Microsoft Mission Critical Blog

6 MIN READ

AI Just Joined Your Code Reviews: GitHub Copilot Comes to Azure Repos

Shdsouza

Microsoft

Sep 03, 2026

A practical guide to enabling, configuring, and getting real value from Copilot code review, where humans still own the call.

Overview

Every engineering team runs into the same wall: the code is written, the tests are green, and then the pull request sits, waiting for a human to find time. Review is where good work can queue. GitHub Copilot code review for Azure Repos is currently in limited preview. It can take a first pass at a pull request and return feedback after a few moments, depending on the repository and the size of the change.

Here is how it works, how to switch it on, what it is genuinely good at, and where you should keep a human firmly in the loop.

GitHub Copilot acts as an automated reviewer on Azure Repos pull requests. When requested, it posts inline comments and one-click suggested edits before a human reviewer signs off.

Best fit: Early feedback on correctness, security, maintainability, and testability.
Human review retained: Domain, architecture, compliance, and required code-owner approvals.
Workflow: Treat findings like any pull request comment, validate, then fix, discuss, or resolve.

Review jobs run on an Azure Pipelines agent, so nothing is installed on developer machines.

The one thing to remember Copilot only comments. It never approves a pull request and never requests changes, so it cannot satisfy a required reviewer or block a merge on its own. Humans stay in control of the merge button, by design.

Prerequisites

Check these prerequisites before you begin.

Requirement	Detail
Platform & repo	Azure DevOps Services with an Azure Repos Git repository. TFVC is not supported.
Permissions	Project Collection Administrator (org), Project Administrator (project), and repository owner/administrator (repo).
Billing	An Azure subscription linked to your organization. Usage is metered through Azure Cost Management. For details, see Billing.
Compute	A supported Microsoft-hosted Azure Pipelines agent pool, or a Managed DevOps Pool using the latest Ubuntu Server image. Windows images and self-hosted agent pools are not supported.

Enable Copilot code review

Access is layered across three scopes; enable the organization first. Use Enable all at the org or project level to cover everything at once.

Organization: Organization settings > Repos > Repositories > Allow repositories in this organization to use Copilot code review = On.
Project (optional): Project settings > Repos > Repositories, enable or restrict per project.
Repository: select the repo > Settings tab > Enable Copilot code review for pull requests in this repository = On.

To verify, open any pull request - GitHub Copilot should appear in the Reviewers list.

Configure reviews

Default review effort

Effort	When to use	Relative cost
Lite	Routine changes, small fixes, docs, low-risk updates.	Fewer tokens
Balanced	Complex, cross-cutting, or security-sensitive changes.	More tokens

Naming note: you may see Lite/Balanced or Low/Medium/High(not yet released); higher effort costs more.

Automatic reviews & instructions

Automatic review: configure a policy at project or repository level to review new pull requests on creation.
Custom instructions: tailor feedback via .github/copilot-instructions.md or .azuredevops/copilot-instructions.md on the PR's target branch, or org/project settings. Using custom instructions to unlock the power of Copilot code review - GitHub Docs

Request and use a review

Next to GitHub Copilot in Reviewers, select Request (or pick an effort from the menu).
Wait for Review completed, then validate each comment before acting.

Comment-only: Copilot never approves or requests changes, so it doesn't satisfy required reviewers or block merges.
Interactive: reply, resolve, or hide comments. Copilot doesn't read replies or follow up.
Re-review / cancel: it doesn't re-review after new commits, select Request again; an in-progress review can be cancelled. To automatically request re-reviews on every push, enable automatic code review. For more information, see Configuring code review by GitHub Copilot.

Scope and limits

Copilot reviews many languages but skips dependency, log, SVG, and vendor/generated files (package-lock.json, yarn.lock, etc.); admins can exclude more paths. Results depend on the difference, so runtime, architecture, and business rules may be missed; always validate.

Requirement / limit	Value
Pull request status	Active, no merge conflicts
Repository size / changed files	≤ 10 GB / ≤ 100 files
Concurrent reviews (org / user / PR)	5 / 2 / 1

Billing

Reviews are token-based (1 GitHub AI credit = US$0.01), charged to the linked Azure subscription as a separate meter in Azure Cost Management, not from Copilot plan credits. Effort, PR size, and instructions drive cost; charges can take 48 hours to appear.

Monitor: Cost Management > Cost analysis, filter by product; project tags enable per-project reporting.
Budget alerts: filter to product “GitHub Copilot for AzDO”. Alerts notify only; they don't stop reviews. Pilot on a repo or two to estimate cost before scaling.

Github Copilot billing

Recommended practices

Keep pull requests small; retain branch policies and required human reviewers.
Fix valid findings; reply to explain false positives. Keep secrets out of source control.
Encode recurring standards in custom instructions, tests, and linters; choose effort deliberately.

Troubleshooting

Symptom	Check
Copilot not offered as reviewer	Enablement, permissions, linked subscription/billing, repo type, Preview-features opt-in.
Review stalls or fails	Service health and agent pool; failed runs post a log link. Request again.
A file wasn't reviewed	Excluded type, content-exclusion path, or evaluated as low-risk.

Visual walkthrough

Step-by-step: turn it on

Enablement is layered across organization, project, and repository settings. Enable the organization first, then decide whether to enable all projects and repositories or configure them selectively.

Step 1 - Enable at the organization

Go to Organization settings > Repos > Repositories, and under GitHub Copilot code review turn on Allow repositories in this organization to use Copilot code review. Select the Compute pool that will run the review jobs and, if needed, add organization-wide custom instructions.

Organization settings: the master toggle, Compute pool, and organization-wide review instructions.

Step 2 - Enable the repository and set the default effort

In Project settings > Repos > Repositories, pick the repository, open the Settings tab, and turn on Enable Copilot code review for pull requests in this repository. Choose a default effort level - more on that below.

Repository settings: Copilot enabled for pull requests, with its default review effort.

Step 3 - Request a review on a pull request

Open any pull request. GitHub Copilot now appears in the Reviewers panel. Select Request, or choose a specific effort from the menu. After the review finishes, the status changes to Review completed. Prefer it hands-off? Configure the policy that requests a Copilot review whenever a new pull request is created.

Copilot listed among the reviewers, with its completed review posted to the timeline.

Step 4 - Review and resolve the findings

Copilot posts each finding inline on the line it applies to and, where possible, includes a one-click suggested change. Validate each finding, then apply the suggestion, reply, react, or resolve the thread. Copilot does not read replies or follow up, and it does not automatically re-review after new commits, select Request again for a fresh review.

Inline findings on the changed code - each ready to validate, address, discuss, or resolve.

Choosing a review effort

The effort level controls the depth of the review and the amount of token usage.

Lite - the default option for fast, targeted feedback on common issues such as bugs, security vulnerabilities, and style inconsistencies.
Balanced - routes the pull request to a higher-reasoning model for longer analysis of complex logic, security-sensitive code, and subtle interactions. It generally consumes more tokens.

The documented options are Lite and Balanced. Higher effort generally analyzes more context and consumes more tokens; pull request size and custom instructions can also affect usage.

The honest scorecard

✓ Strengths	⚠ Watch-outs
Fast first-pass feedback after a few moments, depending on the repository and the number of changes.	Comment-only; it never blocks a merge, so you still need required human reviewers.
Catches common issues such as bugs, security vulnerabilities, and style inconsistencies.	It is not guaranteed to spot every problem and can make mistakes; always validate its feedback with human review.
Inline comments and, where possible, one-click suggested changes for code in any language.	Excludes dependency, log, SVG, vendor, generated, and other documented file patterns.
Works on demand or automatically on Pull requests.	Consumes tokens; an ongoing cost that scales with effort and PR size.
Tunable with organization, project, and repository-level custom instructions.	Preview: no SLA, may change, and data residency may not match your Azure DevOps boundaries.

The bottom line

Copilot code review is not here to replace your reviewers - and the product behavior makes that clear. It can take the first, more mechanical pass at a pull request so issues surface earlier and people can focus on context, design, and business impact. In a busy repository, that can reduce review friction without giving up human control.