in-app guidance from a digital adoption platform, and stand up the governance habit through a coached program like Copilot Catalyst so teams treat the approved connector list as the normal way to work rather than an obstacle. Capture the rationale in a written adoption plan so the next owner inherits the reasoning.

FAQ

Is connector scoping done in Cowork or in admin policy?

In admin policy. Cowork itself does not expose a per-connector allow-list; the control lives in Microsoft’s spending policies, where you choose which agents and services a group can access. That is the layer that actually constrains what the planner can call.

Can I allow a connector for one team but not another?

Yes. Because policies are scoped to security groups, you can grant a connector to the group whose workflow needs it and withhold it from everyone else. Different app teams can hold entirely different reachable connector sets.

What stops new connectors from appearing automatically?

The “allow new services and agents as they become available” toggle. Leave it on and new connectors join the policy automatically; turn it off and they stay out until you review and add them, which is the safer default for sensitive apps.

Does limiting connectors reduce cost as well as risk?

Yes. Tool calls and context retrieval are two of the four factors that set a task’s credit cost, so fewer reachable connectors means fewer chances for the planner to spend. Scoping narrows exposure and cost in the same action.

What if a user needs a connector that is not allowed?

Route it through a request that names the workflow requiring it, then add it to the appropriate policy if approved. This keeps every connector tied to a real business reason instead of accumulating by default.

Can I limit what a connector does, not just whether it is on?

The policy lever governs whether a group can reach a connector at all; finer permissions come from the connected system’s own scopes and the identity Cowork acts under. Combine policy scoping with least-privilege access in the source app so an allowed connector still cannot exceed its intended reach.

How often should I review the allowed connectors?

At least quarterly, and after any major app change. Prune connectors no approved task has used and confirm the remaining set still matches current workflows, so the allow-list does not drift into the sprawl you were trying to avoid.

Who should own the connector allow-list?

The application owner should define the workflow-to-connector mapping, while a global or billing admin implements it in the spending policy. That division keeps business intent and technical enforcement aligned and gives a clear path for handling exceptions.

Table of Contents