Microsoft · AI answers
Copilot
User-triggered Microsoft Copilot fetches for AI answers. Blocking Copilot (or Bing preview UAs) keeps your pages out of Copilot citations.
- Operator
- Microsoft
- Traffic type
- AI answers
- Verification
- User-agent + IP range
- robots.txt
- Usually honors robots.txt
Usually means: Live fetches when someone asks an assistant a question. If these bots cannot reach the page, you cannot be the citation in that answer.
User-agent
robots.txt and most WAF rules match the token, not the full Mozilla string. Operators often wrap Copilot in extra product or version text.
Copilot
What Copilot does
When Copilot needs a live page to answer someone, Microsoft fetches it under Copilot-related user-agents. Bingbot still owns index discovery; this token is the in-product read.
How to get discovered
Allow Copilot and Bingbot, keep content in HTML Bing can already index, and avoid cloaking a different body to Microsoft UAs than you show people.
Why Copilot might skip you
Bot fights aimed at “AI crawlers” that also catch Copilot, or a robots Disallow copied from an OpenAI block list that accidentally includes Microsoft tokens.
robots.txt rule
Allow this token on public pages you want retrieved or cited. A CDN “Block AI bots” toggle can still 403 it after robots.txt says Allow.
# Keep Copilot eligible to fetch this site
User-agent: Copilot
Allow: /Allowlist so Copilot can reach you
A user-agent is spoofable. Microsoft publishes current CIDR ranges as JSON — fetch that file for WAF/CDN allowlists instead of copying ranges from a blog. Ranges rotate; a screenshot of ten prefixes will go stale. If Cloudflare “Block AI bots” is on, this is the list that gets the real crawler through.
https://www.bing.com/toolbox/bingbot.json ↗
Sources
JavaScript: render behavior is not documented.
Other Microsoft bots
Training, search, and user-fetch tokens from the same operator are not interchangeable. Allow the discovery path even when you opt out of training.
Copilot FAQ
What is Copilot?
When Copilot needs a live page to answer someone, Microsoft fetches it under Copilot-related user-agents. Bingbot still owns index discovery; this token is the in-product read.
Should I allow Copilot in robots.txt?
Yes if you want Microsoft to be able to fetch and cite this site. Blocking Copilot is how pages stay invisible to that product even when Googlebot still crawls them.
How do I know a request is really Copilot?
A user-agent is a claim anyone can send. Match the Copilot token, then check the source IP against Microsoft’s published ranges. Use those ranges as a WAF allowlist so a “Block AI bots” rule does not 403 the real crawler.
Letting Copilot in is the start. Getting cited is the job.
Rankealo checks whether AI crawlers can reach you, then publishes pages built to be retrieved and quoted in ChatGPT, Claude, Perplexity, and Gemini.
