@@ -107,6 +107,8 @@ You can use the view to answer questions such as:
 
 For information about {% data variables.product.prodname_copilot_short %} allowances and how {% data variables.product.prodname_ai_credits_short %} are pooled across your enterprise, see [AUTOTITLE](/copilot/concepts/billing-and-usage/organizations-and-enterprises/billing).
 
+App attribution is not available in the **AI usage** view. To identify usage from a {% data variables.product.prodname_github_app %} installed on an organization, download an AI usage report. Use the “List app installations for an organization” REST API endpoint and match `app_client_id` in the report to `client_id` in the response. The response’s `app_slug` identifies the app, and `id` identifies the installation. See [AUTOTITLE](/rest/orgs/orgs#list-app-installations-for-an-organization). For report field definitions, see [AUTOTITLE](/billing/reference/billing-reports#usage-report-fields).
+
 For information about {% data variables.product.prodname_AS %} AI-credit billing, see [AUTOTITLE](/billing/concepts/product-billing/github-advanced-security#how-ai-feature-usage-is-billed).
 
 {% endif %}
 
@@ -68,6 +68,9 @@ The usage reports contain the following fields.
 | `net_amount`             | The billable amount of usage after applying the `discount_amount`. This is the amount that your account will be billed. `gross_amount - discount_amount = net_amount` |
 | `username`               | The user associated with the usage, if applicable. <br><br> Not included in the `Summarized usage report`. |
 | `organization`           | The organization associated with the usage, if applicable. |
+| {% ifversion copilot %} |
+| `app_client_id` | The client ID of the {% data variables.product.prodname_github_app %} associated with usage billed directly to an organization. Use this field with `organization` to identify an app installation. The field is empty for usage attributed to a user, {% data variables.product.prodname_actions %}, other {% data variables.product.company_short %}-owned apps, and usage from before app attribution was available. <br><br>Only available in the `AI usage report` |
+| {% endif %} |
 | `repository`             | The repository associated with the usage, if applicable. |
 | `workflow_path`          | The path of the {% data variables.product.prodname_actions %} workflow that generated the usage, if applicable. <br><br>Only available in the `Detailed usage report` |
 | `cost_center_name`       | The cost center associated with the usage, if applicable. |
 
@@ -29,6 +29,14 @@ The cost of an interaction depends on two things: the model and the number of to
 
 Code completions and {% data variables.copilot.next_edit_suggestions %} are **not** billed in {% data variables.product.prodname_ai_credits_short %}. They remain unlimited for all paid plans.
 
+## How is {% data variables.product.prodname_github_app %} usage billed?
+
+A {% data variables.product.prodname_github_app %} installed on an organization can use an installation access token to make {% data variables.product.prodname_copilot_short %} requests without a user signing in. The organization that owns the installation pays for the usage, and the organization’s model policies and spending controls apply.
+
+You cannot create a budget for an individual app or installation. This authentication method does not require the **Allow use of Copilot CLI billed to the organization** policy, which applies to a different authentication path.
+
+For information about approving access, identifying app usage, and blocking an app, see [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-organization/manage-app-copilot-access).
+
 ## How do {% data variables.product.prodname_ai_credits_short %} work?
 
 Each assigned {% data variables.product.prodname_copilot_short %} license comes with a monthly amount of **included {% data variables.product.prodname_ai_credits_short %}**:
 
@@ -95,6 +95,8 @@ An organization budget caps metered charges for users who receive their {% data
 
 Organization budgets are the only budget option available to organization owners. They can only further restrict usage below any budget set by an enterprise admin, and they cannot override a higher-level budget.
 
+Usage billed directly to an organization from a {% data variables.product.prodname_github_app %} installation counts against the organization budget. You cannot create a budget for an individual app or installation. If **Stop usage when budget limit is reached** is not enabled, the budget only sends alerts and app spending continues after the limit is reached. For information about managing app access, see [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-organization/manage-app-copilot-access).
+
 If a user receives {% data variables.product.prodname_copilot_short %} licenses from multiple organizations, {% data variables.product.github %} picks one organization at random each billing cycle to bill the seat. This means the user's spend could count against a different organization's budget from month to month, making enforcement unpredictable. To avoid this, ensure each user has a single license through one organization, or use cost center budgets with direct user assignment.
 
 ### Enterprise budget
 
@@ -14,6 +14,7 @@ children:
   - /manage-plan
   - /manage-access
   - /manage-policies
+  - /manage-app-copilot-access
   - /add-copilot-cloud-agent
   - /configure-runner-for-coding-agent
   - /prepare-for-custom-agents
@@ -22,4 +23,3 @@ children:
   - /enable-custom-models
 contentType: how-tos
 ---
-
@@ -0,0 +1,63 @@
+---
+title: Manage GitHub Apps that use your organization's Copilot
+shortTitle: Manage GitHub App access
+allowTitleToDifferFromFilename: true
+intro: "Control which {% data variables.product.prodname_github_apps %} can use your organization's {% data variables.product.prodname_copilot_short %} and attribute their spending."
+versions:
+  fpt: '*'
+  ghec: '*'
+permissions: Organization owners
+product: '{% data variables.copilot.copilot_enterprise_short %} or {% data variables.copilot.copilot_business_short %}'
+contentType: how-tos
+category:
+  - Manage Copilot for a team
+---
+
+> [!NOTE]
+> {% data reusables.copilot.org-app-s2s-preview %}
+
+A {% data variables.product.prodname_github_app %} installed on an organization can use its own installation access token to make {% data variables.product.prodname_copilot_short %} requests without a user signing in. The organization that owns the installation pays for the usage.
+
+## Understand access and billing
+
+The app must have the organization **{% data variables.product.prodname_copilot_short %} Requests** permission set to **Read-only**. In this context, **Read-only** does not mean that the app cannot incur costs. The permission authorizes the app to make requests that consume your organization’s {% data variables.product.prodname_ai_credits_short %}.
+
+This authentication method has the following boundaries:
+
+* It applies to apps installed on an organization. Personal account and enterprise installations cannot use this authentication method.
+* The app can use only models allowed by your organization’s {% data variables.product.prodname_copilot_short %} policies.
+* Your organization’s {% data variables.product.prodname_copilot_short %} billing and spending controls apply. You cannot create a budget for an individual app or installation.
+* You do not need to enable the **Allow use of {% data variables.copilot.copilot_cli_short %} billed to the organization** policy. That policy applies to a different authentication path.
+
+This method differs from user authorization, where requests use a user’s identity and are attributed according to that user’s {% data variables.product.prodname_copilot_short %} access. It also differs from {% data variables.product.prodname_actions %}, where workflows use the built-in `GITHUB_TOKEN` and {% data variables.product.prodname_actions %}-specific policies and budgets.
+
+## Review an app before approving access
+
+Only approve apps that you trust to spend your organization’s {% data variables.product.prodname_copilot_short %} usage.
+
+1. Confirm the app’s owner, purpose, and expected usage with the team requesting access.
+1. Review all requested organization and repository permissions. Confirm that **{% data variables.product.prodname_copilot_short %} Requests** is an organization permission set to **Read-only**.
+1. Review your organization’s model policies and spending controls. If a budget must stop additional usage, make sure **Stop usage when budget limit is reached** is enabled.
+1. Install the app or approve its updated permissions.
+
+For instructions on installing an app, see [AUTOTITLE](/apps/using-github-apps/installing-a-github-app-from-a-third-party). If an installed app adds the permission, see [AUTOTITLE](/apps/using-github-apps/approving-updated-permissions-for-a-github-app).
+
+## Identify app usage
+
+App attribution is available in CSV exports, not in the **AI usage** view on {% data variables.product.github %}.
+
+1. Download an AI usage report. See [AUTOTITLE](/billing/how-tos/products/view-productlicense-use#downloading-usage-reports).
+1. Find rows with your organization in the `organization` column and a value in `app_client_id`.
+1. Use the “List app installations for an organization” REST API endpoint and match `app_client_id` from the report to `client_id` in the response. The `app_slug` value identifies the app. See [AUTOTITLE](/rest/orgs/orgs#list-app-installations-for-an-organization).
+
+The `app_client_id` field is empty for usage attributed to a user, {% data variables.product.prodname_actions %}, other {% data variables.product.company_short %}-owned apps, and historical usage from before app attribution was available. For full field definitions, see [AUTOTITLE](/billing/reference/billing-reports#usage-report-fields).
+
+## Control app spending
+
+Usage from an organization-installed app counts against the organization’s {% data variables.product.prodname_copilot_short %} budget. A budget that only sends alerts does not stop spending. To block requests after the limit is reached, enable **Stop usage when budget limit is reached**.
+
+You cannot create a budget for one app or installation. For more information about organization-level controls, see [AUTOTITLE](/copilot/concepts/billing-and-usage/organizations-and-enterprises/budgets).
+
+## Block an app's access
+
+To stop requests from one app installation, suspend or uninstall it for your organization. This also blocks the installation's access to other organization resources. See [AUTOTITLE](/apps/using-github-apps/reviewing-and-modifying-installed-github-apps#blocking-access).
@@ -462,7 +462,7 @@ For multi-user server mode, pass a per-session `gitHubToken` so each session run
 
 ## Disabling auto-login
 
-To prevent the SDK from automatically using stored credentials or `gh` CLI auth, configure it to disable logged-in-user fallback:
+To prevent the SDK from automatically using stored credentials or `gh` CLI auth, configure it to disable logged-in-user fallback. This also ignores environment variable tokens such as `COPILOT_GITHUB_TOKEN`, so you must pass a token through the SDK's explicit token option. The examples below show only the fallback setting:
 
 {% codetabs %}
 {% codetab dotnet %}
 
@@ -39,25 +39,24 @@ The organization's **Allow use of Copilot CLI billed to the organization** polic
 
 For services outside GitHub Actions:
 
-1. Create a GitHub App with the **Copilot Requests** repository permission set to **Read & write**.
-1. Install it on the organization that should be billed. The current Copilot permission check requires **All repositories** access.
-1. [AUTOTITLE](/apps/creating-github-apps/authenticating-with-a-github-app/generating-an-installation-access-token-for-a-github-app) with a repository ID and the Copilot permission:
+1. Create a GitHub App with the **Copilot Requests** organization permission set to **Read-only**.
+1. Install it on the organization that usage should be attributed and billed to.
+1. [AUTOTITLE](/apps/creating-github-apps/authenticating-with-a-github-app/generating-an-installation-access-token-for-a-github-app) with the Copilot permission:
 
    ```json
    {
-     "repository_ids": [123456789],
      "permissions": {
-       "copilot_requests": "write"
+       "organization_copilot_requests": "read"
      }
    }
    ```
 
-1. Pass the resulting `ghs_` token to the runtime as `COPILOT_GITHUB_TOKEN`.
+1. Pass the resulting `ghs_` token to the SDK's `gitHubToken`, `github_token`, or equivalent option. For an existing runtime URI, set it as `COPILOT_GITHUB_TOKEN` on the runtime process instead.
 
 The organization must be enabled for Copilot requests from GitHub App installations. Installation tokens expire after one hour.
 
-> [!WARNING]
-> Do not pass an installation token through the SDK's `gitHubToken`, `github_token`, or equivalent option. That option is for user tokens. Installation tokens must use the runtime environment authentication path.
+> [!NOTE]
+> No signed-in user is required. `useLoggedInUser: false` turns off automatic credential discovery, including environment variable tokens such as `COPILOT_GITHUB_TOKEN`, so pass the installation token through the SDK's explicit token option.
 
 ## Configure the runtime
 
@@ -74,10 +73,7 @@ if (!token) throw new Error("INSTALLATION_TOKEN is required");
 
 const client = new CopilotClient({
     connection: RuntimeConnection.forStdio(),
-    env: {
-        ...process.env,
-        COPILOT_GITHUB_TOKEN: token,
-    },
+    gitHubToken: token,
     useLoggedInUser: false,
 });
 ```
@@ -92,7 +88,7 @@ from copilot import CopilotClient, RuntimeConnection
 
 client = CopilotClient(
     connection=RuntimeConnection.for_stdio(),
-    env={**os.environ, "COPILOT_GITHUB_TOKEN": os.environ["INSTALLATION_TOKEN"]},
+    github_token=os.environ["INSTALLATION_TOKEN"],
     use_logged_in_user=False,
 )
 ```
@@ -117,7 +113,7 @@ func main() {
 	}
 	client := copilot.NewClient(&copilot.ClientOptions{
 		Connection:      copilot.StdioConnection{},
-		Env:             append(os.Environ(), "COPILOT_GITHUB_TOKEN="+token),
+		GitHubToken:     token,
 		UseLoggedInUser: copilot.Bool(false),
 	})
 	_ = client
@@ -134,7 +130,7 @@ fn main() {
     let token = std::env::var("INSTALLATION_TOKEN").expect("INSTALLATION_TOKEN is required");
     let options = ClientOptions::new()
         .with_transport(Transport::Stdio)
-        .with_env([("COPILOT_GITHUB_TOKEN", token)])
+        .with_github_token(token)
         .with_use_logged_in_user(false);
     drop(options);
 }
@@ -144,20 +140,15 @@ fn main() {
 {% codetab dotnet %}
 
 ```csharp
-using System.Collections;
 using GitHub.Copilot;
 
 var token = Environment.GetEnvironmentVariable("INSTALLATION_TOKEN")
     ?? throw new InvalidOperationException("INSTALLATION_TOKEN is required");
-var environment = Environment.GetEnvironmentVariables()
-    .Cast<DictionaryEntry>()
-    .ToDictionary(entry => (string)entry.Key, entry => entry.Value?.ToString() ?? "");
-environment["COPILOT_GITHUB_TOKEN"] = token;
 
 await using var client = new CopilotClient(new CopilotClientOptions
 {
     Connection = RuntimeConnection.ForStdio(),
-    Environment = environment,
+    GitHubToken = token,
     UseLoggedInUser = false,
 });
 ```
@@ -168,16 +159,13 @@ await using var client = new CopilotClient(new CopilotClientOptions
 ```java
 import com.github.copilot.CopilotClient;
 import com.github.copilot.rpc.CopilotClientOptions;
-import java.util.HashMap;
 import java.util.Objects;
 
-var environment = new HashMap<>(System.getenv());
 var token = Objects.requireNonNull(
     System.getenv("INSTALLATION_TOKEN"), "INSTALLATION_TOKEN is required");
-environment.put("COPILOT_GITHUB_TOKEN", token);
 
 try (var client = new CopilotClient(new CopilotClientOptions()
-        .setEnvironment(environment)
+        .setGitHubToken(token)
         .setUseLoggedInUser(false))) {
     // Use the client.
 }
@@ -186,24 +174,24 @@ try (var client = new CopilotClient(new CopilotClientOptions()
 {% endcodetab %}
 {% endcodetabs %}
 
-For in-process FFI, set `COPILOT_GITHUB_TOKEN` in the host environment before loading the runtime; per-client environment options are not supported. For an existing runtime URI, set it on that runtime process.
+For in-process FFI, use the same token option; environment variable tokens in the host process are ignored when `useLoggedInUser` is false. For an existing runtime URI, set `COPILOT_GITHUB_TOKEN` on that runtime process.
 
 ## Refresh tokens
 
-Mint a new installation token before the current token expires. For a child process, restart the SDK client with the new environment. For an in-process or existing runtime, restart the host runtime with the new token.
+Mint a new installation token before the current token expires. For a child process, restart the SDK client with the new token. For an in-process or existing runtime, restart the host runtime with the new token.
 
 ## Billing
 
-Usage is attributed and billed to the account that owns the GitHub App installation. Use an organization installation for organization billing; a user-account installation attributes usage to that user.
+Usage is attributed and billed to the organization that owns the GitHub App installation.
 
 ## Troubleshooting
 
 | Symptom | Check |
 |---|---|
-| `401 Unauthorized` | Confirm the organization supports GitHub App installation authentication for Copilot. |
-| `403 Resource not accessible by integration` or an error mentioning user information | Confirm the installation token is in `COPILOT_GITHUB_TOKEN`, not the SDK's explicit token option. |
-| `403 Forbidden` from the Copilot API | Confirm the token request contains `repository_ids` and `copilot_requests: write`. |
-| `403 Forbidden` with the required token request | Confirm the app installation has **All repositories** access, then mint a new token. |
+| `401 Unauthorized` | The token may be expired or invalid. Mint a new installation token. |
+| `403` stating that Copilot requests with GitHub App installation access tokens are not enabled | Confirm the organization supports GitHub App installation authentication for Copilot. |
+| `No GitHub OAuth token or Copilot HMAC key provided` or `Not authenticated` | Confirm the installation token is passed through the SDK's explicit token option. With `useLoggedInUser: false`, the runtime ignores `COPILOT_GITHUB_TOKEN` and other environment variable tokens. |
+| `403 Forbidden` from the Copilot API | Confirm the installation has the organization **Copilot Requests** permission, then mint a new token. |
 | Requested model is unavailable | Confirm the organization's Copilot policy allows the model and the bundled runtime supports it. |
 | Wrong account billed | Confirm the installation belongs to the intended organization. |