Choose the control that matches your goal: stopping Copilot in your local workspace, excluding selected content in supported Copilot features, or enforcing an organization-wide restriction. These are not interchangeable.
Do not rely on a .copilotignore file as a portable GitHub Copilot privacy barrier. GitHub’s current exclusion instructions use administrator-managed content-exclusion settings, and those settings do not cover every Copilot surface.
1. Decide what must be disabled
If you only find inline suggestions distracting, a completion preference may be sufficient. If policy forbids AI use on the repository, hiding ghost text is not enough: chat, agents, CLI tools and other extensions need separate consideration.
Write down the intended scope before changing anything: which repository, which editor or agent, which users and whether the requirement concerns suggestions or any processing of code. Do not use a real secret as a test prompt.
2. Disable built-in AI for a VS Code workspace
For VS Code, the current setup guide documents chat.disableAIFeatures at workspace scope. It disables built-in AI features and the Copilot extensions.
- Open the repository in its intended workspace.
- Run Preferences: Open Workspace Settings (JSON).
- Merge the following property into the existing JSON object without replacing other settings:
{
"chat.disableAIFeatures": true
}
Check the Workspace scope and any request to reload. In a multi-root workspace, verify which workspace settings you edited rather than assuming every folder has an independent policy. Opening the same repository through another workspace or client requires another check.
This is a local preference, not a universal server-side ban. It does not establish that another AI extension, standalone agent or browser service cannot receive files. Coordinate stricter requirements with your administrator.
3. Use supported administrator content exclusions where appropriate
For eligible Copilot Business or Enterprise organizations, an authorized repository administrator can use Repository Settings → Copilot → Content exclusion. Enter the intended path patterns and preserve inherited rules. Use GitHub’s current exclusion syntax and test procedure, not an invented repository-root ignore file.
For example, a repository path rule can target a directory:
- "/private-config/**"
That example excludes a path only within the feature’s documented scope; it is not a recommendation to keep credentials in source control. Have the administrator review the exact paths and account coverage. Do not give a developer administrator rights simply to troubleshoot missing settings.
GitHub’s limitations matter: Edit and Agent modes do not support these exclusions, and the setup guide also identifies the CLI as unsupported. Symlinks, remote filesystems and indirectly supplied semantic information have additional caveats. Do not route protected content through an unsupported mode while assuming the exclusion still applies.
4. Do not assume other editors use VS Code’s scope
In JetBrains IDEs, the official configuration guide describes disabling completions globally or for the current language from the Copilot status menu. That is not evidence of a project-only switch that disables every Copilot feature.
Check the actual scope offered by your installed IDE and plugin. For a project where AI is prohibited, use an administrator-approved environment with the prohibited functionality disabled. Do not promise that a similarly named checkbox in every IDE has identical behavior.
Keep local preferences and team policy distinct. A setting committed to a repository can help communicate the intended configuration, but users may open the files through other software.
5. Verify without exposing sensitive content
For workspace disablement, reopen the intended workspace and inspect the effective setting and available Copilot features. For content exclusion, use harmless test files that match the patterns and follow GitHub’s supported-feature verification procedure. Existing clients may need a reload before new rules are applied.
Check both what is disabled and what intentionally remains available. No suggestion at one cursor position is not proof that all AI access is blocked. Record the client, account, workspace and feature tested so the result is meaningful.
If unexpected AI functionality remains, stop testing with private code. Check for another extension or a different workspace, then ask the administrator to reconcile the actual controls with the policy. Do not remove security protections or broaden permissions to make an exclusion test pass.
Official documentation checked October 14, 2026. Local settings and content exclusions are not a universal no-transmission guarantee.