What this is
Tool focus: GitHub Copilot
Plan a GitHub Copilot rollout for a regulated UK estate: licence model, M365 DLP, Conditional Access, content exclusions and team rules.
GitHub CopilotGitHub Copilot rolloutLicence model and tenant boundary
A GitHub Copilot rollout that holds up under audit
Copilot is easy to introduce and easy to introduce badly. The rollout is half technical, half policy.
Org-level + repo-level exclusions filter what enters Copilot context.
Licence model and tenant boundary
Business vs Enterprise, tenant boundary and org policies are documented before seats are bought.
Content exclusions and policy
Repo and org exclusions are configured against real sensitive paths, with a short policy for edge cases.
Identity and access on the agent host
Conditional Access, device compliance, admin ownership and GitHub audit trail are part of the rollout.
How an engagement runs
Week 1
Discovery
Tenant, org, and policy review. Which repos are in scope, which are out. Which sensitive paths exist. What the existing M365 controls already enforce.
Week 2
Policy + technical config
Content exclusions, org policy, Conditional Access, device compliance, DLP and audit log shape.
Week 3
Pilot with one team
One team pilots the full policy. Real edge cases are logged before wider rollout.
Common questions
Do we need Copilot Enterprise?
Not always. The choice depends on tenant boundary, content exclusion needs, and audit requirements. The rollout starts by deciding this honestly, not by defaulting to the most expensive tier.
How does this fit Cyber Essentials Plus?
Copilot is a cloud service, so it sits inside the cloud services scope. Identity, MFA, and device compliance on the agent host all matter to the assessor. The rollout treats these as part of the scope rather than as a separate IT problem.
Can the rollout sit alongside an internal LLM?
Yes. Some teams keep Copilot for in-editor work and an internal LLM (Anthropic, OpenAI, or local) for repo-level work. The rollout names which tool is for which workflow so the team is not making the call afresh every time.