Configure Privacy, Content Exclusions, and Safeguards
Domain 6 - Configure Privacy, Content Exclusions, and Safeguards
This domain tests configuration: what an administrator can switch on or off, how exclusions actually behave, and which safeguards you layer on top.
Content exclusion mechanics
- Configured in repository settings or at the organization level with path patterns, for example
- "/src/payments/**"or- "**/*.env". - Excluded files are not used as context for suggestions, and their content is not surfaced in Copilot output - a secret-bearing file cannot be pulled into another file's completion.
- Changes can take time (roughly up to 30 minutes) to reach clients, and exclusions are not retroactive.
- Exclusion does not stop Copilot working inside that file, does not scrub git history, and does not prevent similar code existing in other repositories or in training data.
Policy and safeguard controls
- Organization policies toggle features per surface: Copilot Chat in the IDE, Copilot CLI, Copilot in github.com, Copilot code review, Copilot Autofix, editor preview features, and MCP or extension access.
- Suggestions matching public code can be set to Block or Allow at the organization level, backed by the duplication detection filter and code referencing.
- The audit log records policy changes, seat assignments, and content-exclusion changes - your evidence trail.
- Copilot Business and Enterprise add no-retention and no-training commitments plus IP indemnity; secret scanning with push protection, Dependabot, and CodeQL with Autofix cover exposure that Copilot cannot.
Worked example
An engineer commits deploy/prod.tfvars containing credentials. Correct sequence: rotate the secrets first (exclusion is not remediation), add - "/deploy/*.tfvars" as a content exclusion at repo or org level, confirm propagation by testing a prompt in another file, then enable push protection so the next attempt is blocked. Reasoning: exclusion limits future context leakage; rotation and push protection address the actual exposure.
Traps
- Treating content exclusion as secret removal, or as instant.
- Assuming exclusions behave identically on every surface; verify current coverage for CLI, mobile, and code review.
- Believing individual users can override organization policy.
- Forgetting that disabling a feature policy does not delete data retained earlier under a different plan.