One macOS login that finally uses Entra

Most MSPs treat the Macs in a client tenant like orphans. Enrol them in Intune, push a couple of profiles, tick the box, move on.

But the user still signs into that Mac with a local password. One nobody rotates, nobody recovers, and nobody can tie back to a real person. The Entra identity you spent all that effort hardening — MFA, Conditional Access, the lot — stops dead at the macOS login window.

That’s not managed. That’s two identities wearing the same hoodie.

Platform SSO closes the gap. And here’s the part that annoys me: it’s been sitting in your Intune licence the entire time.

What is Platform SSO, really?

It’s the thing that finally makes a Mac sign in with Entra ID the same way a Windows device does with Windows Hello for Business.

When you turn it on, the Mac gets joined to your Entra tenant and a hardware-bound certificate is locked to the device. From then on, the user’s Entra account is their login. Touch ID unlocks the machine. Apps and browsers get single sign-on off the back of it. No more re-typing the work password into every prompt.

You pick one of three flavours — Secure Enclave, smart card, or password. Microsoft recommends Secure Enclave, and so do I. It’s passwordless, phishing-resistant, and conceptually identical to Windows Hello for Business. The other two exist for edge cases.

Here’s the real win: it’s included with every Intune licensing plan. No add-on, no separate SKU. If you’ve got Business Premium, you already own this.

Step-by-Step: turning it on

Portal only. No scripts.

Check the prereqs first

Devices need macOS 13 or newer — push for macOS 14 Sonoma(opens in new window) for the cleanest experience. The Company Portal app must be version 5.2404.0 or later, because that’s what carries the SSO plug-in. And the user has to be allowed to join devices to Entra. Miss any of these and registration silently never happens.

Build the profile

In the Intune admin center, go to Devices > Manage devices > Configuration > Create > New policy. Platform: macOS. Profile type: Settings catalog.

Drop in the values

In the settings picker, expand Platform SSO and add the core settings:

Authentication Method   UserSecureEnclaveKey
Extension Identifier     com.microsoft.CompanyPortalMac.ssoextension
Team Identifier          UBF8T346G9
Registration token       {{DEVICEREGISTRATION}}

Notice what’s missing? No password field. No certificate to mint. No on-prem ADFS box wheezing in a cupboard. The Mac proves who it is with a key baked into its own silicon.

Deploy Company Portal, then assign

Push the latest Company Portal as a required app — that’s what installs the plug-in. Then assign the policy. One catch that bites people: for devices with user affinity, assign to users, not device groups or filters. Get that wrong and Conditional Access can lock the user out of the very resources you were protecting.

Why this actually changes behaviour

The first time the policy lands, the user sees a “Registration required” notification. They click it, sign in with their Entra account, do MFA once, and it’s done.

That prompt trips up every first-timer. It looks like something broke. It didn’t. That’s the moment the device gets Entra-joined and the certificate binds. Tell your clients it’s coming and the support ticket never gets raised.

“Why does it still ask for my old Mac password after a reboot?”

Because FileVault uses the local password as the disk unlock key. So after a cold boot you enter it once — then Touch ID takes over for the rest of the session. That’s by design, not a half-finished feature. Worth saying out loud before a client assumes it’s flaky.

And if there’s still an on-prem domain in the picture, you can layer Kerberos SSO to on-premises Active Directory onto the same policy. The Mac quietly handles both worlds.

Get this in place and a client’s Mac stops being the weak identity in the room. Same MFA. Same Conditional Access. Same audit trail as every Windows device. One login, one identity, one set of rules.

If you’re rolling out Macs and not showing clients this, you’re handing them a managed device with an unmanaged front door.

Platform SSO isn’t there to make Mac logins prettier. It’s there to make the local password irrelevant.

GAIN: Knowing What to Hand to AI and What to Hold Onto

A while back I caught myself spending a Saturday morning copying figures into a spreadsheet by hand. Forty minutes in, it landed on me — Copilot could have done this while I made a coffee. I wasn’t being thorough. I was being slow. And when the person at the top moves slowly, everything behind them backs up too.

That morning is why I keep coming back to a simple way of sorting the work in front of me: what to pass over, what to speed up, what to build alongside the machine, and what I should never let go of. Four buckets. GAIN.

Pass over the work that doesn’t need you

Most of us hold on to tasks out of pure habit. The first draft. The long document that needs boiling down. The background reading before a client call. None of that needs your judgement — it just needs doing. So let it be done. I’ll ask Copilot in Word to condense a forty-page proposal, or have it pull the recurring themes out of a month of client emails in Outlook. I’m not after ideas. I’m after a finished job. Once you start looking, the size of this pile is genuinely surprising.

Speed up the things that already work

Every business runs on small, repeatable steps. An enquiry arrives, someone qualifies it, someone books the meeting, someone sends the follow-up. You’re not reinventing that — you’re stripping out the waiting in between. With Power Automate sitting under Copilot, a new lead can be sorted, routed, and have a meeting request out the door before anyone’s even read it. Two hours back a week, every week, for as long as the doors are open. That compounds in a way that’s easy to dismiss when you’re staring at the setup.

Build something you couldn’t make alone

This is the part people skip past. The real value isn’t AI standing in for you — it’s the two of you producing something neither would on its own. I’ll have Copilot take ideas I’ve already worked through, connect them in ways I hadn’t spotted, and hand them back in a different shape. Sometimes I’ll drop a Loop page of rough notes and let it pull the thread together while I’m out of the office. I come back and I’m editing, not starting from a blank page. Minutes of shaping instead of hours of grinding. You shift from making the thing to sharpening it — and that’s a far better use of your attention.

Keep what only you can do

Not everything belongs on these piles, and pretending otherwise is how people lose the plot. Taste can’t be handed over — it’s learned, never taught, and certainly never prompted. Vision stays yours, because the machine has no idea what your clients will want next year. And care — actually feeling something for the work and the people on the other end of it — that’s the whole point of doing any of this. Copilot can draft the message; it can’t mean it. Guard those three closely.

The aim was never to turn yourself into the software. It’s to clear away everything else so there’s more room for the part of the job that’s unmistakably yours. I’m curious how far that line shifts over the next year — but those last few things, I don’t think they move at all.

Is Microsoft Losing Its Memory?

Over the last few weeks I’ve had more than a few conversations that have nothing to do with technology and everything to do with people.

The topic? Microsoft.

Not the products. Not Copilot. Not Azure. The company itself.

With another round of layoffs and a steady stream of experienced employees announcing their departure, many people are starting to ask the same question: Is Microsoft becoming a completely different company? And if so, is that a good thing?

It’s a fair question because a lot of the people leaving aren’t newcomers. They’re the people who have spent years, sometimes decades, building products, relationships, culture and institutional knowledge. They know why certain decisions were made. They remember what worked, what failed, and what lessons were learned along the way.

When that experience walks out the door, something goes with it.

Every Generation Reinvents the Company

One thing I’ve learned from watching Microsoft over many years is that the company is constantly reinventing itself.

The Microsoft that built Windows isn’t the same Microsoft that built Azure.

The Microsoft that created Office isn’t the same Microsoft that now delivers Microsoft 365.

And the Microsoft that is investing heavily in Copilot and AI today is once again becoming something different.

In many ways that’s exactly why the company has survived when so many technology giants have faded away. It has shown an ability to change direction when the market changes.

The challenge is that reinvention often comes with a cost. New people bring new ideas, new priorities and new ways of working. That’s healthy. But if too much historical knowledge disappears at the same time, organisations can find themselves solving problems that were already solved years ago.

Sometimes experience isn’t about knowing what to build. It’s about knowing what not to build.

The Hidden Value of Institutional Knowledge

When people think about layoffs, they often focus on roles and headcount.

What doesn’t get measured so easily is context.

Every organisation has unwritten knowledge. The things that never make it into documentation. The conversations that explain why a process exists. The lessons learned after a customer escalation. The accumulated understanding of how products, teams and markets really work.

Ironically, this is exactly what many businesses are now trying to capture with AI.

When organisations deploy Microsoft 365 Copilot, one of the first discoveries is that their knowledge is scattered everywhere. Some of it lives in SharePoint. Some is hidden in Teams conversations. Some is trapped inside Outlook mailboxes. And some only exists inside the heads of experienced employees.

When those employees leave, that knowledge often leaves with them.

That’s why I believe one of the greatest values of Microsoft 365 isn’t just productivity. It’s preserving organisational memory. Every Teams meeting transcript, every shared document, every Copilot-assisted summary creates a record that can help future employees understand the context behind decisions.

Technology can help capture knowledge, but it can’t replace the judgement that created it in the first place.

Could This Actually Make Microsoft Stronger?

The other side of the argument is equally compelling.

Large organisations can become attached to the way things have always been done. Fresh perspectives can challenge assumptions. New leaders can move faster because they’re not carrying the weight of past decisions.

You can certainly argue that Microsoft’s rapid shift towards cloud computing and now AI required new thinking that may have been difficult inside a company built around legacy business models.

A business that never changes eventually becomes irrelevant.

The risk isn’t change itself. The risk is changing so quickly that you forget what made you successful in the first place.

There’s a balance to be found between respecting experience and embracing new ideas.

What I’ll Be Watching

As Microsoft pushes deeper into the AI era, I think the real test won’t be how many people leave or how many new people join.

The test will be whether the company can preserve the culture, engineering discipline and customer focus that helped build its reputation while simultaneously creating something new.

Most successful organisations stand on two foundations: experience and innovation.

Lose innovation and you fall behind.

Lose experience and you repeat old mistakes.

The companies that thrive find a way to keep both.

Microsoft has reinvented itself many times before. The question now is whether this latest transformation strengthens the foundations of the company or slowly erodes the knowledge that helped make it one of the most influential technology organisations in the world.

Copilot in Excel

Most people who tell me Copilot in Excel is useless are half right.

It is useless — on their spreadsheet. Because their spreadsheet is a tangle of merged cells, blank rows, and a title floating in cell A1.

They open the Copilot pane, ask a question, get a shrug, and write the whole thing off as hype.

That’s not a Copilot problem. That’s a data problem.

Here’s the part nobody tells the client. Copilot in Excel only reads structured data. Fix the structure and the same “useless” tool answers everything you throw at it. The fix takes about ten seconds.

What is Copilot in Excel, really?

Forget the demos where someone conjures a dashboard out of thin air. Day to day, Copilot in Excel does four ordinary jobs, and does them well.

It summarises a table. It writes a formula column for you and explains how it works. It highlights, sorts and filters on request. And it flags trends or outliers you’d otherwise have to eyeball.

Notice what’s on that list? Nothing exotic. These are the things your clients already do by hand, slowly, every single week.

The catch is the layout. Copilot needs the data set out so it can read it. Microsoft is blunt about this — your data has to be an Excel table or a clean supported range, as spelled out in Format data for Copilot in Excel. One header row. Headers on columns only. No merged cells. No subtotals baked in. No blank rows cutting the data in half.

Give it a table and it flies. Give it a “report” with a logo in A1 and three blank rows for spacing, and it just stares back.

Step-by-Step: getting Copilot to actually answer

Save the file to the cloud

Copilot only works on files saved to OneDrive or SharePoint with AutoSave turned on. A workbook sitting on the desktop gets you a greyed-out button. File > Save a Copy > OneDrive, and AutoSave flips on by itself.

Turn your data into a table

Click any cell in your data. Press Ctrl+T. Confirm the “My table has headers” box. That’s it.

That one step fixes more “Copilot doesn’t work” complaints than everything else I show people combined.

Open the Copilot pane

The Copilot icon lives on the Home tab, far right of the ribbon. Click it and the pane slides in from the right with a few starter prompts. The official Get started with Copilot in Excel page is a tidy thing to hand a client here.

Ask once, specifically

This is where people fumble. They type “summarise this” and get mush. Be specific about the column and the goal:

Add a column that flags any order in the Total column over 5000 as "Review", and explain the formula.

Notice what’s in that prompt? A named column. A clear rule. A request to explain. That’s the whole difference between a useful answer and a coin toss. Ask once, but ask properly.

Why this actually changes behaviour

Here’s the real win, and it isn’t the formulas.

For years the gap between a spreadsheet and an answer was Excel knowledge. XLOOKUP, pivot tables, nested IFs — the stuff that lives in the head of one person in the office and nowhere else.

Copilot closes that gap. The person who knew the question but not the syntax can now just ask.

“But won’t it get things wrong?”

Yes. It will. Microsoft says so plainly in their Copilot in Excel FAQ — read what it writes, check it, then accept it. Treat it like a sharp junior who’s fast but needs reviewing. You wouldn’t ship a graduate’s first draft unread either.

And that review habit is the part worth teaching. Copilot doesn’t replace judgement. It removes the typing between you and the judgement.

If you look after SMB clients, this is a five-minute conversation that pays for itself. Most of them are already paying for the Copilot licence and getting nothing from it in Excel — because their data was never structured for it.

Show them Ctrl+T. Show them one good prompt. Watch the lights come on.

If you’re not showing your clients this, you’re leaving value on the table that they’re already paying for.

Copilot in Excel isn’t there to make people better at Excel. It’s there to make Excel skill stop being the thing that holds them back.

The Security Feature Most Microsoft 365 Admins Ignore

One of the first things I do when looking at a Microsoft 365 environment is check what security is actually doing. Not what has been configured. Not what the Secure Score says. Not what someone remembers setting up six months ago. I want to see what is really happening right now.

That’s why I’m a big fan of the reporting options built into Microsoft Defender for Office 365.

Too many organisations spend time configuring Safe Links, Safe Attachments, anti-phishing policies and quarantine settings, then never look back. The assumption is that because the settings exist, they must be working. In reality, security is something you need to measure continuously, not configure once and forget. The Microsoft documentation highlights a range of Defender for Office 365 reports that provide visibility into how email protection is performing and what threats are being stopped before they reach users. View Defender for Office 365 reports [learn.microsoft.com]

Security Is About Evidence

I regularly see organisations investing in security tools but struggling to answer simple questions:

How much phishing is being blocked?
Are malicious attachments being detected?
How quickly is email being processed?
Are threats still arriving in user mailboxes?

The Defender reports help answer those questions.

The real value isn’t the graphs and dashboards. The value comes from having evidence. Security conversations change dramatically when you can point to data rather than assumptions.

Imagine sitting down with management and showing that thousands of malicious messages were blocked last month before users ever saw them. That’s a much stronger discussion than simply saying, “Our email security is working.”

It’s Not Just About Blocking Threats

One report that often catches my attention is mail latency. Security processing adds time to message delivery, particularly when attachments need deeper inspection. The report helps you understand whether protection measures are impacting mail flow. Mail latency report [learn.microsoft.com]

Another area worth reviewing is post-delivery activity. No security platform catches everything immediately. Sometimes a threat is identified after a message has already arrived in a mailbox. Defender’s automated remediation features can remove those messages automatically, but unless you’re reviewing reports, you may never know how often that’s happening. Post-delivery activities report [learn.microsoft.com]

This is an important lesson for any organisation using Microsoft 365. Security isn’t only about prevention. It’s also about detection and response.

Why This Matters More in the Age of Copilot

As organisations adopt Microsoft 365 Copilot, the quality and security of their Microsoft 365 environment becomes even more important.

Copilot works across Outlook, Teams, SharePoint and OneDrive. The more information available inside Microsoft 365, the more valuable Copilot becomes. However, that also means security teams need confidence that threats are being managed effectively.

I’ve seen organisations focus heavily on Copilot deployment while overlooking the visibility tools already sitting inside Microsoft Defender. Before chasing the next AI capability, make sure you understand what is happening inside your environment today.

A practical example might be reviewing a phishing campaign shown in Defender reports and then using Microsoft 365 Copilot in Excel to analyse trends over time or prepare management summaries from the collected data. That’s a real-world workflow that combines security visibility with AI assistance.

Stop Flying Blind

One of the biggest mistakes I see in small and medium businesses is treating security as a set-and-forget exercise. Security policies get deployed, everyone feels confident, and then nobody checks whether the controls are actually delivering the expected outcome.

The Defender for Office 365 reports provide the missing feedback loop.

If you’re already paying for Microsoft Defender for Office 365 through licences such as Microsoft 365 Business Premium, E5 or Defender for Office 365 plans, these reports are often sitting there waiting to be used. Defender for Office 365 reports [learn.microsoft.com]

My recommendation is simple. Schedule time every month to review the data. Look at what is being blocked, what is slipping through, and how protection is performing over time. Trends are often more important than individual incidents.

Security isn’t about having controls. It’s about knowing whether those controls are working.

And in my experience, the organisations that regularly review their security reports are almost always in a stronger position than those that don’t.

Has Microsoft Made Copilot Cowork Too Expensive and Too Hard to Use for SMB?

A lot of SMBs think their AI journey starts by buying more AI.

I think that’s the wrong place to start.

Over the last few months I’ve spoken to plenty of SMBs and MSPs who are excited about Microsoft Copilot, curious about Copilot Cowork, and interested in agents. Then they see the pricing model, hear the term pay-as-you-go, start looking at consumption costs, and immediately become nervous.

I don’t blame them.

The real question isn’t whether Copilot Cowork is good. The question is whether Microsoft has made it too expensive and too complicated for the average SMB to realise value from it.

And right now, I think there’s a genuine argument that they have.

Technology should remove friction, not introduce it.

What is Copilot Cowork, really?

Forget the product names for a moment.

Copilot Cowork is essentially Microsoft’s way of allowing AI experiences to go beyond the capabilities included in your existing Microsoft 365 subscription.

That can mean accessing additional AI services, consuming AI-powered workflows, running agents, or using capabilities that incur usage-based costs rather than being covered under a fixed licence.

The attraction is obvious.

You only pay for what you use.

The problem is that most SMBs have spent the last twenty years moving away from unpredictable IT costs. Fixed monthly subscriptions made budgeting easier. Consumption billing moves the conversation in the opposite direction.

That’s where things start getting uncomfortable.

“Isn’t this just cloud pricing all over again?”

In many ways, yes.

The difference is that AI usage can be harder for business owners to understand than storage, mailboxes or virtual machines.

Step-by-Step: Getting Value Before Paying More

Review the Copilot Features You Already Have

Open the Microsoft 365 apps your users work with every day.

Look at the built-in Copilot experiences already available in products such as Edge, Outlook, Teams and Microsoft 365.

Microsoft continues to expand these capabilities, often without organisations fully realising what’s already included.

You can learn more from https://learn.microsoft.com/microsoft-365/copilot/microsoft-365-copilot

Enable Microsoft 365 Copilot Chat

Navigate to:

Microsoft 365 App > Copilot

Many organisations still aren’t getting consistent value from Copilot Chat, despite it being available to users.

If your staff aren’t regularly using Copilot Chat, adding more AI services is unlikely to solve the problem.

Identify Repetitive Business Processes

Look for activities that happen repeatedly:

Status reporting
Meeting preparation
Policy summarisation
Document review
Knowledge retrieval

These are usually the areas where AI can provide immediate value.

Microsoft’s adoption guidance is available through https://learn.microsoft.com/microsoft-365/copilot/adoption/ adoption resources.

Measure Usage Before Expanding

Use the reporting and administrative tools available within Microsoft 365 to understand whether users are actually engaging with Copilot.

Many organisations skip this step entirely.

They purchase AI licences first and measure value later.

That’s backwards.

Introduce Consumption-Based Services Carefully

Only after people are regularly using the AI capabilities already available should you consider broader AI consumption models.

If you do move forward, make sure you understand how billing controls and cost management work.

Microsoft provides additional information through https://learn.microsoft.com/microsoft-365/copilot/microsoft-365-copilot-page.

Why this actually changes behaviour

The biggest issue isn’t price.

It’s uncertainty.

SMBs don’t generally object to paying for technology that creates value.

They object to paying for technology when they can’t predict what the bill will be or explain what they’re getting in return.

That’s an adoption problem, not a technical problem.

Copilot Cowork asks organisations to think differently about AI consumption. That’s understandable from Microsoft’s perspective, but it introduces complexity at a time when many SMBs are still trying to establish basic AI habits.

Notice what’s missing?

People.

If users aren’t actively incorporating AI into their daily workflows, no pricing model will save the deployment.

My recommendation?

Use every Copilot capability already included in Microsoft 365 first.

Build habits.

Measure outcomes.

Identify repeatable wins.

Only then move toward consumption-based AI services.

Copilot doesn’t get tired. Use that.

But don’t pay for more AI until you’ve proven the value of the AI you already have.

The real opportunity isn’t buying more AI.

It’s getting more value from the AI you’ve already paid for. If you’re not showing clients this, you’re leaving value on the table.

The Browser Is Becoming Part of the Conversation

The more I use Copilot Cowork, the more I realise that the interesting part isn’t the AI itself. It’s what happens when the AI can finally interact with the same systems I use every day.

For years we’ve talked about AI helping us write documents, summarise meetings and draft emails. Useful? Absolutely. But most work doesn’t stop there. Sooner or later you need to log into a website, update a portal, retrieve information from a dashboard, or complete a process that lives inside a browser window.

That’s why the addition of local browser use in Copilot Cowork has caught my attention.

The Gap Between Advice and Action

One of the frustrations I see with AI tools is that they often stop at recommendations. They’ll tell you what to do, but they won’t actually do it.

Think about a typical day. You receive an email asking for an update. You find the relevant Teams conversation. You look through a SharePoint document. You then log into a service portal to check the current status before replying.

The work isn’t creating the email. The work is gathering the information across multiple locations and then taking action.

What browser use starts to do is close some of that gap.

Instead of simply suggesting a next step, Cowork can potentially navigate the website on your behalf while remaining inside the flow of the conversation. That changes the relationship between the user and the tool. You’re no longer just asking questions. You’re delegating pieces of work.

The Real Opportunity for SMBs

When I talk with SMBs and MSPs, one common theme emerges. Many important business systems don’t have polished integrations or APIs.

There are customer portals, supplier websites, expense systems, training platforms and countless line-of-business applications that still require someone to open a browser and manually complete a task.

That’s the reality of most small businesses.

Imagine asking Cowork to collect information from a supplier portal, compare it against a spreadsheet in Excel, create a summary in Word and then draft an Outlook email ready for review.

The value isn’t that any individual step is difficult. The value comes from reducing all the switching between systems that quietly consumes large portions of the day.

Every context switch has a cost. Most people simply don’t notice it because they’re so used to doing it.

Human Control Still Matters

Of course, this isn’t a licence to let AI loose across every system without oversight.

One thing I appreciate about Microsoft’s approach is that the browser session remains connected to the user’s identity and permissions. The AI is working with the same access the user already has rather than operating as some separate privileged account.

That’s important.

The future of workplace AI isn’t about removing people from the process. It’s about putting people higher in the process.

I see the role shifting from operator to supervisor. Instead of spending ten minutes navigating through screens and forms, you’re reviewing work, making decisions and approving outcomes.

The keyboard becomes a little less important. Judgement becomes more important.

What I’m Watching Next

I suspect many people will initially view browser use as a novelty. They’ll try a few demonstrations and move on.

I think that misses the bigger story.

The real significance is that Copilot is gradually moving beyond content creation and into work execution. The ability to interact with websites, applications and business processes starts to make the assistant feel less like a chatbot and more like a digital team member.

We’re still in the early stages, and I’d encourage organisations to test it carefully and deliberately.

But every major technology shift starts with a small behavioural change.

For me, that change is simple.

When I open a browser now, I’m increasingly asking not “What can I do here?”

I’m asking, “What can I hand off instead?”

How to Enable Browser Use in Copilot Cowork

Before users can take advantage of Browser Use, there are several prerequisites that must be met. According to Microsoft’s documentation, Browser Use is disabled by default and requires administrator configuration before users can access it. [learn.microsoft.com], [learn.microsoft.com]

Step 1: Enable Copilot Cowork

Browser Use relies on Copilot Cowork being available to users. As an administrator:

Sign in to the Microsoft 365 Admin Center.
Navigate to Copilot.
Open Cost Management.
Configure usage-based billing.
Assign access to the users who will use Copilot Cowork.

If usage-based billing hasn’t been configured, users won’t be able to access Cowork features. [learn.microsoft.com]

Step 2: Enable Browser Access

Once Cowork is available:

In the Microsoft 365 Admin Center, go to Copilot.
Select Settings.
Choose View all.
Locate the Cowork settings.
Turn on Allow browser access.
Save the changes.

Microsoft notes that Browser Use is turned off by default and must be explicitly enabled by an administrator.

Step 3: Verify User Requirements

Each user must meet the following requirements before Browser Use will work:

Have a Microsoft 365 Copilot licence assigned.
Have access to Copilot Cowork.
Have Microsoft Edge installed.
Be running a current version of Edge.
Be signed into Edge using the same work or school account used for Copilot.
Use Cowork in a supported browser experience rather than an unsupported client. [learn.microsoft.com]

Step 4: Launch Copilot Cowork

The user can then:

Open Microsoft 365 Copilot.
Launch Copilot Cowork.
Enter a request that requires interaction with a website.

For supported tasks, Cowork can use a hidden Microsoft Edge session running on the user’s device to interact with websites and web applications whilst keeping the user within the Copilot conversation experience. [learn.microsoft.com]

Step 5: Accept First-Run Consent

The first time Browser Use is invoked, users are presented with a consent prompt explaining:

Browser Use is currently in preview.
The feature can perform actions on the user’s behalf.
AI-generated actions may not always be perfect.
Sensitive actions may still require user confirmation.

Users must accept this prompt before Browser Use becomes available.

Step 6: Start with Low-Risk Scenarios

My recommendation is to begin with simple information-gathering tasks rather than business-critical transactions. Good examples include:

Looking up information in customer portals.
Checking ticket or order status.
Gathering information from vendor websites.
Researching data across multiple web-based systems.

As confidence grows, organisations can gradually expand usage to more complex workflows. This allows users to understand where the technology adds value while maintaining appropriate oversight.

If the process needs assistance while browsing it will pause and you will see something like:

Practical Tip: If Browser Use isn’t working, check the basics first. In my experience the most common causes are that Cowork billing hasn’t been enabled, Browser Access hasn’t been switched on by an administrator, or the user isn’t signed into Microsoft Edge with the same account they use for Copilot. [learn.microsoft.com]

Stop Azure Billing Surprises: How to Set Up Budget and Cost Alerts for Copilot Chat, Copilot Cowork and Azure AI

One of the biggest concerns I hear from people experimenting with Microsoft Copilot, Copilot Cowork, Azure AI Foundry, Azure OpenAI and other Azure services is:

“How do I stop unexpected Azure charges?”

This concern is becoming even more important as more Microsoft AI services move to a consumption-based pricing model. Features such as Copilot Cowork can consume Azure resources behind the scenes, and without monitoring in place, costs can creep up before you realise it.

The good news is that Azure provides built-in tools to help you stay in control. With about 10 minutes of configuration, you can create budget alerts and anomaly detection that will notify you before costs become a problem.

Here’s how I recommend every Azure user configure cost controls.

Why This Matters

Many Azure services charge based on usage. Examples include:

Microsoft 365 Copilot PAYG features
Copilot Cowork
Azure AI Foundry
Azure OpenAI
Azure AI Search
Virtual Machines
Storage services
Networking services

The danger isn’t usually the individual cost. The danger is forgetting something is running or not noticing a new workload starts consuming more resources than expected.

A few simple alerts can provide an early warning long before a large bill arrives.

Step 1: Create a Monthly Budget

Start by opening the Azure portal and navigating to:

Cost Management + Billing
→ Cost Management
→ Budgets

Select:

+ Add

Configure the Budget

Enter a meaningful name such as:

Monthly Azure Budget

Choose:

Reset Period = Monthly

Set the start date to today or the first day of the current month.

Now decide on a budget amount.

For most users I suggest:

AU$50 for light experimentation
AU$100 for regular testing
AU$200 for heavier AI workloads

If you’re just getting started with Copilot Cowork or Azure AI services, AU$100 per month is a sensible starting point.

Click Next to configure alerts.

Step 2: Create Budget Alerts

Budget alerts notify you when your spending reaches specific percentages of your budget.

Rather than waiting until you hit the limit, configure several warning levels.

Alert 1

Create:

Type: Actual Cost
Threshold: 50%

If your budget is AU$100 you’ll receive an alert at AU$50.

Alert 2

Create:

Type: Actual Cost
Threshold: 75%

You’ll receive an alert at AU$75.

Alert 3

Create:

Type: Actual Cost
Threshold: 90%

This provides a final warning before reaching your budget.

Alert 4

This is the most important alert.

Create:

Type: Forecast Cost
Threshold: 100%

Forecast alerts use Azure’s spending predictions.

This means Azure can tell you:

“At your current spend rate, you’re likely to exceed your budget before the end of the month.”

This often gives you warning before you actually spend the money.

Configure Email Notifications

For each alert enter your email address:

admin@yourdomain.com

You can add multiple recipients if needed.

Unless you’re planning advanced automation, leave:

Action Group = None

Email notifications are sufficient for most users.

Once all four alerts have been configured, create the budget.

Step 3: Configure Cost Anomaly Alerts

Budget alerts are excellent for gradual overspending.

However, they won’t necessarily detect sudden spending spikes.

That’s where anomaly alerts come in.

Navigate to:

Cost Management + Billing
→ Cost Management
→ Cost Alerts

Select:

+ Add

Configure the Alert

Choose:

Alert Type = Anomaly

For the view select:

Daily anomaly by resource group

This tells Azure to look for unusual spending patterns across your subscription.

Configure the Notification

Use a descriptive subject such as:

Cost anomaly detected in Azure subscription

Add your notification email address:

admin@yourdomain.com

Optionally enter a custom message such as:

Review Azure spending immediately and investigate the source of the anomaly.

Create the alert.

How Anomaly Detection Helps

Imagine your Azure environment normally costs:

AU$2 per day

Then one day:

A GPU virtual machine is left running
An Azure AI deployment starts processing large workloads
Azure AI Search is accidentally overprovisioned
Copilot-related services begin consuming significantly more resources

Azure notices the unusual increase and generates an alert.

Instead of discovering the issue weeks later, you’ll know almost immediately.

Step 4: Identify What Is Actually Spending Money

Once alerts are configured, the next step is understanding where your money is going.

Open:

Cost Management
→ Cost Analysis

Change:

Group By = Resource Group

to:

Group By = Resource

This simple change provides much more useful information.

Instead of seeing:

copilot-rg

you’ll see the actual resources generating costs such as:

Azure AI Search
Storage Accounts
AI Deployments
Virtual Machines
Managed Disks
Public IP Addresses

This makes troubleshooting much easier.

Step 5: Don’t Forget Compute Services

The most common cause of unexpected charges is running compute resources.

Pay particular attention to:

Virtual Machines
Azure AI Foundry deployments
Azure AI Search services
GPU resources
Azure OpenAI deployments

Where possible, enable automatic shutdown on virtual machines and remove unused resources.

Final Thoughts

The rise of AI services such as Copilot Cowork means more organisations will encounter consumption-based Azure costs. That’s not a reason to avoid these tools. It simply means spending should be monitored in the same way we monitor security, backups and availability.

The combination of:

Monthly budget alerts
Forecast alerts
Cost anomaly detection
Regular cost analysis reviews

provides an effective safety net for most users.

If you’re experimenting with Copilot Cowork, Azure AI Foundry or any other Azure AI services, I strongly recommend configuring these controls before you start serious testing. A few minutes of setup today can save a lot of surprises at the end of the month.