Configuring your proxy server or firewall for Copilot

You should allow certain traffic through your firewall or proxy server for Copilot to work as intended.

Who can use this feature?

Proxy server maintainers or firewall maintainers

In this article

If your company employs security measures like a firewall or proxy server, you should add the following URLs, ports, and protocols to an allowlist to ensure Copilot works as expected:

Domain and/or URLPurpose
https://github.com/YOUR-ENTERPRISE/*Enterprise URL
https://github.com/YOUR-ENTERPRISE?*Enterprise URL
https://github.com/enterprises/YOUR-ENTERPRISE/*Authentication for managed user accounts, only required with Enterprise Managed Users

GitHub Public URLs

Domain and/or URLPurpose
https://github.com/login/*Authentication, only required with Personal Users
https://github.com/login?*Authentication, only required with Personal Users
https://github.com/login/oauth/*Authentication, only required with Enterprise Managed Users
https://api.github.com/user/*User Management
https://github.com/favicon.icoIcon
https://github.com/account/*Account
https://github.com/settings/*Settings
https://avatars.githubusercontent.com/*Avatars
https://github.com/copilot/*Copilot
https://raw.githubusercontent.com/*Raw Content
https://github.githubassets.com/*GitHub Assets
https://collector.github.com/*Collector
https://github.com/github-copilot/*GitHub Copilot
https://api.github.com/*API
https://github.com/notifications/*Notifications
https://github.com/session/*Session
https://github.com/dashboard/*Dashboard
https://github.com/dashboard?*Dashboard
https://github.com/logout/*Logout
https://github.com/logout?*Logout
https://github.com/switch_account?*Switch Account
https://github.com/switch_account/*Switch Account
Domain and/or URLPurpose
https://api.github.com/copilot_internal/*User Management
https://copilot-telemetry.githubusercontent.com/telemetry/*Telemetry
https://default.exp-tas.com/*Telemetry
https://copilot-proxy.githubusercontent.com/*API service for Copilot suggestions
https://origin-tracker.githubusercontent.com/*API service for Copilot suggestions
https://*.githubcopilot.com/*1API service for Copilot suggestions
https://*.individual.githubcopilot.com/*2API service for Copilot suggestions
https://*.business.githubcopilot.com/*3API service for Copilot suggestions
https://*.enterprise.githubcopilot.com/*4API service for Copilot suggestions

If your organization is using Microsoft Extra ID, you also need to add the following URLs to the allowlist:

  • https://login.microsoftonline.com/*
  • https://aadcdn.msauth.net/*
  • https://login.live.com/*
  • https://*.activedirectory.windowsazure.com/*

Depending on the security policies and editors your organization uses, you may need to allowlist additional domains and URLs. For more information on specific editors, see Further reading.

Every user of the proxy server or firewall also needs to configure their own environment to connect to Copilot. See Configuring network settings for GitHub Copilot.

Further reading

Footnotes

  1. Allows access to authorized users regardless of Copilot plan. Do not add this URL to your allowlist if you are using subscription-based network routing. For more information on subscription-based network routing, see Managing GitHub Copilot access to your enterprise's network. ↩

  2. Allows access to authorized users via a Copilot Individual plan. Do not add this URL to your allowlist if you are using subscription-based network routing. ↩

  3. Allows access to authorized users via a Copilot Business plan. Do not add this URL to your allowlist if you want to use subscription-based network routing to block users from using Copilot Business on your network. ↩

  4. Allows access to authorized users via a Copilot Enterprise plan. Do not add this URL to your allowlist if you want to use subscription-based network routing to block users from using Copilot Enterprise on your network. ↩