GitHub Enterprise administration, demystified
One interactive place to understand how enterprise accounts, organizations, enterprise teams, cost centers, budgets, AI credits, and Copilot licensing fit together — with live scenario simulation and a full REST API reference. Content is verified against GitHub Docs and the GitHub Changelog (July 2026) and auto-refreshed weekly.
The big picture
Three pillars of spend governance
1 · Attribution — Cost Centers
Answer "who spent this?" Assign users, orgs, repos, and enterprise teams to cost centers. Usage rolls up automatically for chargeback and forecasting. Cost centers never stop spending by themselves.
2 · Control — Budgets
Answer "how much may they spend?" Dollar limits on metered products at enterprise, org, repo, cost center, or per-user scope — with alerts at 75/90/100% and an optional hard stop.
3 · Caps — AI Credit Pools NEW · Jul 2, 2026
Answer "how much of the shared included pool may they draw?" Cap a cost center's included AI credit consumption to exactly what its own Copilot licenses fund. Auto-calculated, API-managed.
What changed recently?
| Date | Change | Status |
|---|---|---|
| 2026-07-02 | Cost centers support AI credit pools — cap included AI credit draw per cost center (REST API; UI coming soon) | GA (API) |
| 2026-06-30 | Per-user AI credit budgets for cost centers (user-level budgets scoped to a cost center) | GA (API) |
| 2026-06-22 | Enterprise teams can be assigned to cost centers (SCIM-synced attribution) | GA |
| 2026-06-04 | Enterprise Teams generally available · Budget & usage management APIs GA | GA |
| 2026-02-26 | Enterprise AI Controls & Agent Control Plane GA — "AI Controls" tab is the permanent policy home | GA |
| 2025-10-28 | Copilot Business management at the enterprise level GA (assign to users/enterprise teams, no org needed) | GA |
Full history in the Changelog tab — auto-updated weekly by a GitHub Actions workflow.
Enterprise & organization setup
The enterprise account is the top-level container for policy, billing, and identity. Organizations own the code. Understanding the roles at each level is the foundation of everything else.
Classic enterprise vs Enterprise Managed Users (EMU)
Classic (personal accounts)
- Users bring their own github.com accounts
- SAML SSO supported (enterprise or per-org)
- Team sync only via Entra ID or Okta (org teams)
- ❌ No IdP sync for enterprise teams
- ❌ No guest collaborator role
EMU (managed accounts)
- Accounts provisioned from IdP (Entra ID, Okta, PingFederate) via SCIM
- Users can't change username/profile; no public content
- ✅ Enterprise team ↔ IdP group sync via SCIM
- ✅ Guest collaborator role available
- Org/team membership fully IdP-driven
| Partner IdP | SAML | OIDC | SCIM |
|---|---|---|---|
| Microsoft Entra ID | ✅ | ✅ | ✅ |
| Okta | ✅ | ❌ | ✅ |
| PingFederate | ✅ | ❌ | ✅ |
Enterprise roles
| Role | What they can do | Notes |
|---|---|---|
| Enterprise owner | Full control of settings, members, policies, billing | No org access by default — must join each org |
| Billing manager | Billing settings, licenses, usage-based billing, cost centers & budgets | Cannot assign enterprise teams to cost centers (owners only) |
| App manager | Manage enterprise-owned GitHub App registrations | Cannot install/uninstall apps on orgs |
| Security manager Preview | View/manage security alerts enterprise-wide | |
| Member | Default role; internal-repo visibility across orgs | |
| Unaffiliated user | In the enterprise but no org | Can still receive Copilot Business, enterprise team membership & custom roles |
| Guest collaborator | Limited internal-repo visibility | EMU only |
| Custom roles | Delegated slices of enterprise admin (e.g., "AI manager") | Defined by enterprise owners |
Organization roles
| Role | Scope |
|---|---|
| Owner | Complete admin access to the org |
| Member | Default; can create repos and projects |
| Billing manager | Org billing settings only |
| Security manager | Security alerts/settings on all repos + read access |
| Moderator | Block users, interaction limits, hide comments |
| GitHub App manager | Org-owned GitHub App registrations |
| Outside / repository collaborator | Per-repo access without membership (EMU: "repository collaborator") |
| Custom org roles | Granular permission sets (e.g., audit-log-only) |
Adding organizations to an enterprise
Policy inheritance model
Enterprise Teams GA · Jun 4, 2026
Teams that live at the enterprise level and span organizations. They are the connective tissue between identity (IdP groups), Copilot licensing, org membership, and cost attribution.
Timeline
✅ Can do
- Receive Copilot Business licenses from the enterprise
- Hold predefined/custom enterprise roles
- Be added to organizations (members join without invites)
- Bypass access on repository rulesets
- @mention (
@/ent:team-slug), assign, request review on PRs - IdP group sync via SCIM (EMU)
- GitHub Apps & fine-grained PATs via "enterprise teams" permission
- Full audit-log coverage
- Belong to a cost center (usage attribution)
❌ Cannot do (yet)
- IdP sync in classic (personal-account) enterprises
- CODEOWNERS entries
- Secret visibility
- Nested (parent/child) teams
- Team maintainer role
- Project board access
Limits
- 2,500 teams per enterprise
- 5,000 members per team
- 1,000 organizations per team
Key REST endpoints
| Action | Endpoint |
|---|---|
| List / create teams | GET/POST /enterprises/{enterprise}/teams |
| Get / update / delete | GET/PATCH/DELETE /enterprises/{enterprise}/teams/{team_slug} |
| Bulk membership | POST …/teams/{team}/memberships/add · …/remove |
| Single member | PUT/DELETE …/teams/{team}/memberships/{username} |
| Org assignment | POST …/teams/{team}/organizations/add · PUT/DELETE …/organizations/{org} |
Auth: classic PAT — read:enterprise (read) / admin:enterprise (write). Full details in the API Explorer.
Cost centers & budgets
Cost centers attribute usage to business units. Budgets control how much gets spent. They are separate, complementary tools — most enterprises need both.
Cost centers — attribution
Who can manage them
- Enterprise owners & billing managers — any resource in the enterprise
- Org owners — cost centers containing only their org's resources
- Enterprise teams → cost centers: enterprise owners only
What goes in one
- 👤 Users (direct)
- 🏢 Organizations
- 📁 Repositories
- 👥 Enterprise teams Jun 2026 (SCIM-synced)
A resource belongs to one cost center at a time — adding it elsewhere moves it.
Limits & facts
- Max 500 active cost centers per enterprise
- Max 25,000 resources per cost center
- Max 50 resources per API call
- Outside collaborators / unaffiliated users: API-only assignment
- Each cost center can bill to a different Azure subscription (UI-only setup)
- Deleting = archiving — still queryable with
?state=deleted
How usage is attributed
| Product | Charged to the cost center containing… |
|---|---|
| GitHub Actions | the repository or organization where the workflow runs |
| Codespaces | the repository or organization where it's created |
| Copilot license | the user (priority) → the org paying for the license |
| AI credits / Copilot cloud agent | the user who triggered usage (priority) → org that granted the license |
| GitHub Enterprise license | the user (priority) → oldest org the user belongs to |
| Advanced Security | the user (priority) → org billed for the license |
| Git LFS / Packages | the repository or organization owning the resource |
Budgets — control
Product budgets
ProductPricing — an entire product: all of Actions, all of Packages, Codespaces…
SKU budgets
SkuPricing — one SKU: actions_linux_96_core, secret_protection, code_security…
Bundled AI credits
BundlePricing + ai_credits — everything that consumes AI credits: Copilot, cloud agent, Spark.
| Budget scope | Caps | Notes |
|---|---|---|
| Enterprise | All metered charges enterprise-wide | Not a total bill cap — licenses are separate |
| Organization | One org's metered charges | |
| Repository | One repo's metered charges | |
| Cost center | All metered charges attributed to the cost center | Pairs with AI credit pools |
| User — universal | AI credits per licensed user (all users) | Always a hard stop |
| User — cost center Jun 30, 2026 | Per-user cap for everyone in a cost center | Overrides universal; API-only |
| User — individual | One specific user | Overrides both; $0 = immediate block |
Budget mechanics worth remembering
- Max 10,000 budgets per account; amounts in whole dollars
- Budgets apply from creation date — never retroactive (first cycle can overshoot)
- Scope can't be changed after creation — delete and recreate
- Lowest remaining headroom wins: whichever applicable budget has the least capacity left blocks first
- Cost center exclusion lets a team's metered charges bypass the enterprise budget
Cost center vs budget vs AI credit pool
| Control | Question it answers | Phase | Stops spend? |
|---|---|---|---|
| Cost center | Who is responsible for this usage? | Always (attribution) | ❌ Never |
| AI credit pool | How much included AI credit may this cost center draw? | Pool phase (before metered) | ✅ Optional block or roll to paid |
| Budget | How many dollars of metered usage are allowed? | Metered phase (after pool) | ✅ If "stop usage" enabled |
AI credits & included usage caps
Copilot usage-based billing moved from per-request "premium request" multipliers to token-based AI credits. Existing premium-request budgets were converted automatically. 1 AI credit = $0.01 USD.
Included credits per plan
| Plan | Price | Standard included AI credits / user / month | Promo (Jun 1 – Sep 1, 2026) |
|---|---|---|---|
| Copilot Business | $19 / user / mo | 1,900 | 3,000 |
| Copilot Enterprise | $39 / user / mo | 3,900 | 7,000 |
AI credit pools for cost centers Jul 2, 2026
How it works
- Toggle
ai_credit_pool_enabled: trueon create/edit (REST API today; UI coming) - Cost center must contain users or enterprise teams (not just orgs/repos)
- Limit auto-adjusts as licenses are added/removed
- Applies only to the included/pool phase — before metered billing
When the cap is hit — pick one
- 🚫 Block: members stop consuming included credits (completions keep working)
- 💳 Roll to paid: usage continues as metered spend at $0.01/credit (requires the "AI credit paid usage" policy) — then cost center budgets take over
The full check sequence for one AI request
What consumes AI credits
✅ Consumes credits
Copilot Chat · Copilot CLI · Copilot cloud agent · Copilot Spaces · Spark · third-party coding agents · code review (tokens billed to review requester)
❌ Never consumes credits
Code completions and next edit suggestions — unlimited on all paid plans, and they keep working even when a user is blocked.
Model pricing per 1M tokens (July 2026)
| Model | Input | Cached | Output |
|---|---|---|---|
| GPT-5 mini | $0.25 | $0.025 | $2.00 |
| GPT-5.4 mini | $0.75 | $0.075 | $4.50 |
| GPT-5.3-Codex | $1.75 | $0.175 | $14.00 |
| GPT-5.4 (≤272K) | $2.50 | $0.25 | $15.00 |
| GPT-5.5 (≤272K) | $5.00 | $0.50 | $30.00 |
| Claude Haiku 4.5 | $1.00 | $0.10 | $5.00 |
| Claude Sonnet 4.x | $3.00 | $0.30 | $15.00 |
| Claude Sonnet 5 (promo) | $2.00 | $0.20 | $10.00 |
| Claude Opus 4.5–4.8 | $5.00 | $0.50 | $25.00 |
| Claude Fable 5 | $10.00 | $1.00 | $50.00 |
| Gemini 2.5 Pro | $1.25 | $0.125 | $10.00 |
| Gemini 3.1 Pro (≤200K) | $2.00 | $0.20 | $12.00 |
Anthropic models also bill cache writes (e.g., Sonnet $3.75/1M). Copilot code review model selection is automatic and undisclosed.
Copilot seat & license management
Two distinct licensing models coexist: enterprise-level direct assignment (Copilot Business only, no org required) and org-level enablement (Business or Enterprise, org owners pick who gets seats).
no org membership, no GHEC license needed
Business or Enterprise plan per org — mixed plans OK
Path 1 — enterprise direct
- Enterprise → Billing & Licensing → Licensing → Copilot → Manage
- Assign to individual users or enterprise teams
- Works for unaffiliated users (no org, no GHEC seat)
- Copilot Business only — no enterprise-level path for Copilot Enterprise
- "Policies for enterprise-assigned users" governs these users when org policies are delegated
Path 2 — via organizations
- Enterprise enables Copilot for specific orgs or all orgs
- With a Copilot Enterprise agreement: pick Business or Enterprise per org — mixed plans in one enterprise
- Org owner then chooses: all members / selected members / selected teams
- Copilot Enterprise seats are only assignable this way
Seat management API surface
| Level | Endpoint | Purpose |
|---|---|---|
| Enterprise Preview | GET /enterprises/{e}/copilot/billing/seats | All seats across orgs + enterprise teams (deduped in total_seats) |
POST/DELETE /enterprises/{e}/copilot/billing/selected_enterprise_teams | Grant/revoke via enterprise teams | |
POST/DELETE /enterprises/{e}/copilot/billing/selected_users | Grant/revoke individual users | |
| Organization | GET /orgs/{org}/copilot/billing | Subscription info, seat breakdown, feature policies |
GET /orgs/{org}/copilot/billing/seats | List org seats | |
POST/DELETE /orgs/{org}/copilot/billing/selected_teams · selected_users | Grant/revoke via org teams / users | |
GET /orgs/{org}/members/{username}/copilot | One user's seat details & last activity |
Usage metrics API (2026 architecture)
The old inline-JSON /copilot/usage endpoint is superseded. Metrics endpoints now return signed download links to report files. Requires the "Copilot usage metrics" policy = Enabled everywhere. History: up to 1 year (data since Oct 10, 2025).
| Report | Enterprise | Org |
|---|---|---|
| 28-day aggregate | …/copilot/metrics/reports/enterprise-28-day/latest | …/copilot/metrics/reports/organization-28-day/latest |
| 1-day aggregate | …/enterprise-1-day?day=YYYY-MM-DD | …/organization-1-day |
| User-level | …/users-28-day/latest · …/users-1-day | same, org-scoped |
| User↔team join | …/user-teams-1-day | same, org-scoped |
Copilot & AI policies
Since Feb 26, 2026 all Copilot/agent governance lives in the enterprise AI Controls tab (the old Copilot policies page was removed). Each policy is set to Enforce, Delegate ("no policy"), or Disable.
Key enterprise policies
| Policy | Surface | Notes |
|---|---|---|
| Copilot Chat in IDE / agent mode | IDEs | Agent mode policy added Nov 2025, defaults Enabled |
| Copilot CLI · Copilot on GitHub.com | CLI / web | |
| Copilot cloud agent | Cloud agents | Enterprise selects specific orgs — not simple delegation |
| Third-party agents · code review · web search | Agents | |
| MCP servers in Copilot | MCP | Does not govern GitHub MCP server in third-party hosts; enterprise MCP allowlist still in preview |
| Suggestions matching public code | IDEs | allow / block / unconfigured |
| Custom models · Spark · editor previews | Various | |
| Copilot Metrics API | API | Most-restrictive conflict resolution |
Conflict resolution for multi-org users
Least restrictive wins
Chat, agent mode, CLI, web Copilot, web search, code review, cloud agent, Spark, MCP, editor previews, custom models — if any org enables it, the user has it.
Most restrictive wins
Public code suggestions, Copilot Metrics API, semantic indexing — if any org disables it, the user loses it. Across multiple enterprises, most restrictive usually applies.
Agent Control Plane GA Feb 2026
- Enterprise-wide agent session visibility (24h), searchable and filterable by agent, usage tracking by org
- Agentic audit-log fields:
actor_is_agent,user,agent_session.task - Custom agents: canonical path
.github-private/agents/*.md, REST API for definitions, 1-click push protection rule - "AI manager" custom role delegates AI governance without full enterprise ownership
Scenario Lab 🧪
Build an enterprise, split licenses across cost centers, toggle AI credit pools and budgets, then simulate a month of usage. Numbers use real July 2026 rates: Business $19/seat + 1,900 credits, Enterprise $39/seat + 3,900 credits, $0.01 per metered credit.
Presets
1 · Enterprise licenses
2 · Cost centers
3 · Results
REST API Explorer
Every admin/billing endpoint covered in this hub, with auth requirements, sample payloads, and copyable curl. All calls need headers: Accept: application/vnd.github+json and X-GitHub-Api-Version.
Changelog tracker
Relevant entries from the GitHub Changelog, filtered to enterprise admin, billing, cost centers, and Copilot management. A GitHub Actions workflow in this repo refreshes this list every Monday and updates the README.