| title | Copilot allowlist reference | ||||
|---|---|---|---|---|---|
| intro | Learn how to allow certain traffic through your firewall or proxy server for {% data variables.product.prodname_copilot_short %} to work as intended in your organization. | ||||
| permissions | Proxy server maintainers or firewall maintainers | ||||
| versions |
|
||||
| category |
|
||||
| redirect_from |
|
||||
| contentType | reference |
If your company employs security measures like a firewall or proxy server, you should add the URLs in this article to an allowlist to ensure {% data variables.product.prodname_copilot_short %} works as expected. Users must be able to authenticate to {% data variables.product.github %} and access the {% data variables.product.prodname_copilot_short %} service on {% data variables.product.prodname_dotcom_the_website %} or {% data variables.enterprise.data_residency_site %}.
Every user of the proxy server or firewall also needs to configure their own environment to connect to {% data variables.product.prodname_copilot_short %}. See AUTOTITLE.
{% data variables.product.prodname_copilot_short %} on {% data variables.product.prodname_dotcom_the_website %}
We recommend using the /meta API endpoint to find the domains required to use {% data variables.product.github %} on a restricted network. For more information, see AUTOTITLE.
The following request returns most of the wildcard domains required to authenticate and connect to {% data variables.product.prodname_copilot_short %} on {% data variables.product.prodname_dotcom_the_website %}. There are some exceptions for specific services, or if you want to allow traffic only for users with specific {% data variables.product.prodname_copilot_short %} plans.
gh api meta -q '.domains | .website, .copilot'In addition to these domains, we recommend allowing the apex domain github.com. This is not covered by *.github.com and is not returned by the above query, although it is returned by the API under domains.actions.
The following table lists specific domains required for {% data variables.product.prodname_copilot_short %}. If you have already allowed the wildcard domains returned by the /meta endpoint, you will have already implicitly allowed most of these domains.
| URL | Purpose | Relevant wildcard in /meta response |
|---|---|---|
https://github.com/login/* |
Authentication | github.com |
https://github.githubassets.com |
Authentication | *.githubassets.com |
https://avatars.githubusercontent.com |
Authentication | *.githubusercontent.com |
https://github.com/copilot/* |
{% data variables.product.prodname_copilot_short %} on {% data variables.product.github %} | github.com |
https://github.com/enterprises/YOUR-ENTERPRISE/* |
Authentication for {% data variables.enterprise.prodname_managed_users %}, only required with {% data variables.product.prodname_emus %} | github.com |
https://api.github.com/user |
User Management | *.github.com |
https://api.github.com/copilot_internal/* |
User Management | *.github.com |
https://collector.github.com/* |
Analytics telemetry | *.github.com |
https://copilot-telemetry.githubusercontent.com/telemetry |
{% data variables.product.prodname_copilot_short %} client telemetry | *.githubusercontent.com |
https://default.exp-tas.com |
{% data variables.product.prodname_copilot_short %} client experimentation | default.exp-tas.com |
https://copilot-proxy.githubusercontent.com |
API service for {% data variables.product.prodname_copilot_short %} suggestions | *.githubusercontent.com |
https://origin-tracker.githubusercontent.com |
API service for {% data variables.product.prodname_copilot_short %} suggestions | *.githubusercontent.com |
https://*.githubcopilot.com/* |
API service for {% data variables.product.prodname_copilot_short %} suggestions. Allows access to authorized users regardless of {% data variables.product.prodname_copilot_short %} plan. Do not add this URL to your allowlist if you are using subscription-based network routing. For more information on subscription-based network routing, see AUTOTITLE. | *.githubcopilot.com |
https://*.individual.githubcopilot.com |
API service for {% data variables.product.prodname_copilot_short %} suggestions. Allows access to authorized users via a {% data variables.copilot.copilot_individuals_short %} plan. Do not add this URL to your allowlist if you are using subscription-based network routing. | Not included |
https://*.business.githubcopilot.com |
API service for {% data variables.product.prodname_copilot_short %} suggestions. Allows access to authorized users via a {% data variables.copilot.copilot_business_short %} plan. Do not add this URL to your allowlist if you want to use subscription-based network routing to block users from using {% data variables.copilot.copilot_business_short %} on your network. | Not included |
https://*.enterprise.githubcopilot.com |
API service for {% data variables.product.prodname_copilot_short %} suggestions. Allows access to authorized users via a {% data variables.copilot.copilot_enterprise_short %} plan. Do not add this URL to your allowlist if you want to use subscription-based network routing to block users from using {% data variables.copilot.copilot_enterprise_short %} on your network. | Not included |
https://copilot-reports.github.com |
{% data variables.product.prodname_copilot_short %} usage metrics report downloads | *.github.com |
https://copilot-reports-*.b01.azurefd.net |
{% data variables.product.prodname_copilot_short %} usage metrics report downloads (fallback). Required for fallback scenarios where downloads bypass the custom domain and are served from an Azure Front Door CDN. | Not included |
https://usagereports*.blob.core.windows.net |
{% data variables.product.prodname_copilot_short %} usage metrics report downloads (fallback). Required for fallback scenarios where downloads bypass the Azure Front Door CDN and are served directly from Azure Blob Storage. | Not included |
{% data variables.product.prodname_copilot_short %} on {% data variables.enterprise.data_residency_site %}
If you use {% data variables.enterprise.data_residency %}, your enterprise and {% data variables.product.github %}'s services are hosted on a unique subdomain of {% data variables.enterprise.data_residency_site %}.
-
Allow access to the following domains, which cover most required services.
https://*.SUBDOMAIN.ghe.comhttps://SUBDOMAIN.ghe.com
Replace SUBDOMAIN with your enterprise slug.
-
If you plan to use public code detection, allow access to
https://origin-tracker.githubusercontent.com. This is required to check generated code against public code hosted on {% data variables.product.prodname_dotcom_the_website %}. For more information, see AUTOTITLE.
All other domains that are required on {% data variables.product.prodname_dotcom_the_website %} are not required on {% data variables.enterprise.data_residency_site %}. For example:
- Individual services have a dedicated endpoint on your subdomain (such as
https://copilot-proxy.SUBDOMAIN.ghe.com/) - Client experimentation is disabled on {% data variables.enterprise.data_residency_site %}, so
https://default.exp-tas.comis not required - Individual {% data variables.product.prodname_copilot_short %} plans are not available on {% data variables.enterprise.data_residency_site %}, so subscription-based network routing (such as
https://*.individual.githubcopilot.com) is not supported
In addition to the URLs required to connect to {% data variables.product.prodname_copilot_short %}, you must ensure your network rules meet the requirements of the local client (for example, outbound requests to vscode.dev in {% data variables.product.prodname_vscode %}). Find the documentation for your chosen client, for example:
- Network Connections in {% data variables.product.prodname_vscode %} in the {% data variables.product.prodname_vs %} documentation
- Install and use {% data variables.product.prodname_vs %} and Azure Services behind a firewall or proxy server in the Microsoft documentation
Voice features in {% data variables.copilot.copilot_cli %} and the {% data variables.copilot.github_copilot_app %} use Foundry Local to run a speech-to-text model on your machine. To query the model catalog and download models, these features make outbound requests to the following Azure domains. If you want to use voice features behind a firewall or proxy server, add these URLs to your allowlist:
| Domain and/or URL | Purpose |
|---|---|
https://ai.azure.com |
Model catalog requests |
https://api.catalog.azureml.ms |
Detecting the optimal Azure region for model downloads |
https://*.api.azureml.ms |
Regional model catalog endpoints |
https://amlwlrt4*.blob.core.windows.net |
Model downloads from regional Azure Blob Storage. The amlwlrt4* wildcard matches the regional Azure Blob Storage accounts that Foundry Local voice features use to download models. The specific storage account depends on the Azure region closest to the user. |
The {% data variables.copilot.copilot_cloud_agent %} includes a built-in firewall with a recommended allowlist that is enabled by default. The recommended allowlist allows access to:
- Common operating system package repositories (for example, Debian, Ubuntu, Red Hat).
- Common container registries (for example, Docker Hub, Azure Container Registry, AWS Elastic Container Registry).
- Packages registries used by popular programming languages (C#, Dart, Go, Haskell, Java, JavaScript, Perl, PHP, Python, Ruby, Rust, Swift).
- Common certificate authorities (to allow SSL certificates to be validated).
- Hosts used to download web browsers for the Playwright MCP server.
For more information about configuring the {% data variables.copilot.copilot_cloud_agent %} firewall, see AUTOTITLE.
The allowlist allows access to the following hosts:
168.63.129.16
crl3.digicert.comcrl4.digicert.comocsp.digicert.com
ts-crl.ws.symantec.comts-ocsp.ws.symantec.coms.symcb.coms.symcd.com
crl.geotrust.comocsp.geotrust.com
crl.thawte.comocsp.thawte.com
crl.verisign.comocsp.verisign.com
crl.globalsign.comocsp.globalsign.com
crls.ssl.comocsp.ssl.com
crl.identrust.comocsp.identrust.com
crl.sectigo.comocsp.sectigo.com
crl.usertrust.comocsp.usertrust.com
172.18.0.1ghcr.ioregistry.hub.docker.com*.docker.io*.docker.comproduction.cloudflare.docker.comauth.docker.ioquay.iomcr.microsoft.comgcr.iopublic.ecr.aws
*.githubusercontent.comraw.githubusercontent.comobjects.githubusercontent.comlfs.github.comgithub-cloud.githubusercontent.comgithub-cloud.s3.amazonaws.comcodeload.github.comscanning-api.github.comapi.mcp.github.comuploads.github.com/copilot/chat/attachments/
productionresultssa0.blob.core.windows.netproductionresultssa1.blob.core.windows.netproductionresultssa2.blob.core.windows.netproductionresultssa3.blob.core.windows.netproductionresultssa4.blob.core.windows.netproductionresultssa5.blob.core.windows.netproductionresultssa6.blob.core.windows.netproductionresultssa7.blob.core.windows.netproductionresultssa8.blob.core.windows.netproductionresultssa9.blob.core.windows.netproductionresultssa10.blob.core.windows.netproductionresultssa11.blob.core.windows.netproductionresultssa12.blob.core.windows.netproductionresultssa13.blob.core.windows.netproductionresultssa14.blob.core.windows.netproductionresultssa15.blob.core.windows.netproductionresultssa16.blob.core.windows.netproductionresultssa17.blob.core.windows.netproductionresultssa18.blob.core.windows.netproductionresultssa19.blob.core.windows.net
nuget.orgdist.nuget.orgapi.nuget.orgnuget.pkg.github.comdotnet.microsoft.compkgs.dev.azure.combuilds.dotnet.microsoft.comdotnetcli.blob.core.windows.netnugetregistryv2prod.blob.core.windows.netazuresearch-usnc.nuget.orgazuresearch-ussc.nuget.orgdc.services.visualstudio.comdot.netdownload.visualstudio.microsoft.comdotnetcli.azureedge.netci.dot.netwww.microsoft.comoneocsp.microsoft.comwww.microsoft.com/pkiops/crl/
pub.devpub.dartlang.orgstorage.googleapis.com/pub-packages/storage.googleapis.com/dart-archive/
go.devgolang.orgproxy.golang.orgsum.golang.orgpkg.go.devgoproxy.iostorage.googleapis.com/proxy-golang-org-prod/
haskell.org*.hackage.haskell.orgget-ghcup.haskell.orgdownloads.haskell.org
www.java.comjdk.java.netapi.adoptium.netadoptium.netsearch.maven.orgmaven.apache.orgrepo.maven.apache.orgrepo1.maven.orgmaven.pkg.github.commaven-central.storage-download.googleapis.commaven.google.commaven.oracle.comjcenter.bintray.comoss.sonatype.orgrepo.spring.iogradle.orgservices.gradle.orgplugins.gradle.orgplugins-artifacts.gradle.orgrepo.grails.orgdownload.eclipse.orgdownload.oracle.com
npmjs.orgnpmjs.comregistry.npmjs.comregistry.npmjs.orgskimdb.npmjs.comnpm.pkg.github.comapi.npms.ionodejs.orgyarnpkg.comregistry.yarnpkg.comrepo.yarnpkg.comdeb.nodesource.comget.pnpm.iobun.shdeno.landregistry.bower.iobinaries.prisma.sh
cpan.orgwww.cpan.orgmetacpan.orgcpan.metacpan.org
repo.packagist.orgpackagist.orggetcomposer.org
pypi.python.orgpypi.orgpip.pypa.io*.pythonhosted.orgfiles.pythonhosted.orgbootstrap.pypa.ioconda.binstar.orgconda.anaconda.orgbinstar.organaconda.orgdownload.pytorch.orgrepo.continuum.iorepo.anaconda.com
rubygems.orgapi.rubygems.orgrubygems.pkg.github.combundler.rubygems.orggems.rubyforge.orggems.rubyonrails.orgindex.rubygems.orgcache.ruby-lang.org*.rvm.io
crates.ioindex.crates.iostatic.crates.iosh.rustup.rsstatic.rust-lang.org
download.swift.orgswift.orgcocoapods.orgcdn.cocoapods.org
releases.hashicorp.comapt.releases.hashicorp.comyum.releases.hashicorp.comregistry.terraform.io
json-schema.orgjson.schemastore.org
playwright.download.prss.microsoft.comcdn.playwright.devplaywright.azureedge.netplaywright-akamai.azureedge.netplaywright-verizon.azureedge.netstorage.googleapis.com/chrome-for-testing-public
archive.ubuntu.comsecurity.ubuntu.comppa.launchpad.netkeyserver.ubuntu.comazure.archive.ubuntu.comapi.snapcraft.io
deb.debian.orgsecurity.debian.orgkeyring.debian.orgpackages.debian.orgdebian.map.fastlydns.netapt.llvm.org
dl.fedoraproject.orgmirrors.fedoraproject.orgdownload.fedoraproject.org
mirror.centos.orgvault.centos.org
dl-cdn.alpinelinux.orgpkg.alpinelinux.org
mirror.archlinux.orgarchlinux.org
download.opensuse.org
cdn.redhat.com
packagecloud.iopackages.cloud.google.compackages.microsoft.com
dl.k8s.iopkgs.k8s.io