Copilot
| action | Description | Sample | Rule |
|---|---|---|---|
| copilot. | Copilot access was revoked for the organization or enterprise due to its Copilot subscription ending, an issue with billing the entity, the entity being marked spammy, or the entity being suspended. | N | N |
| copilot. | The Copilot enablement policy changed at the enterprise level to either allow or disable access for all organizations, or to allow access for selected organizations. | N | N |
| copilot. | Copilot feature settings were changed at the enterprise level. | N | N |
| copilot. | Copilot feature settings were changed at the organization level. | N | N |
| copilot. | A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members. | Y | N |
| copilot. | A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created. | N | N |
| copilot. | A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot. | N | N |
| copilot. | A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot. | N | N |
| copilot. | A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle. | Y | N |
| copilot. | A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot. | Y | N |
| copilot. | A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot. | N | N |
| copilot. | The seat management setting was changed at the organization level to either enable or disable Copilot access for all members of the organization, or to enable Copilot access for selected members or teams. | N | N |
| copilot. | The GitHub Copilot Product Terms or Pre-Release Preview Terms were accepted. | N | N |
| copilot. | Copilot code review settings were updated for a repository. | N | N |
| copilot. | The excluded paths for GitHub Copilot were updated. | N | N |
| copilot. | Copilot custom instructions were created for the organization. | N | N |
| copilot. | Copilot custom instructions were updated for the organization. | N | N |
| copilot. | Copilot access was enabled or disabled at the enterprise level. | N | N |
| copilot. | A user opted out of Copilot Memory. | N | N |
| copilot. | The plan for GitHub Copilot was updated. | N | N |
| copilot. | The plan for GitHub Copilot was scheduled to be downgraded. | N | N |
| copilot. | Firewall allowlist for Copilot coding agent was updated for an organization. | N | N |
| copilot. | MCP Configuration for Copilot coding agent was updated for a specific repository. | N | N |
| copilot. | Specific repositories were disabled from using Copilot coding agent. | N | N |
| copilot. | Specific repositories were enabled to use Copilot coding agent. | N | N |
| copilot. | Copilot coding agent access was updated for the organization's or user's repositories. | N | N |
copilot.access_revoked
#Description
Copilot access was revoked for the organization or enterprise due to its Copilot subscription ending, an issue with billing the entity, the entity being marked spammy, or the entity being suspended.
Documented on GitHub's enterprise audit log reference.
copilot.cfb_enterprise_org_enablement_changed
#Description
The Copilot enablement policy changed at the enterprise level to either allow or disable access for all organizations, or to allow access for selected organizations.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
copilot.cfb_enterprise_settings_changed
#Description
Copilot feature settings were changed at the enterprise level.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
copilot.cfb_org_settings_changed
#Description
Copilot feature settings were changed at the organization level.
Documented on GitHub's enterprise audit log reference.
copilot.cfb_seat_added
#Description
A Copilot Business or Copilot Enterprise seat was added for a user and they have received access to GitHub Copilot. This can occur as the result of directly assigning a seat for a user, assigning a seat for a team, or setting the organization to allow access for all members.
Documented on GitHub's enterprise audit log reference.Example Audit Log Entry #
{
"org_id": 9000008,
"user_id": 9000030,
"actor_id": 9000031,
"token_id": 9000032,
"created_at": 1782756033416.0,
"business_id": 9000005,
"actor_is_bot": false,
"org": "example-org",
"user": "user",
"actor": "user",
"owner": "example-business-1",
"action": "copilot.cfb_seat_added",
"details": {},
"actor_ip": "ip-redacted",
"business": "example-business",
"owner_type": "organization",
"request_id": 9000033,
"user_agent": "group-syncer/3ce4b61",
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwNA==",
"actor_location": {
"country_code": "XX"
},
"operation_type": "create",
"seat_assignment": {
"assignee": "user",
"assignee_type": "Team",
"created_at": "2023-06-27T19:08:21Z"
},
"external_identity_nameid": "user",
"programmatic_access_type": "GitHub App server-to-server token",
"external_identity_username": "user"
}
References #
copilot.cfb_seat_assignment_created
#Description
A Copilot Business or Copilot Enterprise seat assignment was newly created for a user or a team, and seats are being created.
Documented on GitHub's enterprise audit log reference.
copilot.cfb_seat_assignment_refreshed
#Description
A seat assignment that was previously pending cancellation was re-assigned and the user will retain access to Copilot.
Documented on GitHub's enterprise audit log reference.
copilot.cfb_seat_assignment_reused
#Description
A Copilot Business or Copilot Enterprise seat assignment was re-created for a user who already had a seat with no pending cancellation date, and the user will retain access to Copilot.
Documented on GitHub's enterprise audit log reference.
copilot.cfb_seat_assignment_unassigned
#Description
A user or team's Copilot Business or Copilot Enterprise seat assignment was unassigned, and the user(s) will lose access to Copilot at the end of the current billing cycle.
Documented on GitHub's enterprise audit log reference.Example Audit Log Entry #
{
"org_id": 9000008,
"user_id": 9000034,
"token_id": 9000035,
"created_at": 1782247458620.0,
"business_id": 9000005,
"oauth_application_id": 9000036,
"org": "example-org",
"user": "user",
"owner": "example-business-1",
"action": "copilot.cfb_seat_assignment_unassigned",
"details": {},
"actor_ip": "ip-redacted",
"business": "example-business",
"owner_type": "organization",
"request_id": 9000037,
"user_agent": "Microsoft Azure AD SCIM provisioning",
"hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwNQ==",
"token_scopes": "admin:org",
"actor_location": {
"country_code": "XX"
},
"operation_type": "modify",
"seat_assignment": {
"assignee": "user",
"assignee_type": "User",
"created_at": "2026-06-23T16:44:18-04:00",
"pending_cancellation_date": "2026-06-30"
},
"external_identity_nameid": "user",
"programmatic_access_type": "OAuth access token",
"external_identity_username": "user"
}
References #
copilot.cfb_seat_cancelled
#Description
A user's Copilot Business or Copilot Enterprise seat was canceled, and the user no longer has access to Copilot.
Documented on GitHub's enterprise audit log reference.Example Audit Log Entry #
{
"org_id": 9000038,
"user_id": 9000039,
"created_at": 1780279698623.0,
"business_id": 9000005,
"org": "example-org",
"user": "user",
"owner": "example-org-14",
"action": "copilot.cfb_seat_cancelled",
"details": {
"trial_seat": false
},
"business": "example-business",
"owner_type": "organization",
"operation_type": "modify",
"seat_assignment": {
"access_revoked_at": "2026-05-29T18:36:42Z",
"assignee": "user",
"assignee_type": "User",
"created_at": "2026-05-29T18:36:41Z",
"pending_cancellation_date": "2026-05-31"
}
}
References #
copilot.cfb_seat_cancelled_by_staff
#Description
A user's Copilot Business or Copilot Enterprise seat was canceled manually by GitHub staff, and the user no longer has access to Copilot.
Documented on GitHub's enterprise audit log reference.
copilot.cfb_seat_management_changed
#Description
The seat management setting was changed at the organization level to either enable or disable Copilot access for all members of the organization, or to enable Copilot access for selected members or teams.
Documented on GitHub's enterprise audit log reference.
copilot.clickwrap_save_event
#Description
The GitHub Copilot Product Terms or Pre-Release Preview Terms were accepted.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
copilot.code_review_repository_settings_updated
#Description
Copilot code review settings were updated for a repository.
Documented on GitHub's organization audit log reference.
copilot.content_exclusion_changed
#Description
The excluded paths for GitHub Copilot were updated.
Documented on GitHub's enterprise audit log reference.
copilot.custom_instructions_created
#Description
Copilot custom instructions were created for the organization.
Documented on GitHub's organization audit log reference.
copilot.custom_instructions_updated
#Description
Copilot custom instructions were updated for the organization.
Documented on GitHub's organization audit log reference.
copilot.enterprise_enablement_changed
#Description
Copilot access was enabled or disabled at the enterprise level.
Documented only in GitHub's enterprise audit log reference, not the organization or user audit log pages.
copilot.memory_user_opt_out
#Description
A user opted out of Copilot Memory.
Documented on GitHub's enterprise audit log reference.
copilot.plan_changed
#Description
The plan for GitHub Copilot was updated.
Documented on GitHub's enterprise audit log reference.
copilot.plan_downgrade_scheduled
#Description
The plan for GitHub Copilot was scheduled to be downgraded.
Documented on GitHub's enterprise audit log reference.
copilot.swe_agent_firewall_allowlist_updated
#Description
Firewall allowlist for Copilot coding agent was updated for an organization.
Documented on GitHub's organization audit log reference.
copilot.swe_agent_mcp_config_updated
#Description
MCP Configuration for Copilot coding agent was updated for a specific repository.
Documented on GitHub's organization audit log reference.
copilot.swe_agent_repo_disabled
#Description
Specific repositories were disabled from using Copilot coding agent.
Documented on GitHub's organization audit log reference.
copilot.swe_agent_repo_enabled
#Description
Specific repositories were enabled to use Copilot coding agent.
Documented on GitHub's organization audit log reference.
copilot.swe_agent_repo_enablement_updated
#Description
Copilot coding agent access was updated for the organization's or user's repositories.
Documented on GitHub's organization audit log reference.