"Copilot Requests" permission for fine-grained tokens should be visible for org-owned tokens

Describe the feature or problem you'd like to solve

The "Copilot Requests" Permission does not display when creating a token owned by an organization

Proposed solution

Organizations do not want individual user PAT's being used to authenticate automations in corporate environments. This will unblock automation use cases for organizations

Example prompts or workflows

Additional context

No response

My use case for this:

I'm trying to run copilot cli in a sandbox, where gh command is configured
Gh is authenticated with the organization token, for managing pull requests
Copilot cli get authenticated by using gh token, that has no copilot request permission
Copilot can't find any model because the lack of that permission, so can't be used

I have to choose, either I can use gh for accessing the repo, or I can use copilot CLI but I can't use both with one token in the same sandbox.

Please enable "copilot requests" permission for organization owned tokens, or enable a different token authentication for github cli.

either this, or add GITHUB_COPILOT_TOKEN to be prioritized over GITHUB_TOKEN when authenticating, or just let us use token auth via CLI argument

It looks like this is preventing me to use agentic workflow in an organization. The non-org PAT won't display me the Copilot Request permission either when I select repository to be non "public repositories". How can we workaround this?

Yep, me too. Why can't we use this permission? I'm completely stuck.

We need this as well

+1!!!

@RyanHecht

@RyanHecht this limitation preventing us from using the all workflows described in GitHub Agentic Workflows is there any plan to fix it or suggested workaround?

Agreed, we need this capability!

This is a total blocker right now

Any new on this?

It seems that the reason for this not existing is because a CoPilot license is associated with a GitHub user and not so much with an organization.
What this results in is that when you generate a fine grained personal access token (FG-PAT), you need to set the resource owner to your own GitHub user, even if you use this within your organization/enterprise.

This resolved my issue and I'm now able to use GitHub agentic workflows in my enterprise organization. The documentation should definitely be improved to mention this.

However, you do not want this to be pinned to an Org user in most cases.
And since request pools also allow you to have eg a "team shared excess quota", im confident it wouldnt be that hard to link usage into one of those
not to mention id rather have a short lived token in my automated stuff, than personal permanent ones

I wanted to play around with this but the permission don't show up at all to me (a user account with Copilot) I even can't find a page describing "Copilot Requests" permission at all and where/when it is select-able!

It seems that the reason for this not existing is because a CoPilot license is associated with a GitHub user and not so much with an organization. What this results in is that when you generate a fine grained personal access token (FG-PAT), you need to set the resource owner to your own GitHub user, even if you use this within your organization/enterprise.

This resolved my issue and I'm now able to use GitHub agentic workflows in my enterprise organization. The documentation should definitely be improved to mention this.

This wouldn't work with private repositories owned by the organization as you can't give access to them.

Related issue: github/gh-aw#18379

+1 for this. It currently a total blocker for my ability to use Agentic Workflows on private org-owned repos.

Fix PAT permission name doc + add token-type diagnostic step (#7)

fix: PAT 種別を Fine-grained 必須に訂正(Classic PAT は Copilot CLI 非対応)

@Brend-Smits

It seems that the reason for this not existing is because a CoPilot license is associated with a GitHub user and not so much with an organization. What this results in is that when you generate a fine grained personal access token (FG-PAT), you need to set the resource owner to your own GitHub user, even if you use this within your organization/enterprise.
This resolved my issue and I'm now able to use GitHub agentic workflows in my enterprise organization. The documentation should definitely be improved to mention this.

This work for me. Thank you.

In case anyone don't know: if we set the PAT to All repos or some repo, the Copilot Request permission is under the Account tab.

Your screenshot is showing a fine-grained token for your personal account, reason why you are seeing "Account", while the original poster is asking how to define a fine-grained token for an organization (reason why on OP screenshot you can see "Organizations" instead of Account)".

So to reiterate thread/issue:

fine-grained tokens for a personal account (your handle) work,
fine-grained tokens for organizational level don't allow defining "Copilot Requests", which will make your cli requests result in: Authorization error
solution from @Brend-Smits if I understood correctly allows you to use app instead tokens, but this applies only to workflows (not local machine)? Or did I miss something?

+1 So it would be great to have some direction on this

Hi. My personal account is part of an organization. Creating a PAT on my personal account was the only work-around, as was observed by Brend and confirmed by my own setup.

Your screenshot is showing a fine-grained token for your personal account, reason why you are seeing "Account", while the original poster is asking how to define a fine-grained token for an organization (reason why on OP screenshot you can see "Organizations" instead of Account)".

So to reiterate thread/issue:

fine-grained tokens for a personal account (your handle) work,

fine-grained tokens for organizational level don't allow defining "Copilot Requests", which will make your cli requests result in: Authorization error

solution from @Brend-Smits if I understood correctly allows you to use app instead tokens, but this applies only to workflows (not local machine)? Or did I miss something?

+1 So it would be great to have some direction on this

@geraldnguyen

Hi @geraldnguyen, thanks for clarifying! I think my point may have been a bit unclear, my account is part of the organization as well, private one. So I use fine-grained personal token (me as Resource Owner), but I cannot pull private org repositories into the Copilot CLI context with that token, I can do that only for the repos that are part of my account.

@anitabee

Hi @anitabee I reviewed my setup just now and turn out I didn't use the PAT with Copilot Request access to perform work on my organization's private repo.

This is my usecase:

I had a private repo under an organization
I regularly run some workflows which create Issues and assign to Copilot
Copilot automatically picks up the assigned issue, works on it, then create PR once it complete. It assigns the PR to me to review.
I reviews, request changes or approve and merge the request.

For this use case, I just need a PAT with the organization as the Resource Owner and necessary permissions to create GitHub issues

Is your use case similar? or more complex?

Thanks for clarifying and apology if this answer and my previous cause any confusion.

I was trying to setup an automation workflow for my organization too, but I ran into a similar problem - when I request PAT with me as Resource Owner, I don't see organization repositories (org has enterprise account), and when I request PAT with organization as Resource Owner, I don't see "Copilot Requests" in permission list.

It's an absolute blocker for any automated copilot-backed action.

@geraldnguyen

@geraldnguyen I think @vforge's screenshots nicely demonstrate my issue, it comes down to a difference of token being owned by organization or user.

Use case is different than yours but I think quite simple:

I have internal repos under a GitHub Organization and want to query them via GitHub CLI on my local machine (all or few doesn't matter)
If I use PAT with user as Resource Owner → 404 (makes sense PAT has only permissions to repos under my user account)
If I use PAT with org as Resource Owner → Authorization error (also makes sense as Copilot Requests permission is required)

+1 to this. This issue is preventing us from introducing a lot of gh copilot features into our release workflows. There should be some way for me to configure this for our organization. I mean the billing should be straightforward, we already have the code review agent that is billed to the org so maybe we can introduce something similar here.

+1 to this as well. We're unable to provide a fine grained PAT to service account which is then supposed be used as a COPILOT_GITHUB_TOKEN to make a request to copilot using the CLI.

Same problem here, I need to run copilot cli in pipeline and I have no way to create a personal fine-grained token including the mentioned permissions

Hey folks! We've shipped the capability for you to use the GITHUB_TOKEN in Actions to authenticate Copilot CLI! https://github.com/proxy/docs.github.com/en/copilot/how-tos/copilot-cli/use-copilot-cli-in-actions

This includes Agentic Workflows as well!

General PAT support is still missing, but this might help some of your usecases :)

Navigation Menu

Repository navigation

"Copilot Requests" permission for fine-grained tokens should be visible for org-owned tokens #223

Describe the feature or problem you'd like to solve

Proposed solution

Example prompts or workflows

Additional context

9 remaining items

Is your use case similar? or more complex?

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

"Copilot Requests" permission for fine-grained tokens should be visible for org-owned tokens #223

Description

Describe the feature or problem you'd like to solve

Proposed solution

Example prompts or workflows

Additional context

Activity

arqex commented on Nov 26, 2025

Azuna1 commented on Feb 9, 2026

winzou commented on Feb 14, 2026

bannsec commented on Feb 16, 2026

joeynaor commented on Feb 19, 2026

vfportero commented on Feb 20, 2026

ShaharNoy17 commented on Feb 23, 2026

mslocum-fortegra commented on Feb 24, 2026

dkattan commented on Mar 5, 2026

rwguerra commented on Mar 15, 2026

Brend-Smits commented on Mar 16, 2026

Azuna1 commented on Mar 16, 2026

laeubi commented on Mar 23, 2026

9 remaining items

navidpadid commented on Apr 10, 2026

navidpadid commented on Apr 13, 2026

SuperFamousGuy commented on Apr 21, 2026

anitabee commented on May 27, 2026

geraldnguyen commented on May 28, 2026

anitabee commented on May 28, 2026

geraldnguyen commented on May 28, 2026

Is your use case similar? or more complex?

vforge commented on May 28, 2026

anitabee commented on May 28, 2026

lsickert commented on May 29, 2026

sudughonge commented on Jun 10, 2026

ltpitt commented on Jun 11, 2026

RyanHecht commented on Jul 15, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions