GitHub Enterprise Cloud lists at $21 per user per month for the base plan, with Advanced Security adding $49 per active committer per month and Copilot Enterprise adding $39 per seat per month, taking a fully loaded enterprise developer to $109 per user per month before any volume discount. The realised cost after enterprise negotiation typically lands at $65 to $85 per fully loaded developer per month at $1M-plus annual contract value. This pillar covers every 2026 GitHub line item, the SKU interactions buyers miss, and the negotiation levers that move the bill.
Inside This Pillar
- GitHub 2026 list prices
- Cloud vs Server vs Enterprise Server
- Advanced Security pricing
- Copilot Enterprise and Business
- Codespaces compute
- GitHub Actions compute and storage
- Packages and Registry
- Discount bands and negotiation
- Audit and seat-counting traps
- Exit and migration cost
- How to cut GitHub spend in 2026
GitHub 2026 list prices
GitHub publishes list prices openly. The pricing page is updated quarterly. The 2026 list:
| SKU | List price | Metric |
|---|---|---|
| GitHub Enterprise Cloud | $21 per user per month | Monthly active user |
| GitHub Enterprise Server (self-hosted) | $21 per user per month | Provisioned user |
| GitHub Team (mid-market) | $4 per user per month | Provisioned user |
| Advanced Security add-on | $49 per active committer per month | Unique active committer |
| Copilot Business | $19 per user per month | Provisioned user |
| Copilot Enterprise | $39 per user per month | Provisioned user |
| Codespaces compute (4-core) | $0.18 per hour | Compute-hour |
| Codespaces storage | $0.07 per GB per month | Stored GB |
| Actions Linux compute (standard) | $0.008 per minute | Minute, after free tier |
| Actions Windows compute | $0.016 per minute | Minute |
| Actions macOS compute | $0.08 per minute | Minute |
| Packages storage | $0.25 per GB per month | Stored GB, after 2 GB free |
| Packages data transfer | $0.50 per GB | Outbound GB |
The headline $21 base is straightforward. The bill complexity comes from Advanced Security, Copilot, and consumption-based services. The next sections unpack each.
GitHub Enterprise Cloud vs Server vs Enterprise Server
GitHub Enterprise comes in three deployment forms: Enterprise Cloud (multi-tenant SaaS on github.com), Enterprise Server (self-hosted VM), and Enterprise Cloud with Data Residency (single-tenant cloud, EU residency available 2024 onward). All three carry the same $21 per user per month list. The differences are operational and contractual.
| Capability | Enterprise Cloud | Enterprise Server | EC with Data Residency |
|---|---|---|---|
| Hosting | github.com multi-tenant | Customer VM on-prem or in cloud | Single-tenant in EU region |
| Data residency | US only on standard tier | Customer-controlled | EU (Germany) |
| SSO and SCIM | SAML SSO, SCIM provisioning | Built-in SAML | SAML SSO, SCIM |
| Copilot integration | Full | Available 2024 onward | Full |
| Codespaces | Native | Self-hosted runners only | Native |
| Operational cost burden | Low (GitHub manages) | High (customer manages infra and upgrades) | Low |
| EU AI Act fit | Limited (US residency) | Full control | Built for EU compliance |
The Enterprise Server option is now niche. Most large enterprises that ran Enterprise Server in 2018 to 2022 have migrated to Enterprise Cloud during 2023 to 2026. The remaining Enterprise Server customer base is concentrated in defence, financial services with extreme sovereignty requirements, and pre-existing private-cloud-only mandates. For new buyers, Enterprise Cloud is the default. Enterprise Cloud with Data Residency is the answer for EU sovereignty without operational burden.
GitHub Advanced Security pricing
Advanced Security (GHAS) is the upsell that closes the gap between GitHub and dedicated AppSec vendors (Snyk, Checkmarx, Veracode). It adds secret scanning, dependency review, code scanning with CodeQL, and security overview. List price is $49 per active committer per month.
The "active committer" metric is where Advanced Security cost surprises buyers. An active committer is any user who has pushed a commit to any repository where Advanced Security is enabled, within the past 90 days. The count is calculated per organisation, not per repository. Enabling Advanced Security on a single critical repository can therefore bill every developer who has touched that repository in the last quarter, even if the developer normally works on other repositories where Advanced Security is not enabled.
Advanced Security committer trap: A 500-developer organisation that enables Advanced Security on its 20 production repositories often sees the active committer count land at 350 to 420, not the 80 to 100 developers who actively maintain those repositories. The fix is to scope Advanced Security to a smaller repository set or to negotiate a fixed seat commit rather than the floating committer model.
Advanced Security also offers a tiered alternative: Code Security ($30 per active committer per month) bundles code scanning and secret scanning for production code only, dropping dependency review and security overview. For pure pre-production protection, Code Security cuts the Advanced Security bill by 39 percent.
GitHub Copilot Enterprise and Business
Copilot is the most aggressively priced upsell GitHub has launched. Three enterprise SKUs:
| Copilot SKU | Price | Includes |
|---|---|---|
| Copilot Business | $19 per user per month | Code completion, chat, CLI |
| Copilot Enterprise | $39 per user per month | Business plus organisation context, pull request summaries, custom models |
| Copilot Pro (individual) | $10 per user per month | Individual developer tier, not for enterprise |
| Copilot Extension marketplace | $0 to $20 per user per month per extension | Partner extensions (Atlassian, Datadog, etc.) |
Copilot Enterprise is the obvious upsell from Copilot Business, but the realised ROI gap is narrower than the price gap. The Enterprise features that justify the additional $20 per user are: codebase indexing across the organisation, pull request summaries, custom model fine-tuning, and the Knowledge Bases feature. For developer teams that work in single repositories with limited cross-repo context needs, Copilot Business delivers 80 percent of the value at 49 percent of the price.
The 2026 Copilot pricing change extended seat-based billing to per-message billing for high-volume premium model usage. Premium model requests (GPT-4 Turbo, Claude Sonnet 4) above 300 per user per month are billed at $0.04 each. Heavy users (5 to 8 percent of developer populations) can add $40 to $120 per month per seat in metered consumption. See our companion piece on Copilot Enterprise pricing for the full breakdown.
Codespaces compute
GitHub Codespaces are cloud development environments billed by compute-hour. Pricing scales with VM size:
| Codespace size | Per hour | Monthly cost (8 hours per day, 22 days) |
|---|---|---|
| 2-core / 8 GB RAM | $0.18 | $31.68 |
| 4-core / 16 GB RAM | $0.36 | $63.36 |
| 8-core / 32 GB RAM | $0.72 | $126.72 |
| 16-core / 64 GB RAM | $1.44 | $253.44 |
| 32-core / 128 GB RAM | $2.88 | $506.88 |
Storage is $0.07 per GB per month. A typical enterprise developer with a 16 GB Codespace running 8 hours per day consumes $63 per month in compute plus storage. The hidden cost is auto-suspend configuration. Default auto-suspend at 30 minutes idle works. Disabled auto-suspend creates idle compute bills that have produced six-figure overages in customer estates.
GitHub Actions compute and storage
Actions is the CI/CD pipeline included with Enterprise. The included monthly free minutes vary by plan:
| Plan | Free Actions minutes | Free Packages GB |
|---|---|---|
| Free | 2,000 | 0.5 GB |
| Team | 3,000 | 2 GB |
| Enterprise Cloud | 50,000 | 50 GB |
Above the included minutes, Linux runs at $0.008 per minute, Windows at $0.016, macOS at $0.08. Self-hosted runners (customer infrastructure) are free of GitHub-side compute charges but cost the customer in their own cloud bill. For high-volume CI workloads (more than 5M minutes per month), self-hosted runners on AWS Spot or Azure Spot are 60 to 80 percent cheaper than GitHub-hosted runners.
Actions Larger Runners (4-core, 8-core, 16-core, GPU) carry premium pricing: 4-core Linux at $0.016 per minute, GPU runners at $0.16 per minute. GPU runners can produce surprise bills if ML pipelines are misconfigured.
GitHub Packages and Registry
Packages charges $0.25 per GB per month above 50 GB included on Enterprise. Outbound data transfer is $0.50 per GB. The data transfer fee is the hidden cost. A team pulling 200 GB of container images per day from GitHub Packages incurs $3,000 per month in egress alone. The architectural fix is to mirror frequently-pulled images to a cloud-native registry (ECR, ACR, Artifact Registry) and use GitHub Packages only as the source of truth.
Discount bands and negotiation
GitHub Enterprise sales discounts are tiered by annual contract value. Realistic discount bands observed in advisor-led GitHub negotiations during 2024 to 2026:
| Annual contract value | Base seat discount | Copilot discount | Advanced Security discount |
|---|---|---|---|
| $50K to $250K | 0 to 5 percent | 0 to 5 percent | 0 to 5 percent |
| $250K to $1M | 5 to 15 percent | 5 to 10 percent | 5 to 10 percent |
| $1M to $3M | 15 to 25 percent | 10 to 18 percent | 10 to 20 percent |
| $3M to $10M | 25 to 35 percent | 18 to 28 percent | 20 to 30 percent |
| $10M+ | 35 to 45 percent | 28 to 40 percent | 30 to 40 percent |
Microsoft-portfolio discount adds 5 to 10 percentage points across the board for buyers with material Microsoft Enterprise Agreement spend. GitHub is fully owned by Microsoft and routinely co-sells with the Microsoft account team for strategic customers. Including GitHub Enterprise in the Microsoft EA negotiation rather than negotiating it standalone is the single highest-discount 2026 move for customers with $5M-plus Microsoft EA spend.
Audit and seat-counting traps
GitHub Enterprise Cloud bills on monthly active users. A monthly active user is any user who logged in or performed any action during the month, including read-only browsing. The implication: dormant accounts billed if they ever log in during the billing period. Two common audit traps:
- Service accounts and bots: CI service accounts, deploy bots, and automation users are billable as active users. A pipeline with 12 service account commits per day uses 12 active user slots. The fix is to consolidate automation into a small number of dedicated service accounts.
- Cross-organisation membership: A user who belongs to two enterprise organisations is billed once by each. Multi-business-unit estates where engineers contribute across BU boundaries should consolidate into a single GitHub Enterprise account with internal-only repositories per BU.
Advanced Security 90-day window: The 90-day active committer window means that a developer who commits to a repository once and never returns continues to be billed for 90 days. For organisations with high contractor churn, the Advanced Security cost can be 30 to 60 percent inflated relative to the steady-state developer headcount. Negotiating a flat-rate Advanced Security commit rather than the floating committer model eliminates this leakage.
Exit and migration cost
The cost of migrating away from GitHub is dominated by toolchain interruption, not by data movement. Repository data exports cleanly to GitLab, Bitbucket, or self-hosted Gitea. The cost is in CI/CD migration (Actions to GitLab CI, Jenkins, or CircleCI), webhook reconnection, security tool re-integration, and developer retraining.
Typical 2,000-developer GitHub-to-GitLab migration runs $1.2M to $2.4M across professional services, internal effort, and lost productivity during the cutover. The exception is migrations to Microsoft Azure DevOps, which is operationally close to GitHub for code hosting (and is owned by the same parent) but is a much weaker CI/CD platform. Azure DevOps migration is rarely cost-effective.
How to cut GitHub spend in 2026
Six levers, ranked by typical cost impact:
- Bundle with Microsoft EA: 10 to 15 percent additional discount available by negotiating GitHub alongside Microsoft EA renewal. Highest-discount move for Microsoft-heavy enterprises.
- Right-size Copilot Enterprise to Business: 51 percent saving per seat on the Copilot line. Reserve Copilot Enterprise for the 20 to 30 percent of developers who actively use codebase indexing and PR summaries.
- Scope Advanced Security to a smaller repository set: Often reduces active committer count by 40 to 60 percent. Pair with negotiated flat-rate commit to eliminate floating committer overage.
- Audit service accounts and bots: Typical finding is 8 to 15 percent of paid seats are automation or dormant accounts. Consolidation saves $42,000 per year per 1,000 developers at list.
- Self-hosted runners for high-volume CI: 60 to 80 percent reduction in Actions compute cost above 500K monthly minutes. Requires customer-managed AWS or Azure compute.
- Mirror Packages registry to cloud-native: Eliminates 90 percent of Packages egress charges for high-pull repositories.
The complete commercial framework sits across our cluster pages. See Copilot Enterprise pricing, GitHub Enterprise field guide, Microsoft EA complete guide, Microsoft 365 Copilot pricing 2026, cybersecurity licensing, and the Microsoft vendor hub. For engagement, see our software licensing advisory service or cloud contract negotiation.