Vendor account findingView consolidated app (2 findings) →
← Findings by source

GitHub Copilot

Vendor · GitHub Copilot (demo) GitHub (Microsoft) · Coding · github-copilot organization API

Policy · none set
Policy changes re-score this app on the next sync, which starts right away.
Finding · Open
Risk score
31
Medium
People
12
Seats in the vendor organization
Requests · 30 days
53,760
0 active · 0 keys
First seen
Nov 18, 2025
Last seen 2 h ago
vendorgithub-copilotsanctioned-accountpending-invitesidle-seatspublic-code-allowedcorroboratedsanctioned
Next steps

Recommended actions

  1. 014 seats have no activity in 30 days. Reclaim them; on per-seat plans that is money, on usage plans it is standing access.
  2. 02Copilot is allowed to suggest code matching public repositories. Turn public code suggestions off unless legal has accepted the license exposure.
  3. 032 invitations are pending. Expire invitations that were not accepted within a week.
GitHub Copilot (demo) · contoso · business

Inside the vendor organization

2026-08-16: 02026-08-17: 19202026-08-18: 19202026-08-19: 19202026-08-20: 19202026-08-21: 19202026-08-22: 19202026-08-23: 19202026-08-24: 19202026-08-25: 19202026-08-26: 19202026-08-27: 19202026-08-28: 19202026-08-29: 19202026-08-30: 19202026-08-31: 19202026-09-01: 19202026-09-02: 19202026-09-03: 19202026-09-04: 19202026-09-05: 19202026-09-06: 19202026-09-07: 19202026-09-08: 19202026-09-09: 19202026-09-10: 19202026-09-11: 19202026-09-12: 19202026-09-13: 19202026-09-14: 0
08-1609-14
4 idle2 pending0 adminpublic code allowed
Members
MemberRoleLast active
alice-wubusiness2 h ago
mia-chenbusiness26 h ago
frank-libusiness2 d ago
erin-diazbusiness26 h ago
oscar-rbusiness2 h ago
grace-hbusiness3 d ago
nina-pbusinessJul 31, 2026
tom-bbusinessJul 16, 2026
sam-kbusinessnever
lee-qbusinessnever
jo-mbusinessAug 10, 2026
kai-tbusinessJul 26, 2026
Models · 30 days
default47,600 requests
gpt-4o6,160 requests
Settings
ide chatenabled
seat managementassign_selected
inactive this cycle4
pending invitations2
public code suggestionsallow
Same app, other lanes

Related findings

Who

People

Identifiers come from device telemetry and proxy logs, so they may be account names rather than full directory entries.

PersonDepartmentSourceSign-ins · 30 dGranted
alice-wu
alice-wu
n/aVendor seat0No direct grant
erin-diaz
erin-diaz
n/aVendor seat0No direct grant
frank-li
frank-li
n/aVendor seat0No direct grant
grace-h
grace-h
n/aVendor seat0No direct grant
jo-m
jo-m
n/aVendor seat0No direct grant
kai-t
kai-t
n/aVendor seat0No direct grant
lee-q
lee-q
n/aVendor seat0No direct grant
mia-chen
mia-chen
n/aVendor seat0No direct grant
nina-p
nina-p
n/aVendor seat0No direct grant
oscar-r
oscar-r
n/aVendor seat0No direct grant
sam-k
sam-k
n/aVendor seat0No direct grant
tom-b
tom-b
n/aVendor seat0No direct grant
Why

Evidence

  1. vendor_org · Sep 14, 2026
    GitHub Copilot (demo) (contoso): 12 members, 53,760 requests in 30 days
    Detail
    {
  "byModel": [
    {
      "model": "default",
      "tokens": 14140,
      "requests": 47600
    },
    {
      "model": "gpt-4o",
      "tokens": 0,
      "requests": 6160
    }
  ],
  "settings": {
    "ideChat": "enabled",
    "seatManagement": "assign_selected",
    "inactiveThisCycle": 4,
    "pendingInvitations": 2,
    "publicCodeSuggestions": "allow"
  },
  "warnings": []
}
  2. corroboration
    Also found by another lane (repo:giypXj7r_Gc5tatesErdR:github-copilot)
    Detail
    {
  "findingKey": "repo:giypXj7r_Gc5tatesErdR:github-copilot"
}