On November 3, 2026, GitHub expanded Copilot usage metrics to distinguish developer-configured bring-your-own-key usage from enterprise-configured custom models. This matters because identical model names can represent very different billing and control paths. One request may use a developer’s external provider account, another a company-managed provider integration, and another a Copilot-hosted model. Treating all three as one model line can obscure who pays, who governs credentials, and where data is processed.
Understand the two routing paths
GitHub says local BYOK requests travel directly from Copilot CLI or the Copilot app to the developer’s provider key or local model. Its metrics include the used_local_byok indicator and totals_by_local_byok with request, session, prompt, and token counts. Enterprise custom models are configured by administrators, and requests travel through GitHub to the enterprise’s provider. GitHub identifies these with is_custom_enterprise_model in totals_by_client[].totals_by_model[]. These are observability distinctions, not proof that the two routes have identical security properties.
1. Build a three-ledger reconciliation
Maintain separate ledgers for Copilot-hosted consumption, enterprise custom-model provider bills, and local BYOK or locally hosted inference. The first can be reconciled to Copilot billing; the second to the enterprise’s provider account; the third may involve personal keys, workstation compute, or departmental provider charges. Do not add all request counts to a single monetary figure without pricing and attribution evidence. Report unknown cost explicitly instead of silently treating locally hosted requests as free.
2. Do not double-count the new fields
GitHub states that existing usage totals have not changed: local BYOK is already included in Copilot CLI and app totals, and enterprise custom-model activity already appears in client totals. The new fields classify existing usage rather than adding previously absent requests. Therefore a dashboard that adds local BYOK totals on top of overall Copilot totals inflates activity. Use a partition or filter, not a second sum. Document the source fields and aggregation logic so finance can reproduce the reconciliation.
3. Make missing telemetry visible
GitHub cautions that local BYOK measurements depend on client telemetry and can undercount when telemetry is disabled. Some local providers also omit token counts. An apparent drop in local usage could reflect disabled reporting, not reduced activity. For every report, show telemetry coverage and the share of activity with missing token information. The Copilot telemetry gap assessment describes a related reporting limitation. Enterprise custom-model usage is observed server-side, according to GitHub, but that does not eliminate the need to reconcile with the provider’s invoice.
4. Preserve the historical measurement boundary
The is_custom_enterprise_model field is not backfilled for days before the release. Historical absence must not be interpreted as zero enterprise custom-model usage. Use November 3 as a schema-change boundary, preserve original snapshots, and show ‘not available’ for unsupported historical breakdowns. For trend reporting, compare total usage on a stable definition or restrict the detailed model-route comparison to dates when the fields existed. The adoption dashboard comparability guide explains the broader principle.
5. Connect routing classification to security policy
Developer-managed keys may create different credential custody, logging, data-handling, and offboarding questions from centrally configured models. Inventory approved endpoints, key ownership, retention terms, egress destinations, and permitted project data for each route. Do not infer compliance from the presence of a usage metric. Security teams should verify enforcement in the actual client and network path. The agent authorization analysis illustrates why identity and authorization need distinct checks.
6. Define a useful audit sample
Select a small set of known developers and run controlled tasks through Copilot-hosted, local BYOK, and enterprise custom-model paths. Record timestamp, client, model configuration, expected routing, provider invoice entry where available, and Copilot metric classification. Compare request counts and note any discrepancies without inventing missing token data. Repeat with telemetry intentionally disabled in a permitted test setup to establish what the dashboard cannot see. The result is a defensible measurement boundary, not a promise of perfect attribution.
Decision rule for FinOps leaders
Adopt the new fields as a routing and governance aid, not a replacement for provider invoices or endpoint controls. A credible enterprise cost report separates where requests went, who funded them, and how complete the telemetry is. That separation is more valuable than a single attractive but misleading cost-per-developer number.
Primary-source evidence
Source: GitHub Changelog, November 3, 2026. Product terms and API fields should be rechecked against current official documentation before operational decisions.
Leave A Comment