GitHub Puts Copilot Agent Sessions Into Enterprise Audit Logs
GitHub's Copilot agent session streaming is now in public preview, giving enterprise admins a direct feed of prompts, responses, and tool calls.
What GitHub announced
GitHub Enterprise Cloud customers with enterprise managed users can now access Copilot agent session data across all Copilot clients. That includes cloud agents operating on github.com and on data resident deployments on ghe.com, as well as partner IDEs such as those provided by JetBrains and Eclipse. According to GitHub's changelog post, this gives admins direct visibility into agent session activity, including prompts, responses, and tool calls, so they can manage AI usage across their enterprise.
Two ways to pull the data
GitHub offers two paths into this session data. The first is a streaming connection: from the audit log settings, an enterprise can point GitHub at an event collector or SIEM tool of its choice, and GitHub then automatically streams all session data for that enterprise to the chosen endpoint. Microsoft Purview is also available as a supported streaming endpoint in public preview, which GitHub says gives customers in the Microsoft ecosystem a direct pathway for sending this auditability data from every GitHub Copilot client. The second path is a REST API that lets enterprise owners pull the last 48 hours of session data on demand, through the endpoint GET /enterprises/{enterprise}/copilot/usage-records.
How to turn it on
To enable the feature, an enterprise owner goes to the Copilot subpage inside AI Controls and selects "Enable everywhere" for both "Copilot Usage Records Streaming" and "Copilot Usage Records API." From there, the streaming connection itself is configured from the enterprise's audit log settings, the same place other GitHub audit log streaming destinations are managed.
Key facts
- The feature is limited to GitHub Enterprise Cloud customers with enterprise managed users.
- It covers cloud agents on github.com and ghe.com, plus partner IDEs such as JetBrains and Eclipse.
- Data can be streamed continuously to an enterprise's chosen event collector or SIEM tool, or to Microsoft Purview.
- A REST endpoint separately returns the last 48 hours of session data on request.
- The two toggles are named "Copilot Usage Records Streaming" and "Copilot Usage Records API," both enabled from the Copilot subpage in AI Controls.
Why it matters
Enterprises adopting AI coding agents have had to take GitHub's word for what those agents actually did inside a repository, since agent activity mostly lived inside GitHub's own interface. This matters because it gives compliance and security teams a direct feed of what Copilot's agents were prompted with, what they answered, and which tools they called, sent into tools those teams already use for everything else, such as a SIEM tool or Microsoft Purview. For enterprises that already centralize logging from other vendors, that is a more familiar way to keep an eye on a fast-growing category of automated activity than checking GitHub's dashboards by hand.
What is not covered
GitHub's announcement is scoped to GitHub Enterprise Cloud customers with enterprise managed users; the post does not describe availability for other plan tiers. It also does not state pricing for the feature beyond describing it as being in public preview.
Check your understanding
Which two Copilot Usage Records toggles does an enterprise owner turn on inside AI Controls?
How many hours of session data can the REST endpoint return on demand?