Skip to main content
In this lesson we explain data exclusion mechanisms for GitHub Copilot and show how to create content exclusions to protect privacy. You’ll learn what content exclusion does, who can manage it, how to configure it at repository and organization levels, the supported pattern syntax, typical use cases, and practical limitations to consider. What is content exclusion? Content exclusion is a configuration that instructs GitHub Copilot to ignore specific files and directories during processing. It has three concrete effects:
  • No code completions in excluded files — Copilot will not offer completions while editing those files.
  • Excluded content will not shape suggestions in other files — excluded code is not used to influence completions elsewhere.
  • GitHub Copilot Chat will not use excluded content when answering questions.
A dark-themed slide titled "Content Exclusion" with three numbered cards: "01 No Code Completions," "02 No Suggestions," and "03 No Chat Data," each shown with an icon. Each card explains that excluded content won't be used for code completions, suggestions in other files, or chat responses.
Together these behaviors let you precisely control which parts of a codebase are available to Copilot’s models, helping you balance AI productivity with privacy and compliance. Who can manage content exclusion?
  • Repository administrators can create and modify exclusions for individual repositories.
  • Organization owners can define organization-wide exclusions that apply to users with Copilot seats.
  • Other repository roles (for example, users with the maintain role) may be able to view—but not change—content-exclusion settings.
Content exclusion is available only for GitHub Copilot Business and Enterprise subscriptions. It is not included in individual plans.
Repository-level vs Organization-level (quick comparison) Repository-level exclusion — how to set it up
  1. Open the repository Settings and go to the Copilot (or Copilot settings) section.
  2. Locate Content Exclusion and add patterns for files and directories you want to exclude. In the UI each pattern is typically entered as a quoted string on its own line (the list may be displayed with a leading dash).
  3. Save the changes. Exclusions take effect immediately.
Repository-level exclusions are ideal when a specific repository contains sensitive or proprietary code you never want processed by Copilot. Organization-level exclusion — how to set it up
  1. In Organization settings, navigate to Copilot → Content Exclusion.
  2. Define the scope of exclusion (for example, files tracked in Git repositories or files anywhere on the file system).
  3. Apply patterns using fnmatch notation (supports wildcards and directory wildcards).
A dark-themed slide titled "Organization-Level Exclusion" showing a three-step flow with circular icons for Access Settings, Define Scope, and Apply Patterns. Each step gives brief instructions about navigating organization settings, excluding files in Git repositories or the file system, and using fnmatch wildcards.
Organization-level rules let you enforce consistent privacy protections across many repositories and teams. Pattern matching techniques Use fnmatch-like patterns to express files and directories to exclude. Common examples:
Best practices for pattern use
  • Use exact filenames to exclude a single file across the repo.
  • Use * and ? for simple wildcards and ** for recursive directory matches.
  • Combine patterns to exclude specific file types only in certain folders while leaving them enabled elsewhere.
  • Test patterns in a safe environment or a small repository to confirm they match the intended files before applying org-wide.
Common use cases for exclusions
  • Proprietary algorithms or company-specific intellectual property you do not want processed by external models.
  • Customer data and personally identifiable information (PII) that must not be sent to AI services.
  • Security credentials: API keys, private certificates, or other secrets.
Limitations and practical considerations
  • Indirect access: Exclusion is not an absolute barrier. IDEs may provide semantic information (for example symbol names, type information, or indexing data) to the Copilot assistant, which can allow indirect access to details about excluded files. Be mindful of which IDE features (like symbol/server indexing or language servers) are enabled.
A presentation slide titled "Limitations" with a dark card in the center featuring a blue circular/speech-bubble icon and the text "Possible indirect access through IDE-provided semantic information." The card sits on a light rounded rectangle against a dark background.
  • Visual indicators: Most IDEs display visual cues when content is excluded, helping you verify which files are protected.
  • Exclusion applies only to Copilot processing; it does not change repository visibility, branch protections, or other access controls. Continue to use standard source-control and permission practices.
Content exclusion helps prevent Copilot from processing files, but it is not a substitute for proper access controls. Always combine exclusions with repository permissions, secrets management, and secure development practices.
Key benefits
  • Enhanced security for sensitive code and intellectual property.
  • Better compliance with data protection and privacy requirements.
  • Clear control over which content can inform AI suggestions, reducing leakage risk.
A "Key Benefits" slide with three colorful circular icons across the bottom. The captions read "Enhanced security for sensitive code," "Compliance with data protection requirements," and "Control over what informs AI suggestions."
Conclusion Content exclusion provides a practical way to balance the productivity gains of GitHub Copilot with organizational privacy and compliance needs. Use repository-level exclusions for targeted protection and organization-level rules to enforce policies broadly. Pair exclusions with careful IDE configuration and robust access controls to minimize the risk of unintended exposure while continuing to benefit from AI-assisted development. Links and references

Watch Video