Copilot SEO: the technical guide to getting cited by Microsoft Copilot

How Copilot finds and cites sources#

Microsoft Copilot is one assistant on many surfaces: the web app at copilot.microsoft.com, the Windows, Mac and mobile apps, Copilot in Edge, and Copilot Search inside Bing, launched on April 4, 2025. From August 18, 2026 Microsoft began rolling out an updated Copilot app that takes personal and work accounts in one place, and its documentation now calls Microsoft 365 Copilot simply Microsoft Copilot. Whatever the surface, web answers are grounded the same way: in Bing.

Microsoft’s documents agree on the mechanism. Copilot’s transparency note, updated August 18, 2026, says that “for certain conversations where users seek information, Copilot is grounded in web search results” and “centers its response on high-ranking content from the web.” The work-account docs spell out the query step: Copilot writes a query of “a few words informed by the user’s prompt” and sends it to “the Bing search service.” And Bing’s Webmaster Guidelines say “Bing and Copilot search experiences rely on the same core crawling, indexing, and ranking foundation as traditional search.”

1. 1

   Copilot decides the answer needs the web

   Information-seeking conversations are grounded in web search, and a Search mode in the composer forces it. On work accounts, IT admins can turn web search off for a whole tenant, and each user has a Web content toggle.

2. 2

   It writes a few short Bing queries

   The query is a few words drawn from the prompt, not the prompt itself, unless the prompt is very short. Bing Webmaster Tools reports these as grounding queries: “grouped representations,” not users’ questions.

   Your lever: Title and head each page with the plain terms such a query would use: product names, category words, the problem it solves.

3. 3

   Bing retrieves groundable information

   Grounding runs on “the same crawlers, the same quality signals” as search, per Bing’s May 2026 post, but asks a different question: “what information can an AI system responsibly use to construct a response?” Pages whose content “stands on its own” are more likely to be selected.

   Your lever: Be indexed, canonical and fresh in Bing: a sitemap with honest lastmod, and IndexNow on every change.

4. 4

   Your meta tags set how much it may use

   noarchive keeps a page out of Copilot responses and grounding results. nocache limits Copilot to your URL, title and snippet. nosnippet and data-nosnippet hide captions and “may limit Copilot citation quality.”

   Your lever: Keep all of them off the pages you want quoted.

5. 5

   The answer shows its sources

   Cited sentences end in a pill with the source’s name, source cards sit under the answer, and Show all opens a References panel. Microsoft Advertising can also place ads in the same response.

   Your lever: Make your site name and page title unambiguous. They’re what the citation card shows.

What a Copilot citation looks like

In the Copilot app, a cited sentence ends in a small gray pill with the source’s name, plus a count such as “+2” when several sources back it. Under the answer sit source cards with favicon, site name and page title, and a Show all button that opens a References panel with “Related results” below it, as screenshots from Microsoft’s November 2025 search update show. In Bing, Copilot Search links “the entire sentence or passage” to its source, per its launch post, though in April 2026 Bing was seen testing links on the citation marker only.

Bingbot, and the Copilot crawler that doesn't exist#

Bing’s crawler list names five bots: Bingbot, AdIdxBot, BingPreview, MicrosoftPreview and BingVideoPreview. None is a Copilot fetcher, and Vercel had to leave Copilot out of its December 2024 crawler study because it “lacks a unique user agent for tracking.” Microsoft doesn’t document a live, per-conversation fetcher either; its removal help describes Copilot experiences as ones “that rely on Bing’s index.”

One Bing quirk matters in robots.txt: when Bingbot finds a group addressed to it, it “will ignore the directives listed in the generic section,” so every generic rule has to be repeated. Bing also caches robots.txt, so changes “can take a few hours” to apply.

# Bing's crawler: the only route into Copilot
User-agent: bingbot
Allow: /
Disallow: /cart/
Disallow: /account/
 
# A bingbot group replaces the * group for Bing,
# so every generic rule is repeated above.
User-agent: *
Disallow: /cart/
Disallow: /account/
 
Sitemap: https://www.example.com/sitemap.xml

The meta tags that control Copilot

Robots.txt only controls crawling. What Copilot may do with an indexed page is set by Bing’s robots meta tags, which also work as an X-Robots-Tag header, and can be scoped to Bing alone by writing name="bingbot" instead of name="robots". Bing’s guidelines and tag documentation give each one an explicit Copilot effect:

<!-- Out of Copilot answers and Microsoft AI training; stays in Bing search -->
<meta name="bingbot" content="noarchive">
 
<!-- Copilot may show only URL, title and snippet -->
<meta name="bingbot" content="nocache">
 
<!-- Keep one passage out of snippets and AI summaries -->
<div data-nosnippet>Internal pricing notes</div>

Two details trip people up. A page carrying both nocache and noarchive is treated as nocache, so it stays in Copilot at snippet depth. And noindex has to be seen to work: Bing says “do not block access to the page” in robots.txt, or the tag is never read. See snippet controls for how these compare with Google’s.

Before you allowlist Bingbot at a WAF, verify it: reverse-resolve the IP to a host ending in search.msn.com, then forward-resolve that host back to the same IP. Or match against bingbot.json, which Bing says to refresh daily because it can change at any time.

Bing is the gate: index, IndexNow and Webmaster Tools#

Because Copilot draws on Bing’s index, Bing indexing is the entry ticket that most Copilot advice skips. Bing’s guidelines, which Search Engine Journal reported rewritten in February 2026, list “grounding results and citations” next to indexing and ranking as what compliance earns, and warn that ignoring them can mean “reduced eligibility for grounding experiences, or delisting from the Bing index.” The setup:

1. Verify your site in Bing Webmaster Tools. You can import sites already verified in Google Search Console. AI Performance, URL Inspection and IndexNow reporting all live there.
2. Submit an XML sitemap with honest lastmod. Bing wants ISO 8601 date and time reflecting “the true last modification time of the page content,” reads sitemaps “typically at least once per day,” and takes up to 50,000 URLs per file. List only canonical URLs.
3. Turn on IndexNow. Ping when a URL is added, updated or removed. Bing says timely pings “reduce outdated or incorrect URL references in Copilot responses,” and prefers streaming submissions to batches.
4. Check what Bingbot sees. URL Inspection’s Live URL tab shows “exactly what the Bingbot sees while downloading a page from your site,” including any redirect it stops at.
5. Remove pages cleanly. Return 404 or 410, or add noindex, then send the change through IndexNow. The Block URLs tool hides a page for 90 days while that takes effect.
6. Local businesses: claim Bing Places. Microsoft’s AI Performance launch post points local businesses to Bing Places for Business to keep their details accurate in AI answers.

IndexNow is a shared protocol, not a Bing API. A submission is “automatically shared with all other participating search engines,” currently Bing, Yandex, Seznam, Naver, Yep, the Internet Archive and Amazonbot. Host the key as a text file at your root, then POST changes as they happen (a single URL can also go as a GET):

POST https://www.bing.com/indexnow
Content-Type: application/json; charset=utf-8
 
{
  "host": "www.example.com",
  "key": "3f6c9a1e2b7d4c58",
  "keyLocation": "https://www.example.com/3f6c9a1e2b7d4c58.txt",
  "urlList": [
    "https://www.example.com/pricing",
    "https://www.example.com/blog/new-post"
  ]
}
 
# Up to 10,000 URLs per POST. 200 or 202 = accepted,
# 403 = key not found, 422 = URL not on this host, 429 = slow down.

Technical requirements#

Copilot publishes no requirements of its own; Bing’s guidelines are the spec, and they now name Copilot and grounding throughout. Everything marked required or helps below comes from Microsoft’s own documents.

Bingbot allowedRequired

In robots.txt and at the CDN or WAF. Bing lists “Blocking Bingbot in your robots.txt file” among things to avoid, and Cloudflare’s Block setting now stops it too.

Indexed in BingRequired

Copilot experiences “rely on Bing’s index.” Confirm each target page in URL Inspection, not by assuming Google’s index carries over.

No `noarchive`Required

It “prevents content from being used in Copilot responses and grounding results.” Check CMS and paywall templates for it.

No `nocache` on citable pagesHelps

It limits Copilot to URL, title and snippet, “reducing citation depth and answer quality.”

Content in rendered HTMLHelps

Bingbot renders with current Edge, but Bing says to avoid “hiding critical content behind client-side rendering,” and Microsoft Advertising warns “AI systems may not render hidden content” in tabs or expandable menus.

Freshness signalsHelps

Accurate lastmod, HTTP validators such as ETags, and IndexNow pings. Bing says stale facts matter more in grounding than in search.

One canonical URLHelps

Duplicates “reduce Bing’s confidence in selecting a URL for grounding results or citations.” Use 301s for moves, not canonical tags.

Titles, descriptions, headingsHelps

Missing, duplicate or overly short titles and meta descriptions “may reduce... eligibility for grounding results and citations.”

Structured dataHelps

Bing says it “may support clearer grounding but does not guarantee visibility,” and must match visible content.

Text for images, video and PDFsHelps

Media shouldn’t be the only source of a fact. Microsoft lists relying on PDFs or images for core information as a visibility risk.

llms.txtUnconfirmed

Not mentioned in Bing’s guidelines or any Copilot documentation.

Two quick checks from the command line, then the definitive one in URL Inspection’s Live URL tab:

# 1. Is the key sentence in the HTML Bingbot downloads?
curl -s -A "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)" \
  https://yoursite.com/pricing | grep -c "Plans start at"
 
# 2. Is anything telling Copilot to stay away?
curl -sI https://yoursite.com/pricing | grep -i "x-robots-tag"
curl -s https://yoursite.com/pricing | grep -ioE '<meta[^>]+(robots|bingbot)[^>]*>'
 
# 0 in step 1 = client-rendered text or a WAF challenge. Bingbot renders
# JavaScript, but Bing says not to rely on it: treat 0 as a fix.

What Copilot cites#

Microsoft is unusually explicit about what grounding prefers: its guidelines devote a run of sections to content that is “easy to understand without external context.” The independent data adds a twist: Copilot’s citations lean hard toward retailers and reference sites, and overlap little with other engines.

• Bing eligibility first

  Official

  Crawl efficiency, indexing accuracy, URL consolidation and authority signals “also support” grounding eligibility. Nothing downstream works for a page Bing hasn’t indexed.

• Facts that stand on their own

  Official

  Pages are “more likely to be selected for grounding queries and citations when content stands on its own.” Microsoft Advertising says assistants like Copilot parse pages into “smaller, structured pieces” and favors “sentences that make sense even when pulled out of context.”

• Answer early, one topic per URL

  Official

  “Place essential information near the top” and avoid “long introductions.” URLs focused on one topic “are more likely to be selected for grounding results.”

• Unambiguous entities

  Official

  Consistent names for people, organizations, products and places improve “grounding visibility and citation accuracy,” per Bing. Describe the same product the same way in text, images and schema.

• Retail and reference sites dominate

  Observed

  In Ahrefs’ September 2026 snapshot of 3M+ US queries, Amazon took 16.8% of the citations earned by Copilot’s top 50 domains, Walmart 12.6% and Wikipedia 7.6%. YouTube had 1.9%; Reddit wasn’t in the top 50.

• Low-authority sites still get in

  Our read

  Three of Copilot’s 50 most-cited domains in that snapshot have an Ahrefs Domain Rating under 10. Relevance to the grounding query appears to count for more than domain strength.

• A different race from other engines

  Observed

  Bing’s Copilot answers shared 9.81% of cited domains with Google’s AI Overviews, 11.97% with Perplexity and 13.95% with ChatGPT, the lowest overlaps tested, and cited 3.13 links per answer, the fewest (SE Ranking, Feb–Mar 2025 data).

What not to try

Bing’s guidelines now carry a “Prompt Injection and AI Manipulation” section: content “designed to manipulate or interfere with language models used by Bing or Copilot may result in reduced visibility or removal.” Text written “to manipulate ranking systems or trigger citations,” scaled content without editorial review, and cloaking are on the same list. Bing also says plainly that “GEO does not guarantee grounding or citations in AI experiences.”

Measuring Copilot: citations, clicks and crawls#

Copilot is unusual in that its vendor tells you when you’re cited. Bing Webmaster Tools’ AI Performance report launched in public preview on February 10, 2026, and on June 16 added Intents, Topics, Citation Share and Compare, all labeled preview. Here’s what each place can and can’t show you:

Read AI Performance as a trend line, not a ledger: Microsoft says the data “represents a sample,” that “very low or infrequent citation activity may not surface,” and that a citation “does not represent traffic, clicks, or user engagement.” Its grounding queries are a rare look at the queries behind an AI engine’s answers. Export them monthly and map each to the page you want cited.

For clicks, Copilot has passed a copilot.microsoft.com referrer since at least March 2024, and its web app sets an origin-when-cross-origin referrer policy, so at most you see the host, never the conversation URL. Check where those sessions land in GA4; if any sit in Referral, add a custom channel above it:

# Session source — Copilot (copilot.com is now the app's canonical host)
^(www\.)?copilot\.(microsoft\.)?com$
 
# Session source — all major AI assistants
copilot\.microsoft\.com|copilot\.com|chatgpt\.com|perplexity\.ai|claude\.ai|gemini\.google\.com

Microsoft doesn’t document how clicks from the Windows and mobile apps are referred, so expect some Copilot visits in Direct. On the server side, watch Bingbot’s recrawl rate on your citable pages: after an IndexNow ping, a fresh Bingbot hit is the signal that Copilot’s source of truth has your update.

# Bingbot hits per page, most-crawled first
grep -i "bingbot" access.log | awk '{print $7}' | sort | uniq -c | sort -rn | head -20
 
# Verify an IP is really Bing: expect a host ending in search.msn.com,
# then check that host resolves back to the same IP
host 157.55.39.1
host <hostname-from-above>

Myths worth dropping#

The action checklist#

Everything above, in the order we’d do it. Tick items off as you go — your progress is saved in this browser.

Microsoft Copilot SEO: frequently asked questions#