Copilot Enterprise Setup: A Practical Guide
If you’re rolling out Copilot to a team larger than five people, you’re not just installing an extension—you’re implementing infrastructure. Most “setup guides” skip over the parts that actually matter: SSO integration, permission scoping, and controlling what your code gets sent to Microsoft’s servers.
This guide covers what enterprise Copilot deployment looks like in 2026. I’ll walk through the actual configuration steps, show you the settings that matter, and point out where the documentation leaves you hanging.
## What You’re Actually Deploying
Copilot Enterprise sits between your developers and GitHub’s inference servers. When a developer accepts a suggestion, their code context—file paths, open tabs, recent edits—gets sent to Microsoft’s models. The enterprise tier gives you control over that flow.
Three components matter:
– **Copilot in the IDE** (VS Code, JetBrains, Visual Studio)
– **Copilot in GitHub** (GitHub.com/copilot)
– **Copilot Enterprise dashboard** (admin.github.com/copilot)
The dashboard is where you’ll spend most of your time. That’s where you configure organization access, manage seat assignments, and set policies.
## Prerequisites and Requirements
Before you touch the dashboard, verify these:
– **Organization owner or billing manager role** in GitHub
– **SSO provider configured** (SAML or OIDC)—GitHub supports Okta, Azure AD, OneLogin, and others
– **GitHub Enterprise Cloud** subscription (Copilot Enterprise requires this, not Enterprise Server)
– **Minimum 25 seats** for volume pricing (under 25, you’re on the per-seat plan)
Check your current subscription:
“`bash
# Using GitHub CLI to verify enterprise status
gh enterprise check
“`
If that fails, you don’t have Enterprise Cloud. Go to your organization settings, then Billing > Plans to upgrade.
## Setting Up Organization-Wide Access
Once you have Enterprise Cloud, the first real decision is whether Copilot applies to everyone or specific teams.
### Step 1: Enable Copilot for the Organization
1. Go to **admin.github.com > Copilot > Organization access**
2. Click **Enable Copilot for your organization**
3. Select **Organization-wide access** or **Team-based access**
Organization-wide means every member with a seat gets Copilot. Team-based lets you restrict to specific groups. For most shops, organization-wide is simpler.
### Step 2: Configure Default Policies
The critical settings live under **Policies**:
| Setting | Recommendation | Why |
|———|—————-|—–|
| Allow code suggestions | Enabled | This is the whole point |
| Filter matching code references | Enabled | Reduces copyright risk |
| Allow public code matching | Disabled (usually) | Keeps your code out of training |
| Telemetry collection | Review your compliance needs | Some orgs need this off |
The “filter matching code references” setting is the one most teams miss. When enabled, Copilot checks suggestions against public GitHub code and filters matches. Enable it unless you explicitly want the risk.
### Step 3: Set Up Team Assignments
If you’re doing team-based access:
“`yaml
# Example: teams-config.yaml for bulk assignment
teams:
– name: “backend-core”
copilot_seats: 15
policy: “full-access”
– name: “frontend-team”
copilot_seats: 10
policy: “full-access”
– name: “contractors”
copilot_seats: 0
policy: “deny”
“`
You can’t apply this via CLI directly—use the dashboard or the GraphQL API. The GraphQL approach scales better:
“`bash
# Assign Copilot seats via GitHub GraphQL API
gh api graphql -f query=’
mutation assignCopilotSeats($org: String!, $team: String!) {
assignCopilotSeatToTeam(organization: $org, team: $team) {
success
}
}
‘
“`
## Configuring Security and Privacy Settings
This is where enterprise Copilot diverges from the free tier. You need to understand what data leaves your environment.
### Data Handling
Copilot Enterprise sends the following to Microsoft’s servers:
– Open file names and paths
– Recent edit context (last ~2000 tokens)
– Cursor position and surrounding code
– Chat history (if using Copilot Chat)
It does **not** send:
– Repository contents (unless you explicitly use /reference)
– Private repos you don’t have access to
– Authentication tokens or secrets
### Privacy Controls
Under **admin.github.com > Copilot > Privacy**:
– **Code matching**: Toggle to filter public code matches
– **Telemetry**: Control whether Microsoft receives usage data
– **Content capture**: New in 2026—opt out of having your code improve Copilot models
For regulated industries, the content capture setting is non-negotiable. Flip it off:
“`bash
# Verify content capture status via API
gh api repos/{owner}/{repo}/copilot/settings –jq ‘.content_capture_enabled’
“`
If it returns `true`, go to the dashboard and disable it under Privacy > Improve Copilot.
### IP and Copyright
Microsoft provides indemnification for Copilot Enterprise users. This matters for legal, but you should still configure:
1. **Duplicate code detection** — set to “block” in policy settings
2. **Reference filtering** — already covered, but verify it’s on
3. **Audit logs** — enable under Copilot > Usage logs
The audit logs are your paper trail. They show who used Copilot, when, and what language. Useful for compliance, useful for debugging when something goes wrong.
## Managing Seats and Billing
Seat management happens in two places: the Copilot dashboard and the billing section.
### Adding Seats
You can assign seats manually or auto-provision. Manual is safer for controlled rollouts:
1. **admin.github.com > Copilot > Seat management**
2. Click **Assign seats**
3. Search for users or teams
4. Confirm assignment
Auto-provision automatically assigns seats to anyone with a GitHub identity in your org. Convenient, but harder to control costs.
### Billing in 2026
Copilot Enterprise pricing is $39/user/month with annual billing. Volume discounts start at 150 seats:
– 150-499 seats: 10% discount
– 500-999 seats: 20% discount
– 1000+ seats: Contact Microsoft for custom pricing
Monitor usage monthly:
“`bash
# Check current seat usage
gh api organizations/{org}/copilot/usage –jq ‘.seat_usage | {total, assigned, available}’
“`
If you’re consistently under 80% utilization, you’re overbuying. If you’re at 100%, you’re probably denying seats to people who need them.
### Deprovisioning
When someone leaves, remove their seat promptly. There’s no grace period—you pay for assigned seats whether they log in or not.
“`bash
# Remove seat via API
gh api -X DELETE organizations/{org}/copilot/seats/{username}
“`
Do this as part of your offboarding checklist, not as a separate process.
## Troubleshooting Common Issues
Things break. Here’s what actually fails:
### “Copilot is not available for this organization”
You’re probably on GitHub Enterprise Server, not Enterprise Cloud. Copilot Enterprise requires the cloud version. There’s no workaround—migrate or use the individual Copilot tier (not enterprise).
### Users can’t see Copilot in their IDE
Check three things:
1. **Seat assigned** — verify in Seat management
2. **IDE extension updated** — force update via `Extensions > Check for Updates`
3. **GitHub authentication** — user must be logged into GitHub in the IDE
### Suggestions are low quality or missing
This usually means Copilot isn’t getting enough context. Common causes:
– File too large (over 100KB, Copilot stops reading)
– Too many files open (context window fills up)
– Unsupported language (Copilot supports ~50 languages, not all equally)
### Billing confusion
If you see charges but seats show as unassigned, check **pending invitations**. Invited but not accepted seats still bill.
## Key Takeaways
– Copilot Enterprise requires GitHub Enterprise Cloud, not Enterprise Server
– Enable “filter matching code references” under Policies to reduce copyright risk
– Disable “content capture” under Privacy for regulated environments
– Use audit logs—they’re your compliance paper trail
– Remove seats immediately when users leave to stop billing
## Next Steps
1. **Verify your subscription** — confirm you’re on Enterprise Cloud
2. **SSO first** — configure SAML/OIDC before assigning seats
3. **Pilot with one team** — pick a team that will actually use it and report issues
4. **Set up billing alerts** — monitor seat utilization monthly
5. **Document the policy** — write a one-page guide for developers on what’s acceptable use
If you’re handling this for more than 500 developers, consider a dedicated Copilot admin. The configuration isn’t complex, but the volume of seat management and policy exceptions becomes a job in itself.
