Copilot allowlist reference

If your company employs security measures like a firewall or proxy server, you should add the URLs in this article to an allowlist to ensure Copilot works as expected. Users must be able to authenticate to GitHub and access the Copilot service on GitHub.com or GHE.com.

Every user of the proxy server or firewall also needs to configure their own environment to connect to Copilot. See Configuring network settings for GitHub Copilot.

Copilot on GitHub.com

We recommend using the /meta API endpoint to find the domains required to use GitHub on a restricted network. For more information, see Allowing access to GitHub's services from a restricted network.

The following request returns most of the wildcard domains required to authenticate and connect to Copilot on GitHub.com. There are some exceptions for specific services, or if you want to allow traffic based only for specific Copilot plans.

Shell

gh api meta -q '.domains | .website, .copilot'

gh api meta -q '.domains | .website, .copilot'

In addition to these domains, we recommend allowing the apex domain github.com. This is not covered by *.github.com and is not returned by the above query, although it is returned by the API under domains.actions.

Specific required domains

The following table lists specific domains required for Copilot. If you have already allowed the wildcard domains returned by the /meta endpoint, you will have already implicitly allowed most of these domains.

URL	Purpose	Relevant wildcard in `/meta` response
`https://github.com/login/*`	Authentication	`github.com`
`https://github.githubassets.com`	Authentication	`*.githubassets.com`
`https://avatars.githubusercontent.com`	Authentication	`*.githubusercontent.com`
`https://github.com/copilot/*`	Copilot on GitHub	`github.com`
`https://github.com/enterprises/YOUR-ENTERPRISE/*`	Authentication for managed user accounts, only required with Enterprise Managed Users	`github.com`
`https://api.github.com/user`	User Management	`*.github.com`
`https://api.github.com/copilot_internal/*`	User Management	`*.github.com`
`https://collector.github.com/*`	Analytics telemetry	`*.github.com`
`https://copilot-telemetry.githubusercontent.com/telemetry`	Copilot client telemetry	`*.githubusercontent.com`
`https://default.exp-tas.com`	Copilot client experimentation	`default.exp-tas.com`
`https://copilot-proxy.githubusercontent.com`	API service for Copilot suggestions	`*.githubusercontent.com`
`https://origin-tracker.githubusercontent.com`	API service for Copilot suggestions	`*.githubusercontent.com`
`https://.githubcopilot.com/`	API service for Copilot suggestions. Allows access to authorized users regardless of Copilot plan. Do not add this URL to your allowlist if you are using subscription-based network routing. For more information on subscription-based network routing, see Managing GitHub Copilot access to your enterprise's network.	`*.githubcopilot.com`
`https://*.individual.githubcopilot.com`	API service for Copilot suggestions. Allows access to authorized users via a Copilot Individual plan. Do not add this URL to your allowlist if you are using subscription-based network routing.	Not included
`https://*.business.githubcopilot.com`	API service for Copilot suggestions. Allows access to authorized users via a Copilot Business plan. Do not add this URL to your allowlist if you want to use subscription-based network routing to block users from using Copilot Business on your network.	Not included
`https://*.enterprise.githubcopilot.com`	API service for Copilot suggestions. Allows access to authorized users via a Copilot Enterprise plan. Do not add this URL to your allowlist if you want to use subscription-based network routing to block users from using Copilot Enterprise on your network.	Not included
`https://copilot-reports.github.com`	Copilot usage metrics report downloads	`*.github.com`
`https://copilot-reports-*.b01.azurefd.net`	Copilot usage metrics report downloads (fallback). Required for fallback scenarios where downloads bypass the custom domain and are served from an Azure Front Door CDN.	Not included
`https://usagereports*.blob.core.windows.net`	Copilot usage metrics report downloads (fallback). Required for fallback scenarios where downloads bypass the Azure Front Door CDN and are served directly from Azure Blob Storage.	Not included

Copilot on GHE.com

If you use GitHub Enterprise Cloud with data residency, your enterprise and GitHub's services are hosted on a unique subdomain of GHE.com.

Allow access to the following domains, which cover most required services.
- https://*.SUBDOMAIN.ghe.com
- https://SUBDOMAIN.ghe.com
Replace SUBDOMAIN with your enterprise slug.
If you plan to use public code detection, allow access to https://origin-tracker.githubusercontent.com. This is required to check generated code against public code hosted on GitHub.com. For more information, see GitHub Copilot code referencing.

All other domains that are required on GitHub.com are not required on GHE.com. For example:

Individual services have a dedicated endpoint on your subdomain (such as https://copilot-proxy.SUBDOMAIN.ghe.com/)
Client experimentation is disabled on GHE.com, so https://default.exp-tas.com is not required
Individual Copilot plans are not available on GHE.com, so subscription-based network routing (such as https://*.individual.githubcopilot.com) is not supported

Editor-specific requirements

In addition to the URLs required to connect to Copilot, you must ensure your network rules meet the requirements the local client (for example, outbound requests to vscode.dev in Visual Studio Code). Find the documentation for your chosen client, for example:

Network Connections in Visual Studio Code in the Visual Studio documentation
Install and use Visual Studio and Azure Services behind a firewall or proxy server in the Microsoft documentation

Copilot voice features

Voice features in GitHub Copilot CLI and the GitHub Copilot app use Foundry Local to run a speech-to-text model on your machine. To query the model catalog and download models, these features make outbound requests to the following Azure domains. If you want to use voice features behind a firewall or proxy server, add these URLs to your allowlist:

Domain and/or URL	Purpose
`https://ai.azure.com`	Model catalog requests
`https://api.catalog.azureml.ms`	Detecting the optimal Azure region for model downloads
`https://*.api.azureml.ms`	Regional model catalog endpoints
`https://amlwlrt4*.blob.core.windows.net`	Model downloads from regional Azure Blob Storage. The `amlwlrt4*` wildcard matches the regional Azure Blob Storage accounts that Foundry Local voice features use to download models. The specific storage account depends on the Azure region closest to the user.

Copilot cloud agent recommended allowlist

The Copilot cloud agent includes a built-in firewall with a recommended allowlist that is enabled by default. The recommended allowlist allows access to:

Common operating system package repositories (for example, Debian, Ubuntu, Red Hat).
Common container registries (for example, Docker Hub, Azure Container Registry, AWS Elastic Container Registry).
Packages registries used by popular programming languages (C#, Dart, Go, Haskell, Java, JavaScript, Perl, PHP, Python, Ruby, Rust, Swift).
Common certificate authorities (to allow SSL certificates to be validated).
Hosts used to download web browsers for the Playwright MCP server.

For more information about configuring the Copilot cloud agent firewall, see Customizing or disabling the firewall for GitHub Copilot.

The allowlist allows access to the following hosts: