Copilot Code Review Can Now Approve Your PR: Where the Three Switches Actually Live, Which Files It May Sign Off, and What Each Review Costs

GitHub’s changelog on 2026-09-01 contains one sentence worth stopping for if your team reviews code on GitHub:

Copilot now tells you when a pull request is ready to approve, and admins can authorize it to sign off on approval.

Until now, Copilot’s reviews were always a plain “Comment”: they never counted toward required approvals and never blocked or unblocked a merge. Now it can actually approve, and once enabled that approval counts toward your repository’s required-approvals rule — it becomes a reviewer with a vote.

This is not a news recap. This is the how-to: the exact settings paths, the limits, and the cost, straight from the official docs.

The short version

1. It is off by default. An admin has to turn it on. Leave it alone and Copilot behaves exactly as before, comments only.
2. Once on, it is a real vote. An approving review from Copilot satisfies the required-approval rule “the same way a teammate’s approval would.” But the “ready to approve” assessment on its own does not count.
3. It costs money, per review, as a range. The docs quote US$0.05 to US$1 for a Lite review and US$0.25 to US$5 for a Balanced one.

1. Check your plan first

The changelog lists the eligible plans as Copilot Pro, Pro+, Max, Business and Enterprise. The free tier is not among them.

That matches our own verification record for GitHub Copilot: on the free tier, Code review is listed as unavailable (verified 2026-07-25), with the free allowance being 2,000 completions and 50 chats per month.

(Prices come from our verification record sourced from the official plans page; plan eligibility for approvals comes from the official changelog.)

2. Do this: the three layers, and where each switch is

GitHub splits this into two separate things, and most people miss one of them on the first try:

• “Automatically request a Copilot review” lives in a branch ruleset.
• “May Copilot approve, and for which files” lives in the Copilot code review settings page.

Turning on only one of them will not give you what you want.

Repository level

Automatic review: Settings > Code and automation > Rulesets > New branch ruleset → name it → set Enforcement status to Active → add target branches → under Branch rules, tick Automatically request Copilot code review. Optionally tick Review new pushes and Review draft pull requests.

Approvals and the allowlist: Settings > Code and automation > Copilot > Code review. Three things matter on that page:

• Review effort: Lite (standard) or Balanced (deeper analysis).
• File paths Copilot may auto-approve: one glob per line, and the docs state a maximum of 15 globs.
• The toggle: Allow Copilot approvals to count toward merge requirements.

Organization level

Automatic review: Organization Settings > Code, planning, and automation > Repository > Rulesets — same branch ruleset, except repositories are targeted with Include by pattern / Exclude by pattern (fnmatch syntax).

Approvals: Organization Settings > Code, planning, and automation > Copilot > Code review. At org level there are four choices for whether approvals count toward merge requirements: enabled everywhere, let each repository decide, selected repositories only, or disabled everywhere.

Enterprise level

Enterprise > AI controls > Copilot code review. Create an enterprise-level branch ruleset targeting organizations and repositories, then enable the policy. Approval authority can be left to organizations, limited to selected organizations, or disabled enterprise-wide.

A sane rollout: start on one low-risk repository with an allowlist covering only docs and config (docs/**, *.md), confirm the behaviour, then widen.

3. Four things that will bite you

1. “Ready to approve” is not an approval. Every review adds an assessment in the overview comment, but that assessment alone does not count toward merge requirements. Seeing the green line and waiting is a wasted wait.
2. New commits dismiss the approval. Per the docs, if commits land after Copilot approves, its approval is dismissed exactly as a human reviewer’s would be. Getting approved and then sneaking in one more push does not work.
3. You only get 15 globs. Past that you have to consolidate patterns; you cannot list files one per line.
4. It is a public preview. Behaviour and settings locations can still move. The GA date is not stated by GitHub, so we mark it unverified rather than guess.

4. What it costs (GitHub’s own numbers)

The docs give ranges, not a fixed price:

GitHub adds that “ranges may change as models evolve.”

In practice: a team merging 20 pull requests a day with Balanced everywhere could reach the order of US$100 a day in the worst case. Start on Lite with a narrow allowlist. For how this lands on the bill, see our Copilot model token rates and the AI Credits billing cliff.

5. What we could not verify

House rule: if we could not verify it, we say so.

• GA date for Copilot approvals — the docs only say public preview. Unverified.
• Billing currency and tax treatment by region — the official page quotes USD ranges only. Unverified.
• Quality comparison between Lite and Balanced — no accuracy figures are published, and we do not estimate our own.

Official links

• GitHub Changelog (2026-09-01): https://github.blog/changelog/2026-09-01-copilot-code-review-can-now-approve-pull-requests
• Configure automatic review (docs): https://docs.github.com/copilot/how-tos/use-copilot-agents/request-a-code-review/configure-automatic-review
• Copilot code review concepts (docs): https://docs.github.com/en/copilot/concepts/agents/code-review

Related

• GitHub Copilot tool page (plans and verification log)
• Copilot free vs paid
• Copilot global model policy