Enterprise · Billing
Linking a GitHub enterprise to an Azure subscription looks like a five minute settings change. It is, right up until the consent screen refuses you and you find out it was never a GitHub permissions problem. Here is the exact click path, the screens you will actually see, the limits, and what to configure the day after you link.
Linking connects an Azure Subscription ID to your GitHub organization or enterprise account. After the link, usage-based charges for connected GitHub products are billed through Azure instead of directly through GitHub.
This applies to products such as GitHub Copilot, GitHub Actions, and GitHub Codespaces. Organizations do this to consolidate invoices and manage GitHub spending inside the Azure billing processes they already run.
The connection is available for GitHub organization and enterprise accounts. It is not available for personal accounts.
If you receive GitHub Enterprise Cloud through a Microsoft Enterprise Agreement, the Azure connection is not optional. It is the only way to use GitHub Advanced Security, GitHub Codespaces, or GitHub Copilot at all, and the only way to use GitHub Actions, Git LFS, or GitHub Packages beyond the amounts included with your plan.
Linking does not move every GitHub charge to Azure. Your GitHub plan can stay on its normal GitHub billing date. If you currently pay for GitHub Enterprise licenses through a volume, subscription, or prepaid agreement, that billing continues until the agreement expires or you are invited to transition. At renewal, you can switch to metered billing.
Two permission sets are involved, and they rarely sit with the same person. On the GitHub side, you must be an owner of the organization or enterprise account.
On the Azure side, you need the Azure Subscription ID you want to connect, Owner permission on that subscription, and an Azure account that can give tenant-wide admin consent. If you do not have that, you need a Microsoft Entra Global Administrator who can configure an admin consent workflow for you.
The consent matters because GitHub installs a Subscription Permission Validation app, usually called the SPV app, into your Azure tenant. GitHub uses that app to read the list of subscriptions available in your directory. Installing it requires tenant-wide admin consent. If your tenant has user consent settings configured, users covered by those settings might not need separate admin consent.
Access to the GitHub account is not enough. You need Owner permission on the Azure subscription itself, or it will not appear in the subscription picker. If your default Azure tenant does not hold the subscription or does not give you those permissions, you may need to specify a different tenant ID.
The flow starts on GitHub and hands off to a Microsoft sign-in partway through.
Screen 1 — where the button lives, at the bottom of Payment information.
Screen 2 — the fork in the road. Left is the prompt you need. Right is the one that stops most first attempts.
Screen 3 — the subscription picker and the billing confirmation checkbox.
From the link date onward, usage-based costs are billed through Azure. Charges from before that date stay with GitHub and appear on your next GitHub bill.
A worked example. You link the subscription on June 16 and you have GitHub Copilot Business. Copilot costs and metered usage over included amounts from June 16 onward go to Azure, charged on July 1 and on the first of each month after that. Charges from before June 16 are billed separately by GitHub on your usual GitHub billing date.
The screen you want is Permissions requested. Review it and click Accept.
If you do not see that screen, you will most likely see this instead:
Need admin approval. GitHub Inc needs permission to access resources in your organization that only an admin can grant. Please ask an admin to grant permission to this app before you can use it.
That means the SPV app does not have the tenant consent it needs. The fix is to sign in with an account that can provide tenant-wide admin consent, or to have an Azure administrator configure the admin consent workflow.
Do not treat the admin approval message as a GitHub permissions problem. Nothing on the GitHub side will fix it. It is an Azure tenant consent problem, and it needs an Azure administrator.
Separately, you might see a banner saying your Azure ID is missing. That means the Azure payment method information is missing. Update the Azure subscription connection promptly, because it can lead to service interruptions for the organization or enterprise.
Azure billing runs on calendar months, from the first day through the last day. GitHub sends usage data to Azure daily. Charges appear on the Azure invoice at the start of the next month.
That gives you two billing dates. Azure bills usage-based costs from the connection date onward on the first of each month. GitHub keeps billing everything else, such as your GitHub plan itself, on your usual GitHub billing date.
Prepaid usage is not currently available for usage-based billing through Azure.
Each product is metered differently:
| Product | Usage metric |
|---|---|
| GitHub Copilot | Number of active seats |
| GitHub Actions | Minutes used |
| GitHub Codespaces | Compute hours used |
Your organization's standard Azure payment methods apply, and GitHub does not bill the connected products separately.
GitHub usage is summarized by product family, separated by SKU and by either enterprise ID or cost center ID, in the format enterprise:sku or costcenter:sku. Example product family lines are GH ENTERPRISE and GH ADVANCED SECURITY, with totals excluding tax.
Azure currently shows internal IDs on these lines. Working out which enterprise or cost center a line belongs to is not straightforward.
GitHub products on the Azure invoice are MACC-eligible, so they count toward your Microsoft Azure Consumption Commitment.
There is no limit on how many enterprises or cost centers you connect to a single Azure subscription. Going the other way is more constrained. To use multiple Azure subscriptions for one enterprise, you must create cost centers and connect each cost center to a different subscription. An enterprise can create up to 1,000 cost centers.
A cost center can hold organizations, repositories, users, and enterprise teams. A resource belongs to only one cost center at a time, so adding it to another moves it, and you are notified when that happens.
If a cost center has no Azure subscription of its own, its usage bills to the enterprise account's Azure subscription. The same happens if the cost center becomes invalid or is deleted: future usage from those resources bills to the enterprise subscription.
Cost centers apply only to metered usage. They do not work with volume or subscription billing. Allocation follows the shape of the product: Actions usage charges the cost center holding the repository or organization where the run happened, while Copilot charges the cost center holding the user.
If you are in a GitHub Enterprise Cloud trial without Enterprise Managed Users, connecting an Azure subscription ends the trial immediately and starts paid usage. During an Enterprise Managed User trial you can use metered products up to the included limits, and you only need to link Azure to go beyond them. Check which kind of trial you are in before you click Connect.
Linking sets up billing. It does not set up any control over what gets billed.
A budget does not block spending by default. If you skip the stop-usage checkbox you have built a notification, not a control.
Screen 4 — the budget form. One checkbox separates a control from a notification.
The detailed usage report adds username and workflow_path, and it is available only through the web interface. The REST /usage endpoint returns summarized data only, so if you were planning to automate attribution straight from the API, check that the fields you need are actually there first.
Fields worth knowing: date, product, sku, quantity, unit_type, applied_cost_per_quantity, gross_amount, discount_amount, net_amount, organization, repository, username, workflow_path and cost_center_name. The net_amount is gross minus discount, and that is what you are billed. Use cost_center_name when you need to prove which cost center a given resource's usage landed in.
Open Payment information and find the connected subscription ID. Use the pencil icon to the right of it to edit the subscription, or the trash icon to remove the connection.
After you disconnect Azure, your usage can no longer exceed the amounts included with your plan. Disconnecting is a hard stop on metered consumption, not just a billing change.
The screens above are redrawn from the documented labels, not captured from a live account.