2.4.2. Copilot Code Review Policies
💡 First Principle: Code review policies decide whether and how broadly Copilot reviews pull requests in an organization — including the choice to cover PRs from contributors who don't hold a Copilot seat. Coverage is a deliberate admin decision with billing consequences.
Admins can enable Copilot code review across the organization and, with explicit policies, extend it to all PRs on GitHub.com — even those authored by non-licensed users. Enabling that broader coverage requires turning on specific policies (for example, allowing AI Credit usage to be billed, and a policy permitting non-licensed users' PRs to be reviewed). It's off by default, giving admins control over cost and scope. Note that, from June 1, 2026, code review workflows also consume GitHub Actions minutes in addition to AI Credits.
A scenario: an org wants every PR reviewed for quality, including community contributions from people without seats. The admin enables the relevant code review policies; non-licensed usage bills to the org as AI Credits, while licensed users draw from their normal allowance.
📝 Currency note: The Actions-minutes consumption and the exact policy names are post-January-2026 billing details. The exam-stable idea: extending code review to non-licensed PRs is an opt-in admin policy, not a default.
⚠️ Exam Trap: Broad code review coverage is not automatic. If a question assumes every PR is reviewed by Copilot by default, that's wrong — an admin must enable the policy, and there are cost implications.
Reflection Question: What makes "review every PR, including from non-seat contributors" an admin decision rather than something individual maintainers enable, and what cost factors come with it?
