Microsoft

Copilot is the coding tool most organizations already own, and the one most often scoped against an out-of-date mental model — ghost text plus a chat pane. The current surface is far wider, and the governance layer around it is the actual product.

Scope note: this series covers tools engineers use to write software, not putting a model inside a shipped product. Where local and self-hosted models appear below, they appear as an inference backend for the coding tool — not as something to embed in an application.

GitHub Copilot — a coding assistant that has grown well past completions.

• Suggestion surfaces — inline completions, next-edit suggestions
• Conversational surfaces — chat in editors, on the code host, in mobile, in the terminal
• Agentic surfaces — a cloud agent that opens pull requests, a CLI with its own agent, automated code review, agentic workflows
• Extension surfaces — custom agents, agent skills, hooks, plugins with an enterprise plugin standard, tool-server management
• Context surfaces — repository indexing, shared spaces, memory
• Third-party agents from other labs plug into the same governance layer

That breadth is the value and the review scope. Each item is a capability an administrator can enable, disable, or constrain — and each is a question a vendor-risk team is entitled to ask. Scoping a rollout for completions alone reliably under-plans.

• Seats are granted, not merely purchased
  • Administrators assign them to users and teams; unassigned seats do nothing
  • Licence reconciliation is an ongoing task, not a one-time setup step
• Procurement timing note — new self-serve signups for Business, for organizations on the free and team code-hosting plans, have been paused since April 2026
  • A team assuming it can swipe a card on Friday and be running Monday should verify the current path first

A hybrid model, and the hybrid is the thing to understand.

• Fixed per-seat fee — completions are effectively included at the paid tiers
• Plus a monthly credit pool — agentic and premium-model work draws it down
• Consequence — the seat price is a floor, not a forecast
  • A team leaning on the cloud agent consumes credits at a different rate from one using completions and chat
  • Budgets set from the seat price alone will be wrong in a predictable direction
• Configure budgets and usage-based billing controls during rollout, not after
• Model the tier choice economically, separately from governance
  • The Enterprise tier's larger credit pool is a real economic argument
  • For an agent-heavy team, the higher seat price can be cheaper than the lower one plus overage

Read this section first if legal owns the decision. Copilot has the strongest contamination control in the series and the most conditional indemnity, and the terms changed recently.

0 — Which contract actually applies?

• Evaluation consequence — "which Copilot contract applies here" has three possible answers depending on the purchasing path. Establish which one applies before scoring anything below

1 — Who owns the output?

• The terms state: GitHub does not own Inputs or Outputs, and the customer retains any ownership it already has in its Inputs
• Worth reading precisely. This is a disclaimer of the vendor's ownership. It is not an affirmative assignment of Output rights to the customer, which is what the other three labs in this series grant explicitly
• Practically the effect is similar for most teams. For an organization whose counsel wants a positive grant of title in generated code rather than a disclaimer, it is a difference worth raising in negotiation

2 — Does the source train the model?

• No — GitHub will not use Inputs or Outputs to train generative AI models unless the customer has given documented instructions to do so
• The model-hosting commitments extend that down the supply chain, and are unusually specific:

3 — Could generated code carry someone else's licence?

This is where Copilot is materially ahead of the rest of the series: it is the only one with a documented, vendor-side contamination control rather than a pure indemnity.

• Public-code matching — every suggestion is checked against publicly available code
  • Depending on the organization's Suggestions matching public code policy, a match is either discarded outright or surfaced with a code reference
  • The setting applies irrespective of which model is selected, so it is not defeated by changing models
• Code referencing — where matches are allowed, the accepted suggestion is logged with the URLs of matching files and the licence name where one is found, so a team can decide on attribution or removal
• Two limits worth knowing — only accepted suggestions are checked (code a developer wrote or modified is not), and matches typically occur in under one percent of suggestions

4 — Who defends the company if a third party sues?

• The AI terms module does not contain the indemnity. It says: if the master agreement provides for defense of third party claims, that provision applies to Generative AI Services, including Outputs
  • So the indemnity lives in the volume licensing agreement, and its strength depends on that agreement rather than on anything Copilot-specific
  • An evaluation must read the master agreement, not just the AI module
• The condition that matters most in this entire series — use of Generative AI Services is subject to the Required Mitigations, defined as the Microsoft Customer Copyright Commitment Required Mitigations
  • In plain terms: the copyright protection is conditioned on running the mitigations, which include the public-code filtering described above
  • Turning the public-code filter off to get more suggestions may forfeit the defense. That is a settings decision with contractual consequences, and it is usually made by an engineer who has never seen the contract
  • Lock that policy at the organization or enterprise level and record why
• Shared responsibility — the customer is solely responsible for any application or agent it builds using the services, including compliance with legal, regulatory, and licensing requirements
• Third-party marketplace products are used at the customer's own risk and governed by the publisher's terms, not GitHub's — each one is its own review

The copyright commitment is conditioned on running the required mitigations. An engineer toggling off the public-code filter is making a contractual decision, not a preference one.

How long is it kept?

• The terms state that some services retain Inputs and Outputs to provide the service — specifically naming the case of maintaining functionality in stateless environments outside the code editor
• Read that as: the agentic and command-line surfaces retain more than the editor does. Per-service detail lives in the product documentation rather than the contract
• Content exclusion is the file-level control, and its documented limits are covered in § 06 — they are substantial, and they matter here too

The dimension where Copilot has a structural advantage that is easy to undervalue: identity is the code host's identity.

• Seats are granted through the same organization and enterprise structures that already govern repository access, teams, and permissions
• For an organization already hosting its code there:
  • No new identity integration
  • No new directory sync to configure
  • No second access review
  • No separate leaver process — the joiner-mover-leaver flow already governing repository access governs the coding agent by construction
• The honest counterweight — it concentrates risk
  • A compromise of that identity now reaches both the code and the agent
• Inverts the usual trade — the vendor with the least new identity plumbing is the one already holding the repositories

• Policy surface — organization and enterprise policies, tool-server management, network settings, firewall customization for the agent environment, content exclusion, model access configuration, cloud and local sandboxes
• Instruction layering — personal, repository, and organization scope, mirroring the hierarchy every other lab in this series uses

Model access — the strongest structural argument for this vendor

• The catalogue spans several labs at once: model families from Anthropic, Google, OpenAI, and SpaceXAI alongside the host's own and open-weight lines
• Administrators configure which are available; lower tiers restrict members to automatic selection, paid organizational tiers open the catalogue
• Every other seat in this series is a bet on one lab's model roadmap. This one is a bet on a client and a governance layer, with the model as a swappable input
  • For an organization expecting the frontier to keep moving, buying the routing layer rather than the model is a defensible hedge

Customer-supplied model keys — the in-scope local and self-hosted path

• Why this matters for evaluation — it is the documented route to running the coding tool against a model the organization controls
  • The local variant is explicitly positioned for air-gapped environments
  • The organization-policy switch means a security team can forbid it as easily as permit it — both directions are governable
  • An organization pointing the tool at its own endpoint owns that endpoint: patching, model updates, and capacity when six engineers hit it at once. A vendor seat has an operator included in the price; a self-hosted endpoint moves that cost onto the team

Cloud agent blast radius — the widest-reach surface, with an unusually candid documented risk analysis.

• Risks the documentation names but does not claim to have solved — prompt injection, administrators losing sight of agent work, and automations running without a person initiating each task
  • Naming the unsolved ones is more useful than a page of assurances
  • Take those three as the evaluation's own follow-up items rather than treating them as handled

• Usage metrics for organizations and enterprises
• Agent session logs — the evidence artifact for autonomous runs
• The structural advantage repeats here — agent activity lands as branches, pull requests, and reviews inside the code host
  • Which already has an audit log, already retains history, and is already ingested by whatever tooling the organization runs
  • Evidence arrives in the system a compliance programme already samples, rather than in a new silo requiring its own integration

Strong fit

• Any organization already hosting its code on that platform — identity, audit trail, branch protections, and review workflow all come for free, and agent output lands where compliance already looks
• Model-roadmap hedging — the multi-vendor catalogue is the strongest available protection against betting on one lab
• Agent economics — default self-validation without extra security licences is real value, easy to overlook in a price comparison
• Air-gapped or model-sovereign requirements — the local key path is documented for exactly that, and is policy-controllable in both directions

Weak fit

• Where file-level guarantees are required rather than file-level controls — content exclusion is useful with documented holes: semantic leakage through the editor, no coverage in edit and agent modes, nothing for symlinks or remote filesystems
• Where a flat, forecastable cost is required — the credit pool means the seat price is a floor

Disqualifiers

• The self-hosted server edition of the code host — Copilot is not available for it at all
• Frontier capability with nothing leaving the building — the local key path runs whatever model the organization can host, and a self-hosted open-weight model is not the frontier
• Highly variable laptop fleets considering local inference — measure the slowest machine, not the fastest, before scoring it

Order to evaluate in

1. Decide whether the code already lives on that host — that single fact carries identity, audit, and workflow, and dominates everything else
2. Model the credit pool against the surfaces the team will actually use, comparing the higher tier's larger pool against the lower tier plus overage
3. Build the content-exclusion coverage matrix for the editors in use — treat the edit-and-agent-mode gap as a finding, not a footnote
4. Put the named retention-exception model on the review list and decide explicitly whether to enable it
5. If a controlled model endpoint is required, decide local versus enterprise key path, and name the team that owns the endpoint before ordering hardware

Next: SpaceXAI — the newest entrant, with the most concrete deployment documentation in the series and the thinnest seat table.