Task 2.4: Manage organization-wide settings and policies

• ABoth can use Copilot CLI, because the most recently assigned seat decides

  Incorrect

  Seat order does not decide; the rule differs between one enterprise and several.

• BNeither can use Copilot CLI, because any disabled policy always wins

  Incorrect

  Within one enterprise, the least restrictive policy usually applies.

• COmar can use Copilot CLI and Lena cannot, because enterprise owners must break the tie

  Incorrect

  It is the other way round: across enterprises the most restrictive policy almost always applies.

• DLena can use Copilot CLI, while Omar cannot, as the rules differ across enterprises

  Correct

  Within one enterprise the least restrictive policy usually applies; across different enterprises the most restrictive almost always applies.

If a user receives Copilot from multiple organizations in the same enterprise and those organizations configure a policy differently, the least restrictive policy usually applies, with some exceptions. If the licenses come from different enterprises, the most restrictive policy across enterprises almost always applies.

• Aaction:copilot

  Incorrect

  action:copilot lists events about the Copilot plan, such as settings, policies and licenses.

• Bactor:Copilot

  Correct

  The actor:Copilot search term shows a record of agent activity.

• Caction:copilot.cfb_seat_assignment_created

  Incorrect

  That filter returns license assignments to new users.

• Duser:copilot-pull-request-reviewer[bot]

  Incorrect

  That is the reviewer bot name used to request reviews, not the documented audit log filter.

The enterprise audit log records changes to the Copilot plan and agent activity on GitHub. Use action:copilot for plan-related events, a specific event such as action:copilot.cfb_seat_assignment_created for license assignments, and actor:Copilot for agent activity. Events are retained for 180 days.

• ADELETE /orgs/{org}/members/{username}, and access ends immediately

  Incorrect

  That removes the person from the organization entirely, which is more than the task asks for.

• BDELETE /orgs/{org}/copilot/billing/selected_users; access ends when the billing cycle ends

  Correct

  Removing users sets their seats to pending cancellation, and they lose access at the end of the current billing cycle.

• CPATCH /orgs/{org}/copilot/billing with assign_selected, and access ends at the next sign-in

  Incorrect

  The billing endpoint is read with GET and reports seat_management_setting; it offers no documented call for removing specific users.

• DPOST /orgs/{org}/copilot/billing/selected_users with an empty list, and access ends after 24 hours

  Incorrect

  POST on that endpoint adds seats; it does not remove them.

The REST API lists seats with GET /orgs/{org}/copilot/billing/seats, including last_activity_at for each user, and removes users with DELETE /orgs/{org}/copilot/billing/selected_users. Removal sets seats to "pending cancellation", so the users lose access at the end of the current billing cycle. The documentation suggests exactly this kind of script for revoking seats of members who are not using Copilot.

• AIn each repository's Settings > Copilot page

  Incorrect

  Repository settings hold repository-level options such as exclusions, not enterprise policies.

• BIn each user's personal Copilot settings

  Incorrect

  Personal settings govern individual plans, not enterprise policy.

• COn the enterprise's AI controls tab

  Correct

  Enterprise policies for Copilot are on the enterprise's AI controls tab; organizations have their own settings.

• DIn the .github-private repository of the enterprise

  Incorrect

  That repository can hold enterprise custom agents, not policies.

Policies for GitHub Copilot are on your enterprise's AI controls tab or in your organization's settings. They control which Copilot features, agents and models users can access and how they can use them, for example whether users can use Copilot CLI.

• ANothing; he cannot override the enterprise's choice in his organization

  Correct

  If the enterprise owner selected a specific policy, such as disabling it everywhere, it can't be overridden at the organization level.

• BEnable the policy for his organization, which overrides the enterprise

  Incorrect

  Organization settings cannot override an enterprise selection such as disabled everywhere.

• CEnable it for selected members only, as the enterprise policy allows

  Incorrect

  A disabled-everywhere policy leaves no organization-level choice.

• DGive his team personal Copilot Pro plans, which policies don't affect

  Incorrect

  Personal plans are canceled when users get a Business or Enterprise seat, so this is no workaround.

Copilot policies are set at the enterprise level first. If an enterprise owner selects a specific policy, such as enabling a feature everywhere or disabling it everywhere, organization owners cannot override it. Only "Let organizations decide" leaves the choice to organizations.

• ANothing extra, because the audit log keeps Copilot events indefinitely

  Incorrect

  The audit log retains events for the last 180 days.

• BExport the audit log once a year, because it keeps events for 12 months

  Incorrect

  Retention is 180 days, so a yearly export would lose events.

• CEnable Copilot Memory, which stores policy history for administrators

  Incorrect

  Copilot Memory stores repository facts and user preferences, not audit events.

• DStream it to a SIEM, since events are kept for 180 days

  Correct

  The audit log retains events for the last 180 days, and GitHub recommends streaming it to a SIEM for long-term history.

The enterprise audit log records Copilot plan changes, settings, policies and license changes, and agent activity. It retains events for the last 180 days, so GitHub recommends streaming it to a Security Information and Event Management (SIEM) platform for long-term history and alerts on anomalous activity.

• AWhen access is granted, prorated for the cycle

  Correct

  Billing starts when you grant a member access, irrespective of first use, and a mid-cycle grant is prorated.

• BWhen each developer first uses Copilot in an IDE

  Incorrect

  Billing doesn't wait for first use.

• CAt the start of the next billing cycle, for all 40 seats

  Incorrect

  Seats granted mid-cycle are billed pro rata from the grant.

• DOnly after each developer accepts a suggestion for the first time

  Incorrect

  Acceptance has no effect on when the seat is billed.

After setting up Copilot Business, billing for Copilot starts when you grant an organization member access, irrespective of when they first use Copilot. If you grant access midway through a billing cycle, the cost is prorated for the remainder of the cycle.