Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To limit what Microsoft Scout can access, start at Settings > Permissions. There you can turn off capability groups, control which shell commands run automatically or require approval, and mark specific files or folders as sensitive. Administrators can enforce broader device-level restrictions, including workspace-only file and shell access, browser destination blocks, and approval for non-read actions.
Scout is documented as a preview feature, so settings and availability may change. Confirm the controls in your deployed client and current Microsoft documentation.
What can you control in Scout’s Permissions settings?
The main user-facing controls are in Settings > Permissions. Microsoft documents four capability groups there: File System Access, Shell, Browser Control and Web Browsing, and WorkIQ. Turning off a category makes its tools unavailable to Scout; Microsoft says disabled-category tools do not appear in the system prompt. Microsoft’s Scout user guide describes the controls and their behavior.
- Turn off a category if Scout does not need that kind of access.
- Use shell patterns when you need some commands but not others.
- Use sensitive paths when Scout may work in a broader folder but should ask before touching particular files or directories.
How do shell command permissions work?
Scout sorts shell commands into three permission tiers. The treatment of an individual command can depend on the client version and applicable policy, so Microsoft’s examples should not be treated as a fixed list of defaults.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Tier | Effect |
|---|---|
| Auto-approve | The command runs without an approval prompt. |
| Prompt | Scout pauses and asks before running the command. |
| Deny | The command is blocked. |
In Settings > Permissions, you can add command patterns to allow or deny lists. Microsoft’s examples include allowing npm test or python *.py. Review allow patterns as carefully as deny patterns: a matching allow rule can make a command run automatically. Depending on policy and the action, sensitive operations may still require approval. See the Scout common questions and the user guide.
How can you protect selected files and folders?
Scout can use files in its workspace. When it first needs a folder outside the workspace—for example, Downloads or Documents—it asks for access. You can also designate files or directories as sensitive paths. Scout then needs explicit approval before reading or writing them, even if that operation would otherwise be auto-approved.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
This lets you permit routine project-file work while adding an approval step for locations containing credentials or private documents. Those are practical examples of how to use sensitive paths, not built-in Microsoft classifications. The user guide documents the path control.
Which restrictions can an administrator enforce?
Microsoft documents device-scoped Scout policies managed through Group Policy or Intune. The policies are stored under HKLMSOFTWAREPoliciesScout; standard users cannot change managed policies. The controls have different effects, so choose the policy that matches the boundary you need. See Microsoft’s administrative controls reference.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Policy | What it restricts |
|---|---|
ForcePrompt |
Requires approval for every non-read tool action, regardless of local approval preferences. |
DisabledServers |
Blocks tools provided by named tool servers. Documented examples include filesystem, playwright, and WorkIQ. |
DisabledPermissions |
Unconditionally denies selected permission kinds. Documented examples include shell, write, mcp, url, and custom-tool. |
RestrictToWorkspace |
Limits file system and shell access to the current workspace. |
BrowserEgressBlockedOrigins |
Blocks specified origins from browser automation traffic. |
DisableHeartbeat and DisableWorkflows |
Disable background Heartbeat or Automations. |
DisabledModels and DisabledProviders |
Block specified model IDs or providers. |
Browser-origin blocks are not a general network firewall
BrowserEgressBlockedOrigins applies to browser automation destinations, not all network traffic. The administrative template describes blocked origins as being denied by the browser context before a request leaves the device. It accepts an origin consisting of scheme and host, optionally with a port; entries with a path, query, or fragment are ignored. Consult the current template for exact syntax and behavior.
Does Scout get access to Microsoft 365 data?
Scout uses the signed-in user’s existing Microsoft 365 credentials and the access controls that apply to that account. It should not grant access to information the account itself cannot access. If needed, users can turn off the WorkIQ capability, and administrators can disable its tool server. Microsoft explains this in its responsible AI FAQ and administrator controls reference.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How should you handle Heartbeat and Automations?
Background modes have separate controls from interactive conversation settings. Administrators can disable Heartbeat or Automations, and Microsoft advises configuring their permissions separately. Its common questions page describes background modes as having a more restrictive permission policy than interactive conversations. Check the effective configuration for the particular workflow rather than assuming an interactive approval choice applies to it. See the responsible AI FAQ, administrator controls reference, and common questions.
Quick Recap
Which control should you choose?
| Need | Control to consider | Scope and effect |
|---|---|---|
| Remove an unnecessary capability | Turn off its category in Settings > Permissions | User-level setting; makes that group’s tools unavailable. |
| Allow some shell commands, but review or block others | Shell command patterns | Command-specific; can auto-approve, prompt, or deny matching commands. |
| Add approval for selected files or directories | Sensitive paths | Path-specific; requires approval before reads or writes. |
| Keep file and shell operations inside the project area | RestrictToWorkspace |
Administrator-enforced; confines file and shell access to the current workspace. |
| Require review of all non-read tool actions | ForcePrompt |
Administrator-enforced; prompts for every non-read tool action. |
| Block browser automation from named destinations | BrowserEgressBlockedOrigins |
Administrator-enforced; applies to specified browser origins, not general network traffic. |
| Restrict Microsoft 365 information | Account permissions; optionally disable WorkIQ | Uses the signed-in account’s existing access; WorkIQ can be disabled separately. |
| Stop background activity | DisableHeartbeat or DisableWorkflows |
Administrator-enforced; disables the corresponding background feature. |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
