Skip to content

Commit 0191d06

Browse files
isaacmbrownCopilotjc-clark
authored
Revamp Copilot allowlist article (#62685)
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Joe Clark <31087804+jc-clark@users.noreply.github.com>
1 parent 6a862e6 commit 0191d06

2 files changed

Lines changed: 63 additions & 44 deletions

File tree

‎content/admin/data-residency/network-details-for-ghecom.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,10 @@ For more information about the `/meta` endpoint, see [AUTOTITLE](/rest/meta/meta
9999
| 40.81.180.112/28 | 40.81.176.224/28 |
100100
| 4.190.169.192/28 | 4.190.169.240/28 |
101101

102+
## {% data variables.product.prodname_copilot %}
103+
104+
Most {% data variables.product.prodname_copilot %} services require access to your enterprise's subdomain on {% data variables.enterprise.data_residency_site %} and its subdomains. For more information, see [AUTOTITLE](/copilot/reference/copilot-allowlist-reference#copilot-on-ghecom).
105+
102106
## Supported regions for Azure private networking
103107

104108
{% data variables.product.company_short %} deploys your runners in the same Azure region as the subnet you connect them to. Because of this, your subnet must be in one of the supported regions. If you use Azure private networking for {% data variables.product.company_short %}-hosted runners, the supported Azure regions on {% data variables.enterprise.data_residency_site %} differ from those on {% data variables.product.prodname_dotcom_the_website %}.

‎content/copilot/reference/copilot-allowlist-reference.md‎

Lines changed: 59 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -14,46 +14,73 @@ redirect_from:
1414
contentType: reference
1515
---
1616

17-
If your company employs security measures like a firewall or proxy server, you should add the URLs in this article to an allowlist to ensure {% data variables.product.prodname_copilot_short %} works as expected.
17+
If your company employs security measures like a firewall or proxy server, you should add the URLs in this article to an allowlist to ensure {% data variables.product.prodname_copilot_short %} works as expected. Users must be able to authenticate to {% data variables.product.github %} and access the {% data variables.product.prodname_copilot_short %} service on {% data variables.product.prodname_dotcom_the_website %} or {% data variables.enterprise.data_residency_site %}.
1818

19-
## Enable users to sign in to {% data variables.product.prodname_copilot_short %}
19+
Every user of the proxy server or firewall also needs to configure their own environment to connect to {% data variables.product.prodname_copilot_short %}. See [AUTOTITLE](/copilot/how-tos/configure-personal-settings/configure-network-settings).
2020

21-
Allowlisting the URLs below is **not enough on its own**. If your network blocks {% data variables.product.github %} more broadly, users won't be able to sign in to {% data variables.product.prodname_copilot_short %}, even with every URL below allowed.
21+
## {% data variables.product.prodname_copilot_short %} on {% data variables.product.prodname_dotcom_the_website %}
2222

23-
To sign in, users complete the standard {% data variables.product.github %} browser sign-in flow, which loads the {% data variables.product.github %} sign-in page. On a restricted network, this requires access to {% data variables.product.github %}'s general website domains (for example, `*.githubassets.com` and `*.githubusercontent.com`), which are not specific to {% data variables.product.prodname_copilot_short %}.
23+
We recommend using the `/meta` API endpoint to find the domains required to use {% data variables.product.github %} on a restricted network. For more information, see [AUTOTITLE](/get-started/using-github/allowing-access-to-githubs-services-from-a-restricted-network).
2424

25-
To enable sign-in on a restricted network:
25+
The following request returns most of the wildcard domains required to authenticate and connect to {% data variables.product.prodname_copilot_short %} on {% data variables.product.prodname_dotcom_the_website %}. There are some exceptions for specific services, or if you want to allow traffic based only for specific {% data variables.product.prodname_copilot_short %} plans.
2626

27-
1. Allow access to {% data variables.product.github %}'s general website domains. For more information, see [AUTOTITLE](/get-started/using-github/allowing-access-to-githubs-services-from-a-restricted-network).
28-
1. Add the URLs in this article to your allowlist.
27+
```shell copy
28+
gh api meta -q '.domains | .website, .copilot'
29+
```
2930

30-
## {% data variables.product.github %} public URLs
31+
In addition to these domains, we recommend allowing the apex domain `github.com`. This is not covered by `*.github.com` and is not returned by the above query, although it is returned by the API under `domains.actions`.
3132

32-
| Domain and/or URL | Purpose |
33-
|:------------------------------------------------------------| :--------------------------------- |
34-
| `https://github.com/login/*` | Authentication |
35-
| `https://github.com/copilot/*` | {% data variables.product.prodname_copilot_short %} on {% data variables.product.github %} |
36-
| `https://github.com/enterprises/YOUR-ENTERPRISE/*` | Authentication for {% data variables.enterprise.prodname_managed_users %}, only required with {% data variables.product.prodname_emus %} |
37-
| `https://api.github.com/user` | User Management |
38-
| `https://api.github.com/copilot_internal/*` | User Management |
39-
| `https://collector.github.com/*` | Analytics telemetry |
40-
| `https://copilot-telemetry.githubusercontent.com/telemetry` | {% data variables.product.prodname_copilot_short %} client telemetry |
41-
| `https://default.exp-tas.com` | {% data variables.product.prodname_copilot_short %} client experimentation |
42-
| `https://copilot-proxy.githubusercontent.com` | API service for {% data variables.product.prodname_copilot_short %} suggestions |
43-
| `https://origin-tracker.githubusercontent.com` | API service for {% data variables.product.prodname_copilot_short %} suggestions |
44-
| `https://*.githubcopilot.com/*`[^1] | API service for {% data variables.product.prodname_copilot_short %} suggestions |
45-
| `https://*.individual.githubcopilot.com`[^2] | API service for {% data variables.product.prodname_copilot_short %} suggestions |
46-
| `https://*.business.githubcopilot.com`[^3] | API service for {% data variables.product.prodname_copilot_short %} suggestions |
47-
| `https://*.enterprise.githubcopilot.com`[^4] | API service for {% data variables.product.prodname_copilot_short %} suggestions |
48-
| `https://*.SUBDOMAIN.ghe.com` | For {% data variables.product.prodname_copilot_short %} users on {% data variables.enterprise.data_residency_site %} |
49-
| `https://SUBDOMAIN.ghe.com` | For {% data variables.product.prodname_copilot_short %} users on {% data variables.enterprise.data_residency_site %} |
50-
| `https://copilot-reports.github.com` | {% data variables.product.prodname_copilot_short %} usage metrics report downloads |
51-
| `https://copilot-reports-*.b01.azurefd.net`[^5] | {% data variables.product.prodname_copilot_short %} usage metrics report downloads (fallback) |
52-
| `https://usagereports*.blob.core.windows.net`[^6] | {% data variables.product.prodname_copilot_short %} usage metrics report downloads (fallback) |
33+
### Specific required domains
5334

54-
Depending on the security policies and editors your organization uses, you may need to allowlist additional domains and URLs. For more information on specific editors, see [Further reading](#further-reading).
35+
The following table lists specific domains required for {% data variables.product.prodname_copilot_short %}. If you have already allowed the wildcard domains returned by the `/meta` endpoint, you will have already implicitly allowed most of these domains.
5536

56-
Every user of the proxy server or firewall also needs to configure their own environment to connect to {% data variables.product.prodname_copilot_short %}. See [AUTOTITLE](/copilot/how-tos/configure-personal-settings/configure-network-settings).
37+
| URL | Purpose | Relevant wildcard in `/meta` response |
38+
|:------------------------------------------------------------| :--------------------------------- | :---------------------------- |
39+
| `https://github.com/login/*` | Authentication | `github.com` |
40+
| `https://github.githubassets.com` | Authentication | `*.githubassets.com` |
41+
| `https://avatars.githubusercontent.com` | Authentication | `*.githubusercontent.com` |
42+
| `https://github.com/copilot/*` | {% data variables.product.prodname_copilot_short %} on {% data variables.product.github %} | `github.com` |
43+
| `https://github.com/enterprises/YOUR-ENTERPRISE/*` | Authentication for {% data variables.enterprise.prodname_managed_users %}, only required with {% data variables.product.prodname_emus %} | `github.com` |
44+
| `https://api.github.com/user` | User Management | `*.github.com` |
45+
| `https://api.github.com/copilot_internal/*` | User Management | `*.github.com` |
46+
| `https://collector.github.com/*` | Analytics telemetry | `*.github.com` |
47+
| `https://copilot-telemetry.githubusercontent.com/telemetry` | {% data variables.product.prodname_copilot_short %} client telemetry | `*.githubusercontent.com` |
48+
| `https://default.exp-tas.com` | {% data variables.product.prodname_copilot_short %} client experimentation | `default.exp-tas.com` |
49+
| `https://copilot-proxy.githubusercontent.com` | API service for {% data variables.product.prodname_copilot_short %} suggestions | `*.githubusercontent.com` |
50+
| `https://origin-tracker.githubusercontent.com` | API service for {% data variables.product.prodname_copilot_short %} suggestions | `*.githubusercontent.com` |
51+
| `https://*.githubcopilot.com/*` | API service for {% data variables.product.prodname_copilot_short %} suggestions. Allows access to authorized users regardless of {% data variables.product.prodname_copilot_short %} plan. Do not add this URL to your allowlist if you are using subscription-based network routing. For more information on subscription-based network routing, see [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-access/manage-network-access). | `*.githubcopilot.com` |
52+
| `https://*.individual.githubcopilot.com` | API service for {% data variables.product.prodname_copilot_short %} suggestions. Allows access to authorized users via a {% data variables.copilot.copilot_individuals_short %} plan. Do not add this URL to your allowlist if you are using subscription-based network routing. | Not included |
53+
| `https://*.business.githubcopilot.com` | API service for {% data variables.product.prodname_copilot_short %} suggestions. Allows access to authorized users via a {% data variables.copilot.copilot_business_short %} plan. Do not add this URL to your allowlist if you want to use subscription-based network routing to block users from using {% data variables.copilot.copilot_business_short %} on your network. | Not included |
54+
| `https://*.enterprise.githubcopilot.com` | API service for {% data variables.product.prodname_copilot_short %} suggestions. Allows access to authorized users via a {% data variables.copilot.copilot_enterprise_short %} plan. Do not add this URL to your allowlist if you want to use subscription-based network routing to block users from using {% data variables.copilot.copilot_enterprise_short %} on your network. | Not included |
55+
| `https://copilot-reports.github.com` | {% data variables.product.prodname_copilot_short %} usage metrics report downloads | `*.github.com` |
56+
| `https://copilot-reports-*.b01.azurefd.net` | {% data variables.product.prodname_copilot_short %} usage metrics report downloads (fallback). Required for fallback scenarios where downloads bypass the custom domain and are served from an Azure Front Door CDN. | Not included |
57+
| `https://usagereports*.blob.core.windows.net` | {% data variables.product.prodname_copilot_short %} usage metrics report downloads (fallback). Required for fallback scenarios where downloads bypass the Azure Front Door CDN and are served directly from Azure Blob Storage. | Not included |
58+
59+
## {% data variables.product.prodname_copilot_short %} on {% data variables.enterprise.data_residency_site %}
60+
61+
If you use {% data variables.enterprise.data_residency %}, your enterprise and {% data variables.product.github %}'s services are hosted on a unique subdomain of {% data variables.enterprise.data_residency_site %}.
62+
63+
1. Allow access to the following domains, which cover most required services.
64+
65+
* `https://*.SUBDOMAIN.ghe.com`
66+
* `https://SUBDOMAIN.ghe.com`
67+
68+
Replace SUBDOMAIN with your enterprise slug.
69+
70+
1. If you plan to use public code detection, allow access to `https://origin-tracker.githubusercontent.com`. This is required to check generated code against public code hosted on {% data variables.product.prodname_dotcom_the_website %}. For more information, see [AUTOTITLE](/copilot/concepts/completions/code-referencing).
71+
72+
All other domains that are required on {% data variables.product.prodname_dotcom_the_website %} are **not** required on {% data variables.enterprise.data_residency_site %}. For example:
73+
74+
* Individual services have a dedicated endpoint on your subdomain (such as `https://copilot-proxy.SUBDOMAIN.ghe.com/`)
75+
* Client experimentation is disabled on {% data variables.enterprise.data_residency_site %}, so `https://default.exp-tas.com` is not required
76+
* Individual {% data variables.product.prodname_copilot_short %} plans are not available on {% data variables.enterprise.data_residency_site %}, so subscription-based network routing (such as `https://*.individual.githubcopilot.com`) is not supported
77+
78+
## Editor-specific requirements
79+
80+
In addition to the URLs required to connect to {% data variables.product.prodname_copilot_short %}, you must ensure your network rules meet the requirements the local client (for example, outbound requests to `vscode.dev` in {% data variables.product.prodname_vscode %}). Find the documentation for your chosen client, for example:
81+
82+
* [Network Connections in {% data variables.product.prodname_vscode %}](https://code.visualstudio.com/docs/setup/network) in the {% data variables.product.prodname_vs %} documentation
83+
* [Install and use {% data variables.product.prodname_vs %} and Azure Services behind a firewall or proxy server](https://learn.microsoft.com/en-us/visualstudio/install/install-and-use-visual-studio-behind-a-firewall-or-proxy-server) in the Microsoft documentation
5784

5885
## {% data variables.product.prodname_copilot_short %} voice features
5986

@@ -64,7 +91,7 @@ Voice features in {% data variables.copilot.copilot_cli %} and the {% data varia
6491
| `https://ai.azure.com` | Model catalog requests |
6592
| `https://api.catalog.azureml.ms` | Detecting the optimal Azure region for model downloads |
6693
| `https://*.api.azureml.ms` | Regional model catalog endpoints |
67-
| `https://amlwlrt4*.blob.core.windows.net`[^7] | Model downloads from regional Azure Blob Storage |
94+
| `https://amlwlrt4*.blob.core.windows.net` | Model downloads from regional Azure Blob Storage. The `amlwlrt4*` wildcard matches the regional Azure Blob Storage accounts that Foundry Local voice features use to download models. The specific storage account depends on the Azure region closest to the user. |
6895

6996
## {% data variables.copilot.copilot_cloud_agent %} recommended allowlist
7097

@@ -413,15 +440,3 @@ The allowlist allows access to the following hosts:
413440
* `dl.k8s.io`
414441
* `pkgs.k8s.io`
415442

416-
## Further reading
417-
418-
* [Network Connections in {% data variables.product.prodname_vscode %}](https://code.visualstudio.com/docs/setup/network) in the {% data variables.product.prodname_vs %} documentation
419-
* [Install and use {% data variables.product.prodname_vs %} and Azure Services behind a firewall or proxy server](https://learn.microsoft.com/en-us/visualstudio/install/install-and-use-visual-studio-behind-a-firewall-or-proxy-server) in the Microsoft documentation
420-
421-
[^1]: Allows access to authorized users regardless of {% data variables.product.prodname_copilot_short %} plan. Do not add this URL to your allowlist if you are using subscription-based network routing. For more information on subscription-based network routing, see [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-access/manage-network-access).
422-
[^2]: Allows access to authorized users via a {% data variables.copilot.copilot_individuals_short %} plan. Do not add this URL to your allowlist if you are using subscription-based network routing.
423-
[^3]: Allows access to authorized users via a {% data variables.copilot.copilot_business_short %} plan. Do not add this URL to your allowlist if you want to use subscription-based network routing to block users from using {% data variables.copilot.copilot_business_short %} on your network.
424-
[^4]: Allows access to authorized users via a {% data variables.copilot.copilot_enterprise_short %} plan. Do not add this URL to your allowlist if you want to use subscription-based network routing to block users from using {% data variables.copilot.copilot_enterprise_short %} on your network.
425-
[^5]: Required for fallback scenarios where {% data variables.product.prodname_copilot_short %} usage metrics report downloads bypass the custom domain and are served from an Azure Front Door CDN.
426-
[^6]: Required for fallback scenarios where {% data variables.product.prodname_copilot_short %} usage metrics report downloads bypass the Azure Front Door CDN and are served directly from Azure Blob Storage.
427-
[^7]: The `amlwlrt4*` wildcard matches the regional Azure Blob Storage accounts that Foundry Local voice features use to download models. The specific storage account depends on the Azure region closest to the user.

0 commit comments

Comments
 (0)