Developer data protection
GitHub Copilot
Check Copilot exclusions by mode
GitHub Copilot content exclusions depend on the product surface, mode and repository location. GitHub currently documents exclusions for supported Business and Enterprise workflows, but excludes Edit and Agent modes in IDEs and identifies symlink, remote-filesystem and indirect-context limitations. Use the dated provider matrix, then verify the exact configuration your developers use.
For GitHub enterprise and AppSec administrators
Separate documented support from your own observed result.
Provider documentation snapshot plus synthetic files. All organisation test outcomes are untested.01
Start with GitHub Copilot and the right plan
This guide concerns GitHub’s coding assistant, not Microsoft 365 Copilot. GitHub documents content exclusion for organisations with Copilot Business or Enterprise. Repository administrators, organisation owners and enterprise owners can configure it at different scopes. Check where the effective rule originates and which users and repositories it applies to.
A developer seeing the Copilot icon does not establish that the intended organisation rule is active. Record the account, seat, repository, editor version and mode. Keep account and policy evidence separate from the test result so a configuration mismatch is not mistaken for a product failure.
Source context: GitHub: Content exclusion for Copilot · GitHub: Excluding content from Copilot
02
Read the dated mode matrix
As reviewed on 21 September 2026, GitHub’s support table marks Visual Studio Code inline suggestions and Chat as supported, while its Edit and Agent modes are not supported. The table also lists Copilot CLI support. These are provider-documented statements, not results from tests performed for this guide.
The website and mobile support notes include public-preview qualifications. Keep those qualifications with any approval. Consult the linked current table when adding another editor or surface; do not copy a remembered limitation from an older release into a permanent company policy.
| Surface or mode | Provider-documented state | Important condition |
|---|---|---|
| VS Code inline suggestions | Supported | Applicable Business/Enterprise rule |
| VS Code Chat | Supported | Separate from Edit/Agent |
| IDE Edit and Agent modes | Not supported | Do not infer coverage from Chat |
| GitHub Copilot CLI | Listed as supported | Verify current client and policy |
| GitHub website / Mobile | Supported with preview note | Subject to change |
| GitHub website code review | Exclusions apply | Review the specific repository policy |
Source context: GitHub: Content exclusion for Copilot
03
Check repository location and indirect context
GitHub documents that exclusions do not apply to symlinks or repositories on remote filesystems. Record where the client actually accesses the repository, including remote development and containers that expose a different filesystem. A local clone and a remote workspace are separate approval conditions.
Excluded files can also contribute semantic information indirectly through the IDE, such as type information, hover definitions or project properties. The synthetic type fixture illustrates the review question: can information associated with an excluded type become available through an allowed file? It is not evidence that a specific installation exposes the marker.
Source context: GitHub: Content exclusion for Copilot
04
Keep configuration and observation separate
Use the vendor-supported administration interface and path syntax to configure the intended exclusion. Check inherited rules before adding local ones. The download provides a fixture-relative path and a blank organisation result sheet; it does not create a repository, change a policy or connect to GitHub.
In an approved isolated test repository, establish the permitted baseline and record the effective exclusion. Review the relevant mode using only the synthetic files. Mark unsupported modes and untested locations explicitly. Never fill the observed column with “supported” merely because the documentation says the feature exists.
Source context: GitHub: Excluding content from Copilot
05
Approve a specific combination
The useful conclusion is a named editor or client, mode, repository location and effective rule, with an owner and review date. If developers need an unsupported mode, consider the organisation’s alternative data-access controls or a narrower permitted task. Do not silently apply a Chat-mode result to an agent workflow.
Recheck when the client changes modes, the repository moves or GitHub updates the support table. Content exclusion and supported endpoint policy evaluation address different boundaries. An event observed by another tool is not proof that GitHub excluded the file, and an exclusion is not evidence of uniform third-party DLP coverage.
Put it into practice
GitHub Copilot exclusion review matrix
Pair a dated provider support table with your own mode and repository-location observations.
Provider documentation snapshot plus synthetic files. All organisation test outcomes are untested.
| Case | Documented state | Your observation |
|---|---|---|
| VS Code inline / Chat | Supported with applicable policy | Untested |
| IDE Edit / Agent | Not supported | Untested |
| Copilot CLI | Listed as supported | Untested |
| Symlink or remote filesystem | Exclusion limitation | Untested |
| Indirect type/context | May remain available | Untested |
Work through your review
Use the checks to organise the evidence you need. Your selections stay in this tab.
0 of 3 reviewed
Example files for this task
Keep the source material and the instructions together. You can also download the complete worksheet or matrix as CSV.
README.mdInspect
# GitHub Copilot exclusion review
Dated documentation snapshot: 2026-09-21. No GitHub account, repository, policy or API is created or changed by this pack. All code is synthetic.
Use an isolated organisation-approved test repository if you choose to make manual observations. Follow the current GitHub content-exclusion documentation to review the applicable path rule; do not assume these files activate one.
allowed-example.ts refers to the fictional type in restricted-types.ts. The example contains no business logic or secrets and illustrates the indirect-context question. Exclude only the intended fixture through the approved policy interface, then record each mode/location separately in observed-results.csv. Do not infer a result from documented-matrix.csv.
## Guide and source references
Canonical guide: https://aona.ai/resources/guides/github-copilot-content-exclusion-limits/
Source review: 2026-09-21
- GitHub: Content exclusion for Copilot: https://docs.github.com/en/copilot/concepts/context/content-exclusion
- GitHub: Excluding content from Copilot: https://docs.github.com/en/copilot/how-tos/configure-content-exclusion/exclude-content-from-copilot
documented-matrix.csvInspect
checked_at,surface_or_mode,documented_state,condition,source
2026-09-21,VS Code inline suggestions,Supported,Applicable Business or Enterprise policy,https://docs.github.com/en/copilot/concepts/context/content-exclusion
2026-09-21,VS Code Chat,Supported,Not Edit or Agent mode,https://docs.github.com/en/copilot/concepts/context/content-exclusion
2026-09-21,IDE Edit and Agent modes,Not supported,See current vendor notes,https://docs.github.com/en/copilot/concepts/context/content-exclusion
2026-09-21,GitHub Copilot CLI,Listed as supported,Verify current client and policy,https://docs.github.com/en/copilot/concepts/context/content-exclusion
2026-09-21,GitHub website and Mobile,Supported with preview note,Subject to change,https://docs.github.com/en/copilot/concepts/context/content-exclusion
2026-09-21,Symlink or remote filesystem,Exclusions do not apply,Separate location review,https://docs.github.com/en/copilot/concepts/context/content-exclusion
2026-09-21,Indirect semantic information,May remain available,Types hover definitions and project properties,https://docs.github.com/en/copilot/concepts/context/content-exclusion
restricted-types.tsInspect
// Synthetic type only. No credential or company definition.
export interface SyntheticInternalType {
SYNTHETIC_D07_TYPE_MARKER: string;
}
allowed-example.tsInspect
// Synthetic indirect-context example. It performs no I/O.
import type { SyntheticInternalType } from "./restricted-types";
export type ExampleInput = Partial<SyntheticInternalType>;
observed-results.csvInspect
date,account_and_seat,policy_owner,policy_path,client_version,mode,repository_location,documented_state,observed_result,evidence
,,,,,inline,local,RECORD,UNTESTED,
,,,,,Chat,local,RECORD,UNTESTED,
,,,,,Edit or Agent,local,RECORD,UNTESTED,
,,,,,CLI,local,RECORD,UNTESTED,
,,,,,SELECT,remote or symlink,RECORD,UNTESTED,
,,,,,indirect context,SELECT,RECORD,UNTESTED,
Before you proceed
Keep these distinctions clear
- Confusing Microsoft products
- GitHub Copilot coding exclusions and Microsoft 365 Copilot data policies are different mechanisms.
- Repeating an old CLI claim
- Use the dated current support table. This guide does not assume an earlier unsupported state remains true.
Apply it to employee AI use
Bring your actual data path.
Aona can help evaluate supported employee endpoint inputs alongside repository and client controls.
This guide does not establish Aona enforcement for every GitHub Copilot mode, remote workspace or CLI operation.
Bring the completed mode/location sheet and synthetic fixture to a scoped coverage review.
Review your use caseFAQ
Questions for this decision
Do GitHub content exclusions cover Agent mode in an IDE?
Does the same rule apply to a repository on a remote filesystem?
Is Copilot CLI automatically outside content exclusion?
Why include an allowed file that references an excluded type?
Evidence behind the guide
Sources and scope
Prepared by Aona. Sources checked 2026-09-21. The cited material supports the specific points below; it does not certify a product or your use case.
- GitHub: Content exclusion for Copilot
Dated support matrix, preview notes, indirect-context and repository-location limitations.
vendor · checked 2026-09-21 - GitHub: Excluding content from Copilot
Plan, administrator, policy inheritance and path-configuration requirements.
vendor · checked 2026-09-21