How to Set Up GitHub Copilot for Enterprise Organizations

Deploying GitHub Copilot across an enterprise organization requires careful planning around licensing, security policies, SSO integration, and compliance. This guide walks through the complete setup process for Copilot Business and Enterprise plans.

Understanding Copilot Plans for Organizations

Before deployment, choose the right plan for your organization:

Cost Tip: Users consuming more than 800 premium requests monthly would save money on a Copilot Enterprise plan.

Prerequisites

Before beginning the setup:

• For Copilot Business: An existing GitHub organization or the ability to create an enterprise account
• For Copilot Enterprise: An active GitHub Enterprise Cloud subscription
• Enterprise Owner or Organization Owner permissions
• Access to your identity provider (IdP) for SSO configuration (optional but recommended)
• Firewall/proxy allowlist access (if applicable)

Step 1: Enable Copilot at the Enterprise or Organization Level

Option A: Enterprise-Level Assignment (Recommended for Large Organizations)

Enterprise-level management provides centralized control over Copilot licenses across all organizations:

1. Navigate to your enterprise at https://github.com/enterprises/YOUR_ENTERPRISE

2. Click Settings in the left sidebar

3. Select Copilot under the "Code, planning, and automation" section

4. Click Enable Copilot

5. Choose your plan:

   • Copilot Business: $19/user/month
   • Copilot Enterprise: $39/user/month (requires Enterprise Cloud)

6. Select the assignment approach:

   • Assign licenses directly to users: Best for organizations wanting centralized control without requiring organization membership
   • Enable for organizations: Allows organization owners to manage their own seat assignments

Option B: Organization-Level Setup

For smaller deployments or when you want organization owners to manage their own Copilot access:

1. Go to your organization at https://github.com/YOUR_ORG
2. Click Settings > Copilot
3. Click Enable Copilot or Get Copilot from enterprise (if your enterprise has Copilot enabled)
4. Choose between Copilot Business or Copilot Enterprise

Option C: Standalone Enterprise for Copilot Business

If you do not already have GitHub Enterprise Cloud but want enterprise-grade identity management:

1. Create a dedicated enterprise account for Copilot licensing at https://github.com/account/enterprises/new
2. This approach provides:
   • Enterprise-grade SSO and SCIM integration
   • Centralized license management
   • No requirement for GitHub Enterprise licenses per user
3. Configure SAML SSO (optional but recommended - see Step 3)

Step 2: Configure Copilot Policies

Organization owners can configure policies that affect all Copilot users within their organization.

Access the Policy Settings

1. Navigate to your organization settings
2. Under "Code, planning, and automation", click Copilot
3. Click Policies

Key Policy Settings

Suggestions Matching Public Code

Controls whether Copilot can suggest code that matches publicly available code:

• Allowed: Copilot may suggest code matching public repositories
• Blocked: Copilot checks suggestions against ~150 characters of surrounding code and blocks matches or near-matches

Recommendation: Set to Blocked for organizations with strict IP protection requirements.

Copilot > Policies > Suggestions matching public code: Blocked

Copilot in GitHub.com (Enterprise Only)

Enable or disable Copilot Chat on GitHub.com:

• Enabled: Users can access Copilot Chat throughout GitHub.com
• Disabled: Chat only available in IDEs

Additional sub-options when enabled:

• Opt in to user feedback collection: Allows users to provide feedback on Copilot features
• Opt in to preview features: Enables access to beta features not yet generally available

Copilot CLI Access

Control whether organization members can use Copilot CLI:

• Enabled: CLI access for assigned users
• Disabled: CLI functionality blocked regardless of individual user settings

Enterprise vs. Organization Policy Hierarchy

Important: If your organization is part of an enterprise with explicitly configured policies, you cannot override those settings at the organization level.

• Enterprise sets Enabled: Organizations can choose Enabled or Disabled
• Enterprise sets Disabled: Organizations cannot enable the feature
• Enterprise sets Unconfigured: Organization policy defaults to Disabled (as of November 2025 policy update)

Step 3: Configure SAML Single Sign-On (SSO)

SSO configuration ensures users authenticate through your corporate identity provider before accessing Copilot.

Enterprise-Level SAML Configuration

1. Navigate to your enterprise settings
2. Under "Settings", click Authentication security
3. Select Require SAML authentication
4. Configure your IdP settings:

Microsoft Entra ID (Azure AD) Example

In Entra ID:

1. Go to Enterprise Applications > New Application
2. Search for GitHub Enterprise Cloud
3. Under Single sign-on, select SAML
4. Configure Basic SAML settings:

Identifier (Entity ID): https://github.com/orgs/YOUR_ORG
Reply URL: https://github.com/orgs/YOUR_ORG/saml/consume
Sign on URL: https://github.com/orgs/YOUR_ORG/sso

5. Download the Federation Metadata XML
6. In GitHub, upload the metadata or manually configure:
   • Sign on URL
   • Issuer
   • Public certificate

Enterprise Managed Users (EMU)

For the highest level of identity control, use Enterprise Managed Users:

1. All user accounts are provisioned through your IdP via SCIM
2. Users sign in exclusively through your IdP (no personal GitHub accounts)
3. Provides full control over the user lifecycle

Supported IdPs for EMU:

• Microsoft Entra ID
• Okta
• PingFederate
• Any SAML 2.0 + SCIM 2.0 compliant system

Organization-Level SAML

If you need SCIM provisioning without enterprise accounts:

Organization Settings > Security > Authentication security > Enable SAML authentication

Note: Organization-level SAML is required if you want to use SCIM provisioning without Enterprise Managed Users.

Step 4: Configure Content Exclusion

Prevent Copilot from accessing sensitive files and repositories.

Organization-Level Exclusion

1. Go to Organization Settings > Copilot > Content exclusion
2. Add paths to exclude:

# Exclude all files in secrets directory
- "/**/secrets/**"

# Exclude environment files
- "**/.env"
- "**/.env.*"

# Exclude specific repositories
- "org-name/sensitive-repo/**"

# Exclude configuration files
- "**/config/production/**"
- "**/*.pem"
- "**/*.key"

Repository-Level Exclusion

Repository administrators can add exclusions in their repository settings:

1. Go to Repository Settings > Copilot > Content exclusion
2. Add repository-specific patterns

Exclusion Hierarchy

• Enterprise rules apply to all Copilot users in the enterprise
• Organization rules apply to users with seats assigned by that organization
• Repository rules apply to that specific repository

Note: Content exclusion does not currently apply to Copilot CLI, Copilot coding agent, or Agent mode in Copilot Chat.

Step 5: Set Up Audit Logging

Copilot audit logs help you track usage, policy changes, and compliance.

Accessing Audit Logs

Organization Level

1. Click your profile photo > Your organizations
2. Select your organization > Settings
3. Under "Archives", click Logs > Audit log

Enterprise Level

1. Click your profile photo > Your enterprises
2. Select your enterprise > Settings
3. Click Audit log in the sidebar

Searching Copilot Events

Use the action:copilot qualifier to filter Copilot-specific events:

# All Copilot events
action:copilot

# Seat assignments
action:copilot.cfb_seat_assignment_created

# Seat removals
action:copilot.cfb_seat_cancelled

# Policy changes
action:copilot.cfb_seat_management_changed

# Enterprise enablement changes
action:copilot.enable_copilot_for_enterprise_changed

Key Audit Events

Exporting Audit Logs

1. Apply your filters using search qualifiers
2. Click the Export dropdown
3. Choose JSON or CSV format

Enterprise Cloud users can also access logs programmatically:

• GraphQL API
• REST API

Log Retention

Audit logs are retained for 180 days. For longer retention:

• Export logs regularly to your SIEM
• Use the API to automate exports
• Configure log streaming to external services

Step 6: Deploy to Users

Option A: Enable for All Organization Members

1. Go to Organization Settings > Copilot > Access
2. Under "Seat management", select Enabled for all members
3. All current and future organization members automatically receive access

Option B: Enable for Specific Users/Teams

1. Go to Organization Settings > Copilot > Access
2. Select Enabled for selected members
3. Click Add user or Add team to grant access
4. Search and select users or teams

Option C: Enterprise Teams (Public Preview)

For enterprise-level user management:

1. Navigate to enterprise settings > Teams
2. Create Enterprise Teams grouping users across organizations
3. Assign Copilot licenses to entire teams
4. Users do not need organization membership to receive licenses

Self-Service Model

Many successful rollouts use self-service:

1. Create a request process (GitHub Issue template, internal ticketing)
2. Organization owner or enterprise admin approves and assigns
3. Users can request at https://github.com/settings/copilot and click "Get Copilot from an organization"

Step 7: Configure Network Access

If your organization uses firewalls or proxy servers, ensure Copilot can communicate with GitHub services.

Required URLs to Allowlist

Add these URLs to your firewall/proxy allowlist:

Note: The complete and current allowlist is available in the GitHub Copilot allowlist reference.

Subscription-Based Network Routing

For Enterprise plans, you can use network routing to control access:

• Allow: Add copilot-proxy.githubusercontent.com to allowlist
• Block: Remove the URL to prevent Copilot Enterprise usage on your network

Proxy Configuration

Users behind corporate proxies may need additional configuration in their IDE settings or environment variables. See the proxy server and firewall settings documentation.

Custom SSL Certificates

If your organization uses SSL inspection:

1. Export your organization's root CA certificate
2. Install on developer machines
3. Configure IDEs to trust the certificate

Step 8: Platform-Specific Deployment

macOS Deployment

MDM Distribution (Jamf, Kandji, etc.):

1. Download the Copilot CLI package or create a custom package
2. Deploy via your MDM solution
3. Use a post-install script for authentication:

#!/bin/bash
# Pre-configure environment for managed deployment
# Users still need to authenticate individually

# Add to /etc/paths.d/ for system-wide CLI access
echo "/usr/local/bin" >> /etc/paths.d/copilot-cli

Homebrew with Managed Deployment:

# Install Homebrew if not present
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

# Install Copilot CLI
brew install copilot-cli

Windows Deployment

Group Policy / SCCM / Intune:

1. Create a deployment script:

# Silent installation via WinGet
winget install GitHub.Copilot --silent --accept-package-agreements --accept-source-agreements

2. For environments without WinGet, use npm:

# Requires Node.js pre-installed
npm install -g @github/copilot

PowerShell Requirements: Ensure PowerShell 6+ is deployed. Windows 11 ships with 5.1 by default.

Linux Deployment

Ansible Playbook Example:

- name: Install GitHub Copilot CLI
  hosts: developer_workstations
  tasks:
    - name: Install via npm
      npm:
        name: "@github/copilot"
        global: yes
        state: present
      when: ansible_os_family == "Debian" or ansible_os_family == "RedHat"

    - name: Alternative - Install via script
      shell: curl -fsSL https://gh.io/copilot-install | bash
      args:
        creates: /usr/local/bin/copilot

Package Manager Options:

# Install script (recommended)
curl -fsSL https://gh.io/copilot-install | bash

# npm (requires Node.js)
npm install -g @github/copilot

# Homebrew (if available)
brew install copilot-cli

Step 9: Monitor and Optimize

Usage Metrics

Track Copilot adoption and usage:

1. Go to Organization Settings > Copilot > Overview
2. Review metrics including:
   • Active users
   • Suggestions accepted
   • Lines of code from suggestions

Identifying Underutilized Seats

Regularly review seat utilization to optimize costs:

1. Check the Access page for users who have not activated Copilot
2. Consider reassigning seats from inactive users
3. Set up automated reminders for users who have not onboarded

Gathering Feedback

Enable feedback collection to improve your deployment:

1. Enable Opt in to user feedback collection in policies
2. Create internal channels for users to share experiences
3. Use feedback to refine policies and training

Compliance Considerations

SOC 2 Compliance

GitHub provides SOC 2 Type II compliance reports for Copilot Business and Enterprise. Request reports through your GitHub account representative.

GDPR and Data Residency

• Copilot does not store prompts or suggestions after processing
• Code context is processed in real-time and not retained
• Enterprise customers can work with GitHub on specific data residency requirements

Audit Documentation

Maintain documentation for auditors:

1. Access controls: SSO configuration, role-based access
2. Audit logs: Regular exports showing Copilot activity
3. Policy configuration: Screenshots or exports of policy settings
4. User lifecycle: SCIM provisioning records

Next Steps

After completing the setup:

1. Communicate to users: Announce Copilot availability and provide onboarding resources
2. Provide training: Share documentation and best practices
3. Establish guidelines: Create internal policies for Copilot usage
4. Monitor adoption: Track usage metrics and gather feedback
5. Iterate policies: Adjust content exclusions and settings based on organizational needs

Additional Resources

• GitHub Copilot Documentation
• Setting up GitHub Copilot for your enterprise
• Managing policies for Copilot in your organization
• Copilot allowlist reference
• Audit log events for your organization

Need help with your GitHub Copilot enterprise deployment? Inventive HQ offers comprehensive Copilot implementation services, from initial planning to organization-wide rollout. Contact us for a free consultation.