GitHub Licensing Explained: Team vs Enterprise, Actions and Copilot
This page answers the GitHub licensing questions buyers actually ask — what the jump from Team to Enterprise actually buys, what Actions really costs, how Advanced Security is packaged since the split, and what changed when Copilot moved to usage-based billing. Figures are GitHub list prices in USD.
The short answer: the Team-to-Enterprise jump is bought almost entirely for identity and governance — SAML, SCIM, audit log API, IP allow lists, data residency and the SLA. Core code review controls are already on Team. Two things deserve attention before you sign: GitHub’s published prices are framed as first-12-month rates and the renewal rate is not published anywhere, and Copilot’s promotional AI credit allowances ended in September 2026, so any budget built on a summer invoice understates your real run rate.
What do GitHub’s plans cost?
| Plan | Published price |
|---|---|
| Free | $0 |
| Team | $4 per user/month for the first 12 months |
| Enterprise | From $21 per user/month for the first 12 months |
Know your year-two price before you sign year one. Both published figures carry a “first 12 months” qualifier, and GitHub does not publish the post-promotional rate anywhere we could find. This is the single biggest commercial gotcha in a current GitHub agreement, and it is entirely avoidable by asking the question up front. Treat any renewal number you have not seen in a contract as unknown — contact us and we will get you the renewal rate in writing alongside a quote.
What does Enterprise actually buy over Team?
Less than most people assume on the engineering side, and more on the compliance side.
Already on Team — you do not need Enterprise for these: protected branches on private repositories, CODEOWNERS on private repositories, multiple required pull request reviewers, environments and environment secrets, and the audit log in the UI with 180 days of history.
| Capability | Free | Team | Enterprise Cloud |
|---|---|---|---|
| Protected branches (private repos) | — | Yes | Yes |
| CODEOWNERS (private repos) | — | Yes | Yes |
| Multiple required reviewers | — | Yes | Yes |
| Deployment protection rules on private repos | — | — | Yes |
| SAML SSO | — | — | Yes |
| SCIM provisioning | — | — | Yes |
| Audit log in UI (180 days) | — | Yes | Yes |
| Audit log API | — | — | Yes |
| IP allow lists | — | — | Yes |
| Enterprise Managed Users | — | — | Yes |
| Data residency, SOC reports, FedRAMP | — | — | Yes |
| 99.9% uptime SLA | — | — | Yes |
Do I need Enterprise just for SAML SSO?
Yes. SAML SSO and SCIM are Enterprise Cloud only — GitHub Team does not support them at any price. At $21 versus $4 per user per month that is roughly a five-fold increase on the base plan, bought largely for identity. For a 200-developer organisation that is about $50,400 a year against $9,600 at published first-year rates.
The one engineering-workflow feature genuinely gated at Enterprise is deployment protection rules — wait timers and required reviewers — on private repositories. On Free, Pro and Team those only work on public repos. If your release gates depend on them, that alone can force the upgrade.
What does GitHub Actions really cost?
| Plan | Minutes/month | Artifact storage | Actions cache |
|---|---|---|---|
| Free | 2,000 | 500 MB | 10 GB |
| Pro | 3,000 | 1 GB | 10 GB |
| Team | 3,000 | 2 GB | 10 GB |
| Enterprise Cloud | 50,000 | 50 GB | 10 GB |
Three mechanics drive the bill, and only one of them is the minute count:
1. Public repos and self-hosted runners are free
Actions usage is free for self-hosted runners and for public repositories on standard GitHub-hosted runners. Included minutes effectively apply to private repositories only. If your CI runs on self-hosted infrastructure, Actions is close to a zero line item.
2. The operating system multiplier is brutal
| Standard runner | Per minute | Relative to Linux |
|---|---|---|
| Linux 1-core x64 | $0.002 | 0.3× |
| Linux 2-core x64 | $0.006 | 1× |
| Linux 2-core arm64 | $0.005 | 0.8× |
| Windows 2-core x64 | $0.010 | 1.7× |
| macOS | $0.062 | ~10× |
Larger runners scale up steeply — Linux x64 runs from $0.006 to $0.252 per minute at 96 cores, Windows x64 from $0.022 to $0.552. macOS and iOS build pipelines are where Actions bills explode, and moving those to self-hosted hardware is usually the highest-return optimisation available.
3. Per-job rounding punishes short jobs
GitHub rounds each job up to the nearest whole minute. A thousand jobs of twenty seconds each bills as a thousand minutes, not 333. Matrix builds with many small jobs are far more expensive than the wall-clock time suggests.
Storage overage runs $0.25 per GB per month on shared storage and $0.07 per GB per month on cache and custom images. Budgets with a hard stop are available but opt-in — set them, with alerts at 75%, 90% and 100%.
For scale: Enterprise’s 50,000 included minutes is about $300 of Linux time, or roughly $3,100 of macOS time.
How is GitHub Advanced Security packaged now?
GHAS split into two standalone products in April 2025, and this is a meaningful improvement for buyers:
| Product | Price | Includes |
|---|---|---|
| GitHub Secret Protection | $19 per active committer/month | Secret scanning, push protection |
| GitHub Code Security | $30 per active committer/month | Code scanning, premium Dependabot, dependency review |
Two changes worth knowing. First, GHAS is no longer Enterprise-gated — GitHub Team customers can buy both products. Second, you can buy Secret Protection alone, without Code Security. Secret leak prevention is usually the higher-return half, and it is now separable.
Is Advanced Security worth it?
The honest framing: at $49 per committer per month combined, GHAS costs more than the Enterprise seat itself. For 200 active committers that is around $117,600 a year on top of roughly $50,400 of Enterprise seats.
Three things make the real number smaller than that:
- Billing is on active committers in the last 90 days, counted once organisation-wide — not headcount. The billable number is usually well below your seat count.
- Public repositories get code scanning, secret scanning and dependency review free.
- Secret risk assessment is free for organisations, so you can measure your actual leak exposure before deciding whether to buy.
Start with the free risk assessment. If it comes back clean, you have a much easier conversation about whether to buy. If it does not, you have the business case.
What changed with Copilot pricing in 2026?
Seat prices are unchanged, but the billing model changed on 1 June 2026 from premium requests to AI credits at $0.01 each, driven by which model you use and how many tokens you consume.
| Plan | Price | Included AI credits/month |
|---|---|---|
| Copilot Free | $0 | Limited; 2,000 completions/month |
| Copilot Pro | $10/month | 1,500 |
| Copilot Pro+ | $39/month | 7,000 |
| Copilot Max | $100/month | 20,000 |
| Copilot Business | $19/seat/month | 1,900 |
| Copilot Enterprise | $39/seat/month | 3,900 |
Overage is $0.01 per credit. Organisation credits pool at the billing entity level. Code completions and next edit suggestions remain unlimited on paid plans and are not billed in credits.
The September 2026 credit cliff. Elevated promotional allowances ran from June to August 2026 and expired on 1 September — Enterprise dropped from 7,000 to 3,900 credits and Business from 3,000 to 1,900. If you built a Copilot budget from a June, July or August invoice, it understates your real run rate by 35–45%. September 2026 is the first month at standard allowances, and that is the invoice to baseline from.
Copilot Enterprise requires GitHub Enterprise Cloud. Copilot Business works on Free and Team organisations too, so if you are not on Enterprise Cloud the question answers itself.
Where GitHub bills catch buyers out
Dormant users and outside collaborators cost full price
A dormant account consumes a full licence on both Cloud and Server. Outside collaborators on private or internal repositories consume a licence too, counted once regardless of how many repositories they touch. Pending invitations also consume on non-metered billing. There is no published reclaim or refund mechanism — on metered billing a removal takes until the next cycle to stop charging, and on Enterprise Server suspending a user is what stops the charge. A quarterly dormant-account review is the practical control.
Enterprise Server is included — but deduplication is by email
A GitHub Enterprise Cloud licence carries the right to use Enterprise Server, and a user consumes one licence regardless of how many Server instances or Cloud organisations they touch. The catch is that GitHub deduplicates by email address. Mismatched email addresses between your Server and Cloud environments will double-count and double-bill. Configure licence sync properly and audit it.
Enterprise Server needs annual upgrades
Feature releases ship roughly quarterly and GitHub supports at least the four most recent, giving about twelve months per release. Version 3.19 falls out of support on 9 December 2026. Treat GHES upgrades as a standing annual commitment, not a project.
What breaks if we turn on Enterprise Managed Users?
EMU is an identity decision with a real developer-experience cost, and it is worth being honest about that before you commit. Managed users cannot:
- Authenticate by any route other than your IdP — no GitHub password, no GitHub-stored 2FA
- Push code, open issues or pull requests, or comment on public repositories outside the enterprise
- Star, watch, follow or fork repositories outside the enterprise
- Create or comment on gists
- Sign up for Copilot Free or Copilot Pro — they must be granted Business or Enterprise
- Create GitHub Actions workflow templates, or use hosted runners in personal repositories
- Have a personal profile; they are visible only to other enterprise members
For organisations that contribute to open source, this is significant. Many run a second, non-EMU identity for that work. SCIM 2.0 is required, with full support for Entra ID, Okta and PingFederate.
Frequently asked questions
Is there an annual billing discount?
We could not verify one on any GitHub-controlled page. Historical annual rates circulate widely but are not confirmed for current pricing, so do not assume a discount exists. Contact us and we will confirm what is actually available at your volume and term.
Do bots and service accounts consume seats?
GitHub’s licence documentation does not address them explicitly. In practice a machine account is an ordinary user account and will consume a seat if it is an organisation member; a GitHub App is not a user. Rather than relying on inference, contact us and we will confirm how your specific setup will be counted.
What happens if we exceed our purchased licences?
On usage-based billing you simply pay for what you consume, pro rata for mid-cycle additions, with removals reflected the following month. For prepaid and volume agreements the true-up mechanics are contractual and not published — contact us and we will get the true-up terms for your agreement in writing.
Is push protection free on private repositories?
No. Public repositories get secret scanning and push protection free. On private repositories, push protection is a paid Secret Protection feature. The free secret risk assessment is a different thing — it shows you your exposure without remediating it.
Can we use Enterprise Server without connecting to the cloud?
Yes, but the licensing model differs. Metered billing requires GitHub Connect and a linked cloud enterprise account. Standalone, air-gapped Server instances use prepaid volume or subscription licences instead.
Pricing and licensing terms verified 18 September 2026 against GitHub’s published pricing, documentation and changelog. GitHub’s published plan prices are promotional first-year rates and the renewal rate is not published — confirm it with GitHub or your reseller before committing. ReleaseTEAM delivers GitHub implementations, migrations and DevOps consulting.
Ask us for your year-two price before you sign year one
We help teams model real GitHub costs — Actions consumption, GHAS committer counts, Copilot credits after the September reset, and what Enterprise genuinely buys you over Team.
Speak With An Expert