Copilot seat management can now run from a GitHub App, not a person’s token

GitHub, owned by Microsoft, says enterprise GitHub Apps can now call the enterprise-level Copilot seat management APIs. A new fine-grained permission, Enterprise Copilot license management, controls access, according to the changelog entry.

A new permission instead of a borrowed login

The announcement is short. In its own words, “Enterprise GitHub Apps can now call the enterprise-level Copilot seat management APIs.” Those APIs decide which users and which enterprise teams hold a Copilot seat. The permission that unlocks them is new and is set at the enterprise level.

The changelog points to the Copilot user management REST documentation, API version 2026-03-10. Reading that page shows what the APIs cover. There is an endpoint to list every seat assignment in an enterprise, endpoints to add or remove enterprise teams, endpoints to add or remove individual users by username, and one to fetch a single member’s seat details and activity. All paths sit under /enterprises/{enterprise}/, where the enterprise slug is the identifier.

The documentation also carries caveats that the changelog does not repeat. The endpoints are labeled public preview and may change. Removing a seat does not cut access at once: the seat is marked as pending cancellation and ends when the billing cycle closes, unless the person still gets Copilot through another team. Requests return a 422 error if Copilot Business or Enterprise is not enabled, billing is not set up, or the public code suggestions policy has not been configured for the enterprise.

The documentation lists token scopes for classic personal access tokens and OAuth apps, such as manage_billing:copilot and admin:enterprise. It also says only enterprise owners can cancel seats for their members. The changelog does not say how the new App permission maps onto those owner-only rules, and that is the first thing an administrator would want to confirm.

What changes for the people running the rollout

Until now, as the documentation describes it, these endpoints were tied to tokens that belong to a person or an OAuth app. For a company that assigns seats by script, for instance when a hire joins a team or a contractor’s engagement ends, that usually means a script running under an owner’s credentials. A GitHub App is a separate identity with its own narrowly scoped permission, which is the usual reason enterprises prefer one. The announcement itself makes no such argument, so this reading is ours rather than GitHub’s.

The practical gain is a narrower grant. An app holding only the Copilot license permission can manage seats without also receiving the broad enterprise administration scope that the older token route listed for adding and removing users.

What the announcement does not establish matters just as much. It names no plan requirement beyond the enterprise scope, gives no rollout schedule and no price, and does not say whether the permission is available to every enterprise or arrives gradually. The page is tagged only with Copilot and enterprise management tools. Readers should treat availability as unconfirmed until they see the permission in their own enterprise settings.

One more admin control in a busy week for Copilot

The change fits a pattern of GitHub adding administrative levers to Copilot at the enterprise level. Two days earlier, as we reported, Copilot added Claude Fable 5.2 behind a policy that Business and Enterprise admins must switch on, which also counts as acknowledging Anthropic’s data retention requirement. The policy is off by default, so leaving it untouched keeps the model unavailable across the organization. That model is offered to Copilot Pro+, Max, Business and Enterprise subscribers.

Seat assignment and model policy are different controls, but they point the same way: organizations with many Copilot users want to manage who gets what in code, not by clicking through settings pages. The same week also saw several Copilot CLI releases, in the 1.0.109 and 1.0.110 series, which GitHub published on its releases page. None of those is tied to this change.

The limits are also worth noting. The seat APIs are in public preview according to the documentation, so teams building automation on them should expect the interface to move. There is no sign yet of the same permission for organization-level Copilot management, and the changelog does not mention it.

For an enterprise owner, the next step is concrete: check whether the Enterprise Copilot license management permission appears when registering or editing an enterprise GitHub App, then test it against the list endpoint before moving any seat assignment job onto it. GitHub has not published a date for the APIs to leave preview.