GitHub Copilot docs.github.com/copilot ↗

Pin Plan Tier and Opt-In Features

Free/Pro/Pro+ data is opted into model training by default starting 24 April 2026; Business and Enterprise contractually exclude customer data + add audit logs, IP indemnification, content exclusions. Coding Agent, MCP, self-hosted runners are admin-gated.

Path: Enterprise/Org → Policies → Copilot → toggles for Chat, Coding Agent, MCP, model selection.

Tip: standardize on Business or Enterprise; review feature matrix quarterly and disable previews you're not actively governing.

Minimize Copilot Exposure Surface

Copilot is reachable from IDE, github.com chat panel, PR/issue @copilot mentions, CLI, mobile, MCP-connected tools. Copilot CLI, Coding Agent, and Agent Mode in Chat do not honor content exclusions.

Path: Org → Copilot → Policies → disable surfaces you do not use (CLI, mobile, Chat in .com, Coding Agent per repo).

Tip: enable Coding Agent only on opted-in repos; disable @copilot in public repos to prevent drive-by issue triggers.

Authentication and Identity

Copilot seats follow GitHub identity; SSO/SCIM enforcement on Enterprise gates Copilot access. Personal accounts using Copilot Free against company repos bypass enterprise telemetry.

Path: Enterprise → Authentication security → require SAML SSO + SCIM; Copilot → seat management restricted to SSO-verified users.

Tip: block personal-account access via IP allowlist + Enterprise Managed Users (EMU); require WebAuthn/passkeys for any account that can trigger the Coding Agent.

Coding Agent Isolation Boundaries

The Coding Agent runs in an ephemeral GitHub Actions runner, can only push to current PR branch or fresh copilot/* branch, and its PRs require human approval before workflows execute. Self-hosted runners (ARC) supported.

Path: Repo → Settings → Actions → "Require approval for all outside collaborators" + branch protection on main; Copilot → Coding Agent → choose GitHub-hosted vs self-hosted runner.

Tip: treat the agent like an external contributor — never add it as a bypass actor on rulesets; if using ARC, isolate the runner namespace and rotate the runner image daily.

Content Exclusions and MCP Allowlist

Content Exclusions stop Copilot completions/Chat from reading matched paths — but not the Coding Agent or CLI. The MCP allowlist controls which MCP servers any Copilot surface can connect to.

Path: Enterprise → Copilot → Content exclusions (glob: .env, **/secrets/**, IaC); Org → Copilot → MCP allowlist set to "explicit allow"; Repo → Copilot → Firewall = Enabled.

Tip: exclude secrets, infra, customer-data paths org-wide; allowlist MCP servers individually with pinned versions; never enable "Let repositories decide" for the firewall.

Credential and Secret Handling

The Coding Agent can commit secrets pasted into issues, accidentally embed API keys lifted from context, or write .env files into PRs. Push protection + secret scanning are the backstop.

Path: Repo → Security → Secret scanning + Push protection = ON; Org → Code security → require both for all repos; pre-commit gitleaks for IDE-side defense.

Tip: configure GHAS custom patterns for your own tokens; alert on any commit authored by copilot-swe-agent[bot] that touches .env*, *.pem, or CI secret files.

Treat .github/copilot-instructions.md as Code

Custom instruction files are auto-injected into every Copilot request in the repo. A malicious PR that edits copilot-instructions.md can silently rewire the assistant for every subsequent developer — highest-leverage prompt-injection vector.

Path: CODEOWNERS entry: /.github/copilot-instructions.md @security-team + branch protection requiring code-owner review on main.

Tip: require signed commits on these files, review diffs in security review, forbid applyTo: "**" patterns from untrusted contributors.

Prompt-Injection Defenses (CamoLeak Class)

CamoLeak (CVSS 9.6, disclosed Jun 2025, fixed Aug 2025) combined hidden HTML comments in PRs with Camo-proxy URL precomputation to exfiltrate private code as 1×1 pixel requests. GitHub disabled image rendering in Chat, but the class — untrusted markdown + agent with repo read + outbound channel — persists via MCP and Coding Agent firewall gaps.

Tip: never let the Coding Agent process issues from external contributors without human triage; apply Willison's "lethal trifecta" — strip outbound network from any agent that sees private code and untrusted text.

Update Cadence and Feature-Flag Governance

Copilot ships changes weekly; IDE extension, Chat backend, Coding Agent runner image update independently. Premium-request SKUs changed materially Sep–Dec 2025 (zero-dollar budgets removed; per-SKU tracking for Coding Agent from 1 Nov 2025).

Path: Enterprise → Policies → Copilot → "Block usage above budget" = ON; per-SKU budgets for Coding Agent.

Tip: subscribe to the GitHub Changelog RSS, gate preview features behind a pilot org, set hard premium-request budgets on Coding Agent to cap blast radius from a runaway agent loop.

Audit Logs and Monitoring

Enterprise plans expose a Copilot audit log covering policy changes, content-exclusion edits, MCP allowlist edits, Coding Agent task starts, seat assignments. Chat prompt/response content is not in the standard audit log.

Path: Enterprise → Settings → Audit log → stream to SIEM (Splunk/Sentinel/S3); enable copilot.* event categories; ingest Copilot Metrics API daily.

Tip: alert on copilot.cfb_* (Coding Agent firewall bypass), business.update_copilot_business_policy, copilot.content_exclusion_updated, and any Coding Agent run outside business hours from a non-pilot repo.