Identify employees using the free version of GitHub Copilot for Visual Studio Code (VSC) within your company environment

You should carefully consider whether you allow your employees to use free GitHub Copilot. This way they can potentially leak some sensitive company data and nobody wants that 🙂

---

Below is a short PowerShell script to identify the usage of the free GitHub Copilot addon version in Visual Studio Code (VSC) IDE across your Windows clients.

You can run it via PowerShell remoting or like in my case via Intune on-demand remediation.

Install-Module IntuneStuff

# code will check VSC log files for usage of free_limited_copilot copilot sku
$code = { 
    Get-ChildItem -Path "C:\Users\*" | ? Name -NE "Public" | % {
        Get-ChildItem -Path ($_.FullName + "\AppData\Roaming\Code\logs\*") -Recurse -Include "GitHub Copilot Chat.log" -ErrorAction SilentlyContinue | % {
            $matchedContext = Select-String -Path $_.FullName -Pattern "sku: free_limited_copilot" -Context 1

            if ($matchedContext) {
                $userLine = @($matchedContext)[0] -split "`n" | ? { $_ -match "Got Copilot token for" }
                $user = ([regex]"Got Copilot token for (.+)$").Matches($userLine).captures.groups[1].value

                if ($user) {
                    "On $env:COMPUTERNAME in '$($_.FullName)' user '$($user.trim())' is using free copilot"
                } else {
                    "On $env:COMPUTERNAME in '$($_.FullName)' this info was found:`n$matchedContext"
                }
            }
        }
    } 
}

# invoke given code against all Windows Intune-managed devices
Invoke-IntuneCommand -scriptBlock $code -waitTime 20