Capabilities & Organization Policies

How Agent Mode Works

• Copilot acts autonomously — it decides which files to touch and what changes to make
• Can create, edit, and delete files across the entire repository
• Runs terminal commands: builds, tests, dependency installs, linters
• Iterates on its own errors — if a build fails, it diagnoses and fixes automatically
• Delegates sub-tasks to Sub-Agents for optimized context usage
• Available in VS Code (Copilot Chat panel) and GitHub.com
• Cloud Agent: A version of Agent Mode that runs remotely on GitHub infrastructure, not locally

When to Use Agent Mode

• Complex feature implementations spanning many files
• Setting up an entire project scaffold from scratch
• Automated refactoring across a large codebase
• When you want maximum autonomy and can review the result at the end

How Edit Mode Works

• You select which files Copilot is allowed to edit
• Copilot proposes changes step-by-step and you approve each iteration
• More controlled than Agent Mode — Copilot cannot touch files outside your selection
• Available in VS Code and JetBrains IDEs

When to Use Edit Mode

• Focused refactoring of a known set of files
• Applying a consistent change across multiple specified files
• When you need control over exactly what is modified

• Copilot produces a detailed implementation plan before any code changes are made
• Plan lists which files will be created, edited, or deleted with explanations
• You review and approve the plan before execution begins
• After approval you can hand off to Agent Mode or Edit Mode for execution
• Best for: complex tasks where you want full upfront visibility

• Agent Sessions maintain context across multiple steps of a multi-part task
• Sub-Agents handle isolated delegated tasks with their own independent context windows
• Architecture prevents context window exhaustion on large tasks
• Sub-Agents report results back to the orchestrating agent session
• Enables parallelism — multiple sub-tasks can run concurrently

Key MCP Concepts

• Connects Copilot to external systems: databases, APIs, Jira, Slack, Teams, Azure Boards, Linear
• Configured via MCP servers that expose tools and resources to Copilot
• On GitHub.com, the GitHub MCP server is automatically configured — enables branch creation, PR merging, issue management directly from Copilot Chat
• Organizations can manage MCP availability via the MCP policy in admin settings
• Enterprise owners control whether users can connect MCP servers

Policy Levels for MCP

• Enterprise: enable/disable MCP for all orgs, or delegate to org owners
• Organization: enable/disable MCP for the org's members
• Access controlled under AI Controls > Model Context Protocol (MCP)

Copilot Code Review

• Reviews pull requests on GitHub.com with AI-powered feedback
• Identifies bugs, security issues, style violations, and suggests improvements
• Configured with customizable review standards via instructions files
• Admins toggle it via Settings > Copilot > Code review
• Custom instructions for code review are pulled from the PR's base branch
• Org admins enable Copilot Code Review policies to roll it out org-wide
• Also available in supported IDEs for "Review selection" (Free plan: VS Code only)

Copilot Spaces

• Curated workspaces combining code, documentation, and context
• Gives Copilot a richer, more focused view of a project or area
• Shareable with team members for consistent AI assistance
• Helps reduce context ambiguity in large mono-repos

GitHub Spark

• AI-powered tool for building small web applications using natural language — no coding required
• Creates functional micro-apps and prototypes quickly
• Apps can be deployed from the CLI or web interface
• Uses prompt engineering techniques to refine the app iteratively

Pull Request Summaries

• Copilot automatically generates a summary of PR changes
• Describes what changed, why, and potential impact
• Helps reviewers quickly understand a PR's scope without reading every diff line
• Available to all plans on GitHub.com

Instructions File Locations & Priority

When multiple levels apply, all are provided to Copilot — not just the highest priority one.

Path-Specific Instructions

• Create NAME.instructions.md files inside .github/instructions/
• Use a frontmatter applyTo field with glob patterns to scope them:

---
applyTo: "app/models/**/*.rb"
---
Always use ActiveRecord validations, never raw SQL.

• Use excludeAgent to prevent an instruction file from applying to a specific agent:

---
applyTo: "**"
excludeAgent: "code-review"
---

• Path-specific instructions currently apply to Copilot cloud agent and Copilot code review on GitHub.com

Agent-Specific Files

• Repositories can also contain AGENTS.md, CLAUDE.md, or GEMINI.md for agent-specific guidance

Prompt Files

• Reusable prompt templates stored in the repository
• Shared across the team for consistent Copilot responses
• Reduce variance in AI output for common tasks (e.g., "write a REST endpoint")

• Chat has rate limits that vary by plan (see plans table below)
• Users provide feedback via 👍/👎 on responses to improve Copilot
• Chat history within a session is included in the prompt, consuming context window tokens
• Starting a new chat session resets context — useful when a conversation goes off track
• Inline chat (Ctrl+I) targets selected code or the cursor position

GitHub's current documentation refers to the monthly usage allowance as "GitHub AI Credits" (the same concept historically called "premium requests"). Exact numeric allowances for Max and for AI-credit-denominated tiers are not published as fixed figures — know it qualitatively as "the highest individual allowance," scaled above Pro+.

Three Policy Categories (AI Controls)

1. Agents — control AI agent (cloud agent) availability
2. Copilot — control Copilot feature availability (suggestions, chat, code review, etc.)
3. Model Context Protocol (MCP) — control whether MCP server connections are allowed

Scope Hierarchy

• Enterprise owners can define a policy for the entire enterprise, or delegate decisions to individual org owners
• Organization owners configure policies for their org under Settings > Copilot
• Implementation methods: dropdown menus, toggles, or named policy links
• Specific controls: enable Copilot Code Review policies, manage feature availability across IDEs and github.com, enable user feedback collection

• Copilot generates audit log events visible in the org/enterprise audit log on GitHub
• Types of events tracked:
  • Seat assignments added or removed
  • Policy configuration changes (features enabled/disabled)
  • Content exclusion rule changes
  • Copilot usage activity (feature interactions)
• Available on Business and Enterprise plans only
• Used for compliance, security review, and governance
• Reference: Reviewing audit log events for Copilot

The GitHub REST API provides dedicated endpoints for Copilot seat and billing administration at the organization level.

All endpoints require organization-owner authorization plus the manage_billing:copilot or read:org scope (admin:org for write operations).

• Useful for automating seat onboarding/offboarding scripts at scale (hundreds or thousands of developers)
• "Pending cancellation" seats remain billed until the end of the current billing cycle — removal is not immediate
• Content exclusion rules can also be managed via the REST API for bulk configuration

Network Settings (Enterprise Rollouts)

• Copilot continuously "interacts with a remote machine learning model and checks for updates" — corporate firewalls/proxies can block this traffic and cause suggestions to silently fail
• Enterprises behind a restrictive firewall must allowlist the required Copilot domains before rollout (see the official allowlist reference below)
• This is a common root cause when "Copilot works at home but not on the corporate network"