Configure Content Exclusions

Content exclusions prevent Copilot from reading or suggesting code from specified file paths. This is critical for protecting sensitive files like environment variables, secrets, and proprietary algorithms.

Instructions

1. Navigate to your organization's Copilot settings:

   Go to your organization on GitHub, then Settings → Copilot.

2. Find the "Content exclusion" section.
3. In the "Repositories and paths to exclude" text box, enter exclusion rules in YAML format. Use "*": to apply to all repositories (and non-Git files), or a repository reference (e.g. YOUR-ORG/YOUR-REPO:) to scope to one repo. Each path must be on its own line as - "PATH". Comments start with #. Patterns use fnmatch notation and are case-insensitive.

   # Apply to all repositories and non-Git files
   "*":
     # Exclude environment files
     - "**/.env"
     - "**/.env.*"
   
   Exclude secrets and keys
       
   
       
       
           #
       
       
   
   
   “/secrets/”
   “/keys/”
   “**/*.pem”
   “**/*.key”
   
   
   Exclude internal/proprietary directories
       
   
       
       
           #
       
       
   
   
   “/internal/”
   “/proprietary/”
   
   
   Scope additional rules to a specific repository
       
   
       
       
           #
       
       
   
   YOUR-ORG/YOUR-REPO:
   
   “/src/proprietary/**”
   “secrets.json”

4. Click Save to apply the configuration.
5. Understand what content exclusions do:
   • Inline suggestions are not available in excluded files.
   • Excluded files are not used as context to inform inline suggestions in other files.
   • Excluded files are not used to inform Copilot Chat responses on supported surfaces.
   • Excluded files are not reviewed by Copilot code review.
   • Not supported in Copilot CLI, Copilot cloud agent (cloud agent), or Agent mode in Copilot Chat in IDEs — exclusions won't apply there.

Configure Duplication Detection

Duplication detection (also called the "duplication filter" or "suggestions matching public code") blocks Copilot from suggesting code that closely matches publicly available code on GitHub.

Instructions

1. In your org's Copilot settings, find "Suggestions matching public code".
2. The options are:
   • Allowed: Copilot may suggest code that matches public repositories
   • Blocked: Copilot filters out suggestions that match public code (~150 characters)
3. For enterprise use, set this to Blocked.
4. Critical relationship — IP Indemnity:
   • GitHub provides IP indemnity for Copilot suggestions (covers you if someone claims copyright infringement)
   • IP indemnity requires the duplication filter to be set to Blocked
   • If you set it to "Allowed," you lose IP indemnity protection

Review Audit Logs

Audit logs track Copilot-related events for compliance and security monitoring.

Instructions

1. Navigate to your organization's audit log:

   Go to your organization on GitHub, then Settings → Audit log.

2. Filter for Copilot events. In the search box, type:

   action:copilot

3. Review the types of events that appear. Common Copilot audit events include:
   • copilot.seat_added — A seat was assigned to a user
   • copilot.seat_removed — A seat was removed
   • copilot.content_exclusion_changed — Exclusion rules were modified
   • copilot.policy_changed — An org policy was updated
4. For programmatic access, note the audit log API endpoint:

   GET /orgs/{org}/audit-log?phrase=action:copilot

5. Audit logs can also be streamed to external SIEM tools (Splunk, Datadog, etc.) using audit log streaming.

Review Usage Metrics

Usage metrics help you track adoption, identify power users, and demonstrate ROI.

Instructions

1. Navigate to your org's Copilot usage metrics:

   Go to your organization on GitHub, then Settings → Copilot → Usage.

2. Review the key metrics:
   • Active users: How many seat holders actually used Copilot this month?
   • Suggestion acceptance rate: What percentage of suggestions were accepted?
   • Lines of code suggested vs. accepted: Raw productivity metric
   • Language breakdown: Which languages are most used with Copilot?
   • Editor breakdown: VS Code vs. JetBrains vs. Neovim, etc.
3. For the API approach, note the endpoint:

   GET /orgs/{org}/copilot/usage

4. Identify:
   • Which team members have the highest acceptance rates? (Potential Copilot champions)
   • Are there assigned seats with zero usage? (Consider reassigning)
   • Which languages show the highest acceptance rates? (Training focus areas)

Document Your Organization's Configuration

Create a reference document of your org's Copilot configuration for compliance reviews, onboarding, and periodic policy audits.

Instructions

1. Use Copilot Chat to draft a complete configuration template. Use this prompt:

   Generate a markdown template for documenting an organization's GitHub Copilot
   configuration. Include sections for:
   
   Plan & access
       
   
       
       
           #
       
       
   
   
   Plan tier (Free / Pro / Pro+ / Business / Enterprise) and seat count
   Seat assignment model (direct, team-based, auto-assign on request)
   SSO / SCIM provisioning posture (Enterprise)
   
   
   Content & IP protections
       
   
       
       
           #
       
       
   
   
   Content exclusion rules (org-level and per-repo) with rationale
   Suggestions matching public code: Allow or Block
   IP indemnity eligibility (derived: Business/Enterprise AND duplication filter = Block)
   
   
   Feature policies (org settings -> Copilot -> Policies)
       
   
       
       
           #
       
       
   
   
   Copilot in github.com
   Copilot Chat in the IDE
   Copilot CLI
   Copilot cloud agent
   Copilot code review
   Copilot Extensions
   MCP servers (and allowlist, if used)
   Model selection / multi-model picker
   Editor preview features
   
   
   Data, residency & network
       
   
       
       
           #
       
       
   
   
   Data residency (e.g. EU data residency for Copilot Enterprise, if applicable)
   Prompt & suggestion data handling (training opt-out is default on Business/Enterprise)
   Chat retention policy (check the Copilot Trust Center for the current period)
   Corporate proxy / firewall / certificate requirements for IDE Copilot
   
   
   Audit & monitoring
       
   
       
       
           #
       
       
   
   
   Audit log streaming target (Azure Event Hubs, Splunk, Datadog, S3, etc.)
   Standard org/enterprise audit log retention (GHEC default: 6 months)
   Usage metrics review cadence and owner
   
   
   Responsible AI guidelines for developers
       
   
       
       
           #
       
       
   
   
   Review-before-accept expectations
   Prohibited use cases
   Escalation path for suspected IP or security issues
   
   For each section, include: current value, source of truth (URL or API endpoint),
   
   last reviewed date, and owner.

   
   


2. Fill in the template using these sources of truth:
   
   
   
   • Org policies & content exclusion: organization Settings → Copilot
   
   
   • Seats & billing: GET /orgs/{org}/copilot/billing and /copilot/billing/seats
   
   
   • Usage metrics: GET /orgs/{org}/copilot/metrics (the modern metrics API; the older /copilot/usage endpoint is deprecated)
   
   
   • Content exclusions (programmatic): REST API for Copilot content exclusion
   
   
   • Audit log: organization Settings → Audit log, filtered with action:copilot
   
   
   
   


3. This document serves as:
   
   
   
   • A compliance artifact for security reviews
   
   
   • An onboarding reference for new team members
   
   
   • A baseline for periodic policy reviews (recommend: quarterly)
   
   
   
   

• Content exclusions block both context AND suggestions — Business and Enterprise only
• IP indemnity requires duplication filter set to Blocked
• Business/Enterprise code is never used for model training
• Copilot Chat retention on Business/Enterprise — confirm the current period in the Copilot Trust Center rather than relying on a figure quoted in study material
• Audit logs available on Pro+, Business, and Enterprise plans
• Admin policies (org-wide enforcement) are available on Business and Enterprise plans
• SAML SSO is Enterprise-only
• Privacy domain (content exclusions + data handling) = 30% of the exam (15% + 15%)