Proxy Servers for GitHub Copilot

No — Microsoft attached the Copilot name to several unrelated products, and the network story differs for each. This page is about GitHub Copilot, the coding assistant in your IDE and terminal, which runs under your personal or organization GitHub account and happily follows the proxy settings described above. Microsoft 365 Copilot lives inside Word, Excel, and Teams under a corporate tenant: its connectivity is managed by your Microsoft 365 administrator against Microsoft's published endpoint lists, and a personal proxy has no useful role there. Windows Copilot is a third thing again — an OS feature following system network settings.

Quick test: if your Copilot autocompletes code, you're in the right place.

Honestly: it depends on the firewall, and we'd rather say so upfront. Our proxy is an external dedicated address — for Copilot to use it, your machine must be able to open outbound CONNECT tunnels to it, and locked-down corporate networks often permit that only to approved hosts. If the network forces all traffic through its own gateway, your traffic to us goes through it too, and its policies still apply. That's physics, not something any proxy vendor can wave away.

In practice there are two clean setups: networks that allow outbound proxy connections (most mid-size companies) — just configure the address and go; and BYOD or remote-work machines outside the inspection perimeter, where the dedicated address works unconditionally. If you're on a hard-locked network, the conversation you need is with IT about allowlisting one host — a smaller ask than exempting all of GitHub.

First understand what it's telling you: something between VS Code and GitHub replaced the TLS certificate. That's the signature of corporate SSL inspection — the gateway breaks open HTTPS, re-signs it with the company's private CA, and Copilot's Node.js runtime, which doesn't automatically trust desktop certificate stores, refuses the forgery. The clean fixes are making the runtime trust that CA (the win-ca extension in append mode on Windows, or NODE_EXTRA_CA_CERTS pointing at the corporate root) — not setting http.proxyStrictSSL: false, which switches off certificate checking for everything.

If the error appeared while using a third-party proxy service, draw the opposite conclusion: that service is intercepting your TLS, and your GitHub tokens transit it in cleartext. A Copilot proxy done right is a blind tunnel — GitHub's certificate arrives untouched, and this error never fires. That's worth verifying before you trust any proxy with a developer account.

Both follow the same convention as every well-behaved terminal tool: set HTTPS_PROXY=http://login:password@IP:port in the environment, and the Copilot CLI, gh, and API clients route through it — in a CI runner that's one line in the job's env block. If your pipeline talks to a Copilot API proxy endpoint at volume, give the runner its own datacenter IP rather than borrowing your personal address: separate identity per environment, and a $3.50 dedicated IP is cheaper than untangling why your laptop's address suddenly looks like a build farm.

One scoping note: the environment variable is process-level, so it applies to everything the job runs. If only Copilot should use the proxy, set the variable in the specific step that calls it rather than globally.