Network-Level Controls
Copilot allowlist reference (what to permit if you run a restrictive proxy)
Official documentation
Use gh api meta -q '.domains | .website, .copilot' to pull current wildcard domains; also allow apex github.com separately. Includes a dedicated cloud-agent allowlist section.
Subscription-based network routing (block non-enterprise Copilot plans at the firewall)
Official documentation
Allow only *.business.githubcopilot.com / *.enterprise.githubcopilot.com; block *.individual.githubcopilot.com — stops employees from using personal Copilot Pro/Free accounts on the corporate network. Requires min client versions.
IP allow lists
Official documentation
Important gap to teach: IP allow lists do not restrict “Copilot features that do not require directly fetching private/organizational data” — so this is not a complete Copilot access gate by itself.
SAML SSO enforcement
Official documentation
Gates all access (including Copilot) behind IdP session; composes with IP allow lists.