Copilot Credits: Configuring Your Spending Policies

The advanced features of Microsoft Copilot, formerly Microsoft 365 Copilot, can appear for users who have no credit budget. Before opening access, you need to decide who can consume, how much, and how to verify spending without confusing credits and euros.

Why the licence alone no longer frames spending

The user licence covers everyday Copilot usage. Advanced work falls under usage-based billing in Copilot Credits; access to these experiences also requires a user licence, according to the overview of the two billing models in Microsoft Learn. To tell this foundation apart from credits, see also our breakdown of licences, credits and agents.

Cowork, Code and Autopilot are among the entry points concerned. The scope of usage-based billing also includes Copilot experiences in SharePoint, apps hosted on Copilot Managed Runtime and the Work IQ API, as stated in the Microsoft Learn overview of Copilot Credits. A spending policy serves to cap consumption: it does not reserve credits for a service or a team.

Message center posts MC1479276 and MC1479277 announced, respectively, the rollout of this model in the fourth quarter of 2026 and the default visibility of certain new entry points. MC1479277 planned availability in October 2026 for standard customers and in November 2026 for customers on delayed rollout. Seeing an entry point therefore does not mean having a policy that authorises its use.

Defining scope, caps and permissions

Start with one Microsoft Entra ID security group, formerly Azure AD, per population to manage. According to the Microsoft Learn setup documentation, security groups are the way to target specific users or resource accounts. A policy applied to the whole organisation does not give the same control as a pilot limited to one group.

Then set a cap for the policy and a monthly cap per user. Microsoft Learn recommends at least 2,000 credits per user per month and asks you to size the policy cap at no less than the required minimum for the eligible users it covers. This multiplication helps prepare a budget; it does not allocate those credits individually.

Entrust creation to an authorised role, then give the finance lead a read role for monitoring. For model selection, do not promise model-by-model filtering: model profiles require at least two models, according to Microsoft Learn.

Configuring a policy in the admin centre

The procedure below goes through the portal: no cmdlet name or write endpoint is needed to apply an unverified configuration. Plan for a pilot group, its budget owner, an Azure subscription to use and caps expressed in credits.


Propagation delay: the cited resources give no figure to rely on after activation. Wait until the policy is visible in the portal, then check the experience of a group member and that of an excluded user before extending the targeting.

Implementation

This PowerShell script prepares and checks offline the caps of several policies; it creates nothing in the tenant. Required module: no external module, so no install command. Minimum permission to run it: no Microsoft 365 permission; to carry the plan over into the portal, use the creation role indicated above. The output is a simulation table; set $Exporter to $true after validation to produce a local CSV.

1# Simulation locale par défaut : aucune modification du locataire.
2$Exporter = $false
3$nombreTexte = Read-Host 'Nombre de politiques à préparer'
4[int]$nombre = 0
5if (-not [int]::TryParse($nombreTexte, [ref]$nombre) -or $nombre -lt 1) {
6    throw 'Saisissez un nombre de politiques supérieur à zéro.'
7}
8 
9$plan = @()
10for ($i = 1; $i -le $nombre; $i++) {
11    # Saisir les données à vérifier avant de les reporter dans le portail.
12    $groupe = Read-Host "Nom du groupe de sécurité de la politique $i"
13    if ([string]::IsNullOrWhiteSpace($groupe)) { throw 'Le groupe est obligatoire.' }
14 
15    $effectifTexte = Read-Host 'Nombre d’utilisateurs admissibles'
16    [int]$effectif = 0
17    if (-not [int]::TryParse($effectifTexte, [ref]$effectif) -or $effectif -lt 1) {
18        throw 'Saisissez un effectif supérieur à zéro.'
19    }
20 
21    $limiteTexte = Read-Host 'Plafond mensuel par utilisateur, en crédits'
22    [long]$limiteUtilisateur = 0
23    if (-not [long]::TryParse($limiteTexte, [ref]$limiteUtilisateur) -or $limiteUtilisateur -lt 1) {
24        throw 'Saisissez un plafond utilisateur supérieur à zéro.'
25    }
26    if ($limiteUtilisateur -lt 2000) {
27        Write-Warning 'Ce plafond est inférieur à la recommandation Microsoft de 2 000 crédits.'
28    }
29 
30    $politiqueTexte = Read-Host 'Plafond mensuel de la politique, en crédits'
31    [long]$limitePolitique = 0
32    if (-not [long]::TryParse($politiqueTexte, [ref]$limitePolitique) -or $limitePolitique -lt 1) {
33        throw 'Saisissez un plafond de politique supérieur à zéro.'
34    }
35    $minimumIndicatif = [long]$effectif * $limiteUtilisateur
36    if ($limitePolitique -lt $minimumIndicatif) {
37        throw "Plafond insuffisant pour le dimensionnement retenu : $minimumIndicatif crédits."
38    }
39 
40    $pourcentageTexte = Read-Host 'Seuil d’alerte souhaité, en pourcentage'
41    [int]$pourcentage = 0
42    if (-not [int]::TryParse($pourcentageTexte, [ref]$pourcentage) -or
43        $pourcentage -lt 1 -or $pourcentage -gt 100) {
44        throw 'Saisissez un pourcentage compris entre 1 et 100.'
45    }
46 
47    # Le seuil calculé aide à reporter une alerte en crédits dans le portail.
48    $alerteCredits = [long][math]::Ceiling(($limitePolitique * [double]$pourcentage) / 100)
49    $plan += [pscustomobject]@{
50        Groupe = $groupe
51        Utilisateurs = $effectif
52        PlafondUtilisateur = $limiteUtilisateur
53        PlafondPolitique = $limitePolitique
54        MinimumIndicatif = $minimumIndicatif
55        AlerteCredits = $alerteCredits
56    }
57}
58 
59$plan | Format-Table -AutoSize
60if ($Exporter) {
61    # Export facultatif : refuser d’écraser un plan déjà enregistré.
62    $chemin = Join-Path -Path (Get-Location).Path -ChildPath 'plan-politiques-credits-copilot.csv'
63    if (Test-Path -LiteralPath $chemin) { throw "Le fichier existe déjà : $chemin" }
64    $plan | Export-Csv -LiteralPath $chemin -NoTypeInformation -Encoding UTF8
65    Write-Output "Plan exporté : $chemin"
66}

For example, in an illustrative pilot with four users, an individual cap of 2,000 credits leads to checking an indicative minimum of 8,000 credits for the policy. This calculation is neither a reservation nor an invoice forecast: confirm the actual group members and the rate that applies under your contract before activation.

Checking consumption without confusing it with the invoice

The documented order of use is prepaid capacity, then the P3 prepurchase plan, then pay-as-you-go. Microsoft Learn specifies that P3 sits on top of pay-as-you-go: it is not a standalone mode that guarantees continuity. Without pay-as-you-go enabled, exhausting the credit sources blocks requests. This choice deserves an explicit budget agreement, not a box ticked out of reflex.

In the admin centre, review the Overview and Consumption tabs for each policy. Then compare them with Azure Cost Management without expecting identical amounts: Microsoft Learn states that prepaid capacities do not appear there. The admin centre and the Cost Management API present credits, not prices; the “amortised cost” view helps spread the P3 purchase over the term of the plan. Cowork, Copilot Studio or Work IQ credits may appear under the Microsoft Copilot Studio service on the invoice.

For the monthly review, therefore, reconcile policy scope, period, credit source and invoice presentation. Our Copilot Cowork monitoring guide extends this tracking for one of the experiences concerned.

Troubleshooting denials and tracking discrepancies

When a user reports being blocked, start with their applicable policy and cap, before examining the invoice. The table separates an expected denial from a reporting discrepancy.

If several policies apply to the same person, also check the purchase channel. The Partner Center documentation on Copilot Business states that, for customers going through a partner, the least restrictive policy applies; an unlimited policy always wins. This selection behaviour does not mean that a user who has exhausted their policy automatically switches to another.

Frequently asked questions

Is a Copilot licence enough to use advanced work?

No. The licence covers the user foundation; advanced experiences billed in credits also require a policy and a usable credit source. Seeing an entry point in the app does not prove that access is authorised.

What happens when a user reaches their limit?

They lose access to the agents and services concerned until credits reset on the 1st of the month, according to Microsoft Learn. They can request additional credits, but the system keeps them on their assigned policy instead of moving them to another.

Can a profile be limited to a single model?

No, not with the model profiles described in the setup documentation: a profile must contain at least two models. Check this prerequisite before promising a single-model selection to a pilot team.

Validating the pilot before widening access

Have the budget owner approve the cap and the pay-as-you-go choice. If continuity matters more than an automatic stop, explicitly document the use of pay-as-you-go; if a strict stop is required, test the behaviour after credit sources are exhausted within your pilot scope.

Start with a single population and log the denied access requests: they show where to extend the scope, without turning a user request into an implicit spending authorisation.

Going further

• Manage usage-based billed AI experiences — policy creation and behaviour at caps.
• Monitor Copilot Credits spending — reading dashboards and edge cases.
• Compare the admin centre with the Azure invoice — consumption order and differences between views.
• Understanding Copilot Credits pricing — a follow-up on the usage-based billing model.