GitHub Copilot Pricing and Cost by Plan: Business and Enterprise Security Controls Compared

The short answer for anyone sizing a budget: every GitHub Copilot security control that a security team actually reviews starts at Copilot Business, 19 USD per granted seat per month. Content exclusion, enterprise managed settings and the contractual position that your code is not used for training all begin at that tier and none of them exist below it. Copilot Enterprise at 39 USD adds codebase indexing and a larger credit allowance, not a materially different security posture. Prices below were verified against GitHub documentation in August 2026, and GitHub changes them, so re-check before you sign.

How much does GitHub Copilot cost per user?

Here is the full list price table as GitHub publishes it, with the monthly AI credit allowance on each plan, because the credit line is the part that decides your real bill rather than the seat price.

Two things about this table trip people up in procurement. The first is that Pro+ and Enterprise are both 39 dollars, which invites the assumption that they are comparable products. They are not. Pro+ is an individual subscription with no organization policy surface at all, so buying it for a team gives you a team of unmanaged installs at Enterprise prices. The second is that "per granted seat" means what it says: you are billed for assigned seats, not for developers who happened to open the editor, so seat hygiene is a real line item once you are past a couple of hundred people.

Which security controls each plan unlocks

This is the table the seat price should actually be argued from. Every entry here comes from GitHub own documentation rather than a vendor comparison chart.

Read down the Business column and you have the whole security case. Read across the bottom two rows and you have the honest answer to the question everyone asks next.

What is the difference between Copilot Business and Copilot Enterprise for security?

Very little, and it is worth saying so plainly because the 20 dollar per seat gap is usually justified internally on security grounds that do not survive contact with the documentation. Content exclusion is on both. Enterprise managed settings are on both. The training and retention position is identical on both: GitHub states verbatim that it "does not use Copilot Business or Copilot Enterprise customer data to train AI models", and on both plans prompts and suggestions are not retained, while user engagement data is kept for two years.

What Enterprise adds is capability, not control. Codebase indexing lets Copilot answer questions grounded in your own repositories, and the credit allowance doubles from 1,900 to 3,900 per user per month. Those are real reasons to buy it. If someone is proposing Enterprise so that the security review passes, ask which specific control they mean, because on current documentation the answer is usually that they were thinking of a Business feature.

The credit allowance decides your bill more than the seat price does

A 1,000 seat Business deployment is 19,000 dollars a month at list, and that number is easy to plan around. The part that is not easy to plan around is the credit line, because agent usage does not distribute evenly. Completions consume very little. An engineer running agent mode against a large refactor for an afternoon consumes a great deal, and a team that adopts the coding agent for routine pull requests can move an order of magnitude in a fortnight without anyone deciding anything.

The practical consequence is that AI tooling behaves like metered infrastructure wearing a per-seat price tag, which is an awkward category for most finance processes. Teams that handle it well treat the allowance the way they treat any consumption line and set a threshold alert that fires before the overage lands rather than discovering it on the invoice six weeks later. Teams that handle it badly find out when someone escalates a bill, then respond by restricting agent usage across the board, which is the expensive way to solve a forecasting problem.

One useful control here doubles as a security control. Seat hygiene, meaning revoking granted seats for people who have left or moved teams, reduces both the bill and the number of identities that can start an agent against your repositories.

The one setting to change on the day you buy

If you take a single action after purchasing Business or Enterprise, make it this one. Set disableBypassPermissionsMode to disable in the enterprise managed settings file. It prevents GitHub Copilot CLI and Visual Studio Code from skipping permission prompts, the mode developers refer to as auto-approve or yolo mode.

This matters more than its obscurity suggests, for two reasons. The first is behavioral: auto-approve is what a developer reaches for on the second afternoon of agent mode, after the twentieth confirmation dialog, and it converts a tool with a human in the loop into one without. The second is that it is new. GitHub shipped it on June 17, 2026 for Copilot CLI and Visual Studio Code 1.122 and later, and extended it to the Copilot app and cloud agent on July 27, 2026. Any Copilot security assessment written before the middle of 2026 does not contain this setting, which means most of them do not.

The reason it deserves the top slot is visible in the published incident record. In CVE-2025-53773, an injected instruction in ordinary repository content made Copilot write "chat.tools.autoApprove": true into the workspace settings file, which disabled all user confirmations and opened the door to shell command execution. An attacker had to reach for that setting because it was valuable. Turning it off centrally, before anyone turns it on locally, removes the prize.

What no tier buys you

There is a class of risk that is not on the price list, and GitHub has been unusually direct about it. When researchers demonstrated the Comment and Control technique in April 2026, delivering instructions to agents through pull request titles and issue comments, GitHub classified the Copilot Agent finding as a known architectural limitation rather than a defect to patch.

That classification is correct, which is why no plan upgrade addresses it. An agent whose job is to triage issues has to read text written by people you do not control. An agent that opens pull requests has to hold a token that can write. Those two requirements are the product. The exposure is a consequence of the feature working, so it cannot be priced away, and a vendor saying so is more useful than one shipping a filter and implying the matter is closed.

What that leaves is a scoping question rather than a purchasing one. If Copilot writes code that a human reviews and merges, the Business tier controls plus your normal review process genuinely cover it, and you should spend the remaining budget elsewhere. If Copilot is opening pull requests unattended, calling MCP servers or running in CI with credentials, the residual risk sits at the moment the agent takes an action, and it needs authorization and a record enforced at that point. We wrote up where each native control stops, with GitHub own wording, on the GitHub Copilot security page.

A short buying checklist

• Buy Business at 19 USD per seat unless you specifically want codebase indexing or the larger credit allowance. The security controls are the same on both organization tiers.
• Do not buy Pro or Pro+ for a team. They cost real money and provide no organization policy surface.
• Set disableBypassPermissionsMode to disable before the first seat is assigned.
• Configure content exclusion, and write down that it does not apply in Edit or Agent modes so nobody later assumes a secrets path is protected there.
• Set the organization firewall settings centrally rather than leaving them on Let repositories decide.
• Restrict the MCP servers and third-party coding agents policies before developers start connecting things, not after.
• Treat the credit allowance as a consumption line with an alert threshold, and keep granted seats clean.

If you are still choosing between coding agents rather than configuring one you have bought, the Gemini CLI and Claude Code security comparison covers default permissions and admin enforcement side by side, and the coding agents page covers the controls that apply whichever one you land on. Prices and settings in this article were verified in August 2026 against GitHub documentation. Confirm both before a purchase decision.