GH-300: What the GitHub Copilot Exam Actually Tests

What This Exam Is Really About#

The GH-300 is not testing whether you can use Copilot. It's testing whether you understand Copilot as an enterprise platform: how it processes data, who controls what, which features are locked to which plan tier, and what happens when governance requirements conflict with developer convenience.

The mental model that makes this click: think like a Copilot administrator who also writes code. Every question either asks "what would you configure here?" or "what is the correct Copilot behavior in this scenario?" The scenario-based format rewards understanding of why the rules exist. Candidates who memorize feature lists miss questions because two or three options look equally plausible, and the tie-breaker is always the underlying governance logic. The January 2026 revision sharpened this further by adding Agent Mode and MCP, two areas where the AI operates with more autonomy and the governance stakes are higher.

Exam at a Glance#

The question format is almost entirely scenario-based. You won't be asked to define "zero-shot prompting" in isolation; you'll be given a specific developer situation and asked which prompt strategy is appropriate. Multiple-response questions are common, and they're the ones where surface-level knowledge fails. Distractor answers are constructed to be plausible, two options often both "work" in the abstract, and the correct answer is whichever aligns with Microsoft's documented governance model.

The two-section mechanic. People who've written up their exam experience consistently flag this as the biggest operational surprise: once you submit Section 1 and move to Section 2, you cannot return. There is no going back to change an answer. Flag every uncertain question in Section 1, do a full review pass before submitting, then advance. This is not recoverable if you miss it.

The January 2026 revision changed the published domain structure. The current official skill areas differ from the seven-domain breakdown that appears in older study guides. Both frameworks show up in community discussion, but the six-domain January 2026 structure is what the exam now uses.

Who Should Take This#

GH-300 is the right credential for developers, DevOps engineers, tech leads, and Copilot administrators who use the tool regularly and want to formalize that expertise. It sits at the Intermediate level, positioned alongside GH-100 (Administration), GH-200 (Actions), and GH-500 (Advanced Security) in GitHub's five-exam certification track.

If you've been using Copilot for six months or more in daily work, the features domain won't surprise you. The governance material will. The exam is designed to validate that you can deploy Copilot responsibly at scale, not just use it to write functions faster. If you're still on the Copilot Free tier and haven't configured anything at an organization level, plan for extra time on the enterprise sections. If you manage Copilot for a team already, you may find the governance questions feel practical rather than theoretical.

Domain Breakdown#

Domain 1, Use GitHub Copilot Responsibly (17%)#

17%

The responsible AI domain covers ethical use principles, algorithmic bias, transparency requirements, and what it means to validate AI-generated output before shipping it. At 15–20% of the exam, it's lighter than the features domain but heavier than most candidates prepare for.

The pattern in exam questions here: Microsoft doesn't ask you to recite ethical principles. It presents a scenario and asks which principle applies, or asks what the correct response is to a specific AI output concern. "Fairness" and "Inclusiveness" appear in the same question and the distinction between them is tested. "Transparency" is about explaining how the filtering works, not relying on external reputation or interface familiarity.

The community is consistent on this: responsible AI concepts thread throughout the exam, not just in this domain. A question about content exclusion will include a responsible AI dimension. A question about Agent Mode will ask you to consider what oversight the agent requires. Treating it as isolated material is the study mistake.

Domain 2, Use GitHub Copilot Features (27%)#

27%

At 25–30%, this is the largest domain and the one that trips the most people. The breadth is what gets candidates: it covers IDE integration across VS Code, Visual Studio, and JetBrains; inline completion mechanics; Copilot Chat; Agent Mode; Edit Mode; Plan Mode; Copilot Spaces; Sub-Agents; MCP workflows; Copilot CLI; Copilot Code Review; and subscription management via the REST API.

The plan tier distinctions are the hardest part of this domain. GitHub Copilot has five tiers: Free, Pro, Pro+, Business, and Enterprise. The questions test which features exist at which tier:

• Content exclusion is Business and Enterprise only. Individual users cannot configure it
• IP indemnity is Business and Enterprise only
• Fine-tuned models, Knowledge Bases, and pull request summaries are Enterprise only
• SAML SSO enforcement is Business and above
• Web search grounded in Bing is Enterprise only
• Audit logs for administrator actions are Business and Enterprise; the detail level differs by tier

This matters because the exam will describe a scenario with specific requirements (a company needs IP indemnity, or a team needs content exclusions on their secrets directory) and ask which plan is required. The distractor is always the plan one tier below the correct answer.

Agent Mode and MCP were added to scope in the January 2026 revision. Agent Mode lets Copilot autonomously write code, run builds, read failure logs, and retry, a full agentic loop without human step-by-step guidance. MCP (Model Context Protocol, originally developed by Anthropic as an open standard) is what enables Copilot to connect to external tools, databases, and CI/CD systems in a standardized way. You need to understand how to structure prompts for Agent Mode, specifically, how to define operational boundaries and negative constraints (telling the agent to plan but not make file changes, for instance).

Domain 3, Understand GitHub Copilot Data and Architecture (12%)#

12%

This domain covers how Copilot actually processes a prompt: context gathering, the proxy pipeline, pre-processing, LLM interaction, post-processing, and what happens to data after a session ends.

The proxy pipeline is what people get questions wrong on. When you write code in your IDE and Copilot generates a suggestion, the prompt doesn't go directly from your IDE to an LLM. It travels to a GitHub-owned Azure proxy first. The proxy runs pre-processing (toxicity filtering, relevance checks), routes to the LLM, then the LLM's output goes back through the proxy for post-processing before reaching your editor. Post-processing includes:

• Secondary toxicity filtering
• Code quality checks
• Security scans for common vulnerabilities
• Enterprise code matching to block verbatim copyrighted snippets
• Truncation or discard if the output doesn't pass

Understanding this pipeline matters for the exam because several questions are built on it. "Why didn't Copilot return a suggestion?" often has an answer in the post-processing filters. "Where is data stored?" depends entirely on which tier and which interface.

Data retention by plan and interface:

• Business and Enterprise (IDE interactions): zero retention. Prompts and suggestions are discarded after processing
• CLI and Agent Mode workflows: 28-day retention for abuse monitoring and session auditing, not model training
• Individual plans (Free, Pro, Pro+): interaction data may be used for model training by default; users can opt out in GitHub settings without losing access to features
• User engagement telemetry: kept for two years across all tiers for product development

This is a guaranteed test area. The 28-day exception for CLI and Agent Mode (and the reason for it) is exactly the kind of specific detail the exam tests.

Domain 4, Apply Prompt Engineering and Context Crafting (12%)#

12%

The prompt engineering domain is more practical than theoretical. The exam tests whether you can reason about what makes a prompt work or fail in a given scenario, not whether you can define terms.

The framework that shows up in exam content: prompts should be single, specific, short, and surrounded (the four Ss). Each of these has exam consequences. "Single" means one task per prompt; multi-task prompts produce mixed-quality output. "Specific" is the one candidates most consistently underestimate, vague prompts produce vague output, and the exam will attribute poor suggestion quality to insufficient specificity before any other cause.

Zero-shot vs. few-shot is tested, but in application rather than definition. Given a developer task, the exam asks which approach is appropriate. Few-shot (providing examples in the prompt) is for situations where the pattern is non-obvious or where consistency matters more than speed. Zero-shot is the default for straightforward tasks.

Chat history and context injection are also in scope. The exam includes scenarios where Copilot returns off-topic suggestions and asks what was missed, the answer is usually context. The candidate who understands why context matters (the LLM is working from what's in the context window, nothing else) will eliminate distractors faster than the candidate who memorized a list of prompt tips.

Domain 5, Improve Developer Productivity with GitHub Copilot (12%)#

12%

This domain covers the real-world use cases: test generation, documentation, legacy code modernization, refactoring, debugging, and multi-file edits. It's the most comfortable domain for people who use Copilot daily, and the failure pattern here is overconfidence.

The exam asks about use cases at a level of specificity that requires IDE experience. Questions about generating unit tests will distinguish between generating a test for a function in isolation vs. generating integration tests that depend on external systems. Questions about Edge cases will ask how to prompt Copilot to enumerate them rather than just generate happy-path coverage.

Copilot's integration into the pull request lifecycle is tested here too. Copilot Enterprise can generate a prose summary of a PR changeset and answer questions about the diff interactively. The exam tests the boundary of what it can do: it can summarize and answer questions, but it does not automatically merge PRs or validate correctness of changes. Distractor answers always include one option that's more autonomous than the documented behavior actually allows.

Domain 6, Configure Privacy, Content Exclusions, and Safeguards (12%)#

12%

This domain and Domain 2 are where the exam separates developers from administrators. The content exclusion material is the single most cited knowledge gap in community pass reports, and for good reason: individual Copilot users have no reason to configure it, so it's unfamiliar territory.

How content exclusions work:

• Repository admins, organization owners, and enterprise owners can configure exclusion patterns (e.g., /*.env, /*.csv, /src/secrets/)
• When content is excluded, Copilot is blocked on three vectors: inline suggestions are disabled in excluded files, excluded content cannot be used as context for suggestions in other files, and Copilot Chat will refuse to analyze excluded content
• Users with the Maintain role can view content exclusion settings but cannot edit them
• Enterprise-level rules take precedence over org-level rules once set; otherwise org rules apply enterprise-wide
• After you change content exclusion settings, it takes up to 30 minutes to propagate to IDEs where settings are already loaded

The critical gotcha, tested explicitly: Content exclusion does not apply to Copilot CLI, the coding agent, or Agent Mode in Chat. This is in the official GitHub documentation and it's a frequent exam target. If a question asks how to prevent Copilot from accessing a secrets directory in an agentic workflow, "configure content exclusion" is wrong, it doesn't apply in that context.

IP protection configuration: The correct setting to seek IP indemnity coverage is "Suggestions matching public code: blocked." Not "enable license checking," not "block MIT or GPL code", the correct setting is the public code matching filter set to blocked. The exam has distractors built around adjacent-sounding configurations.

Duplication detection and security warnings in editor settings are also in scope. Copilot can be configured to show warnings when a suggestion matches public code, separate from blocking it. The difference between warning and blocking is tested.

Where Candidates Lose Points#

Under-studying Domain 2. The Plans & Features domain is 25–30% of the exam. People who use Copilot on a Free or Pro account every day have deep feature knowledge but zero experience with Business and Enterprise plan configurations. Memorizing which features exist at which tier is table stakes; understanding the reasoning behind the tier boundaries is what resolves ambiguous questions.

Getting the billing model wrong. The billing model is the trap no one warns you about until it's too late. The exam as revised in January 2026 still tests the old Premium Request Unit (PRU) billing model. GitHub is transitioning to AI Credits on June 1, 2026. If your study material is from mid-2026 or later, it may cover the new model while the exam tests the old one. Study both.

Assuming content exclusion covers everything. The most common trap question: a team needs to prevent Agent Mode from reading a sensitive directory. A candidate who knows content exclusion controls this setting confidently picks it as the answer. It's wrong. Content exclusion does not apply to Agent Mode, CLI, or the coding agent. This requires a different control.

The two-section mechanic. The failure reports are consistent on this: candidates who move to Section 2 without reviewing Section 1 sometimes realize after the fact that they knew the correct answer on a question they'd marked uncertain. There is no recovery. The flag-and-review workflow in Section 1 is not optional.

Treating responsible AI as background. The responsible AI material is embedded throughout the exam, not isolated in its own set of questions. A question about Agent Mode configuration will include a component about what human oversight is required. A question about data retention will include a responsible AI framing. Studying it as a separate domain check-box produces gaps across the whole exam.

Over-trusting old study material. The January 2026 revision was substantial. Agent Mode, Edit Mode, Plan Mode, Sub-Agents, MCP, Copilot Spaces, Copilot Spark, Copilot CLI, and Copilot Code Review policies were all added to scope. Any course or guide published before mid-2025 is missing significant material.

How to Prepare#

Foundation: the official Microsoft Learn path. Microsoft's "GitHub Copilot Fundamentals" learning path (Parts 1 and 2) is the official baseline and it's free. People who've written up their experience report finishing it in 3–8 hours depending on how deeply they already use the tool. The path is good on features but lighter on enterprise governance, plan for additional time in the docs on content exclusion, data retention, and plan comparison.

Official study guide. The study guide at learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/gh-300 is the authoritative domain list. Use it as a checklist: for each item, can you answer a scenario question about it or just define it? The gap between those two is where exam points are.

Hands-on practice. You cannot pass this exam on theory alone, and the community is unanimous on this. Use Agent Mode, Edit Mode, and Plan Mode explicitly, not just inline completion. Configure a content exclusion rule on a test repository. Try the CLI with gh copilot suggest and gh copilot explain. The questions that test these features are grounded in what the interface actually does, and recognizing correct behavior requires having seen it.

Practice questions. The official Microsoft free practice assessment (available from the certification page) is the first thing to run, not the last. Take it before you feel ready. Where you score below 80%, that's the domain to focus on. The assessment is somewhat easier than the real exam, people who've passed say the real exam includes questions that require more careful reasoning. Use CertCompanion's GH-300 practice questions to build pattern recognition on scenario-based questions before exam day. Aim for consistent 85%+ before you schedule.

Build a plan tier cheat sheet. One page, five tiers, every major feature. Free / Pro / Pro+ / Business / Enterprise. Which features are available, which require Business, which require Enterprise. Refer to it until you can reproduce the key distinctions from memory. This is the most targeted preparation for the highest-weighted domain.

Official exam tools to use:

• Microsoft Learn free practice assessment (from the certification page)
• Exam interface preview at aka.ms/GHExamDemo-enu
• GitHub Copilot Free tier for hands-on practice (2,000 completions/month)
• GitHub docs at docs.github.com/en/copilot (particularly content exclusion, plan comparison, and the trust center)

Study Timeline#

Community experience suggests the Microsoft Learn path alone (estimated at 4–8 hours officially, completed in ~3 hours by some experienced users) is necessary but not sufficient. The pattern across pass reports: the people who score above 800 consistently added hands-on agentic workflows and a focused session on the enterprise governance material beyond what the learning path covers.

On Exam Day#

Pearson VUE proctoring logistics. The online proctored format requires environmental photos of your testing space, one monitor, a closed-door room, and no other people. Community experience describes the setup as straightforward, photo submission, identity verification, system check. No live proctor visible on screen during the exam. Clear your desk and pick a quiet, well-lit space.

Time management. At ~65 questions in 100 minutes, you have about 90 seconds per question. Scenario-based questions typically run longer to read than the time they take to answer once you know the material, if a question is taking more than two minutes, mark it and move on. The multiple-response questions (where you choose two or three correct answers) require more deliberate elimination, so budget slightly more time for those.

Register with a personal Microsoft account. If you register with a work or school Azure AD account and change employers, your certification record is unrecoverable. Use a personal MSA. This is a permanent record portability issue, not a temporary inconvenience.

Score reporting. Scores are typically available immediately at the end of the exam session via the Pearson VUE interface. The digital badge appears in your Microsoft Certification dashboard shortly after.

After You Pass#

The GH-300 is recognized at the Intermediate level alongside the other GitHub certifications. For roles that involve deploying or administering AI-assisted developer tooling at scale, it's a meaningful signal, it validates governance competency, not just feature familiarity.

Career context: available job listing data from Glassdoor showed over 200 remote GitHub Copilot-related positions in early 2026. Salary data from one community source puts average compensation for Copilot-related roles at around $81,750 USD, though that figure has limited sourcing and should be treated as directional rather than precise.

The certification is valid for two years. Renewal is via a free Microsoft Learn online assessment, no need to sit the full exam again. Microsoft has been consistent about this free renewal path across their certification portfolio.

Logical next certifications:

• GH-200 (GitHub Actions): Copilot integrates directly into CI/CD workflows, so Actions knowledge compounds the GH-300 material
• GH-500 (GitHub Advanced Security): Copilot's IP and secret-scanning behaviors have direct overlap with the Advanced Security domain
• GH-900 (GitHub Foundations): Entry-level credential if you need to formalize core Git and GitHub platform knowledge alongside the Copilot cert

Frequently Asked Questions#

Is GH-300 hard? Moderate. The consensus across pass reports is "not hard to pass, but harder to score high." The exam format is scenario-based throughout, and the plan-tier distinctions require genuine memorization rather than reasoning. Candidates with daily enterprise Copilot experience generally find it more manageable; those coming from individual accounts should expect a meaningful study investment on the governance material.

How many hours should I study? Four to eight hours for daily enterprise Copilot users who add focused sessions on the January 2026 material (Agent Mode, MCP, Spaces). Ten to twenty hours for individual-plan users who lack enterprise administration experience. Three to six weeks for those starting fresh with Copilot. The Microsoft Learn path is the starting point, not the whole plan.

Does the certification expire? Yes, two years. Renewal is via a free Microsoft Learn assessment, no exam fee, no full retake. Microsoft has maintained this free renewal path consistently across its certification portfolio.

Are there prerequisites? No official prerequisites. Practical experience with Copilot in an IDE is strongly recommended by everyone who's passed; theory alone is insufficient for the scenario-based format.

What's the retake policy? 24-hour wait after the first attempt, with longer mandatory wait periods after subsequent failures. Maximum five attempts per year. The 24-hour window is shorter than most Microsoft certification retakes, which is noted positively in community reports.

Does GH-300 cover Agent Mode and MCP? Yes, explicitly. The January 2026 revision added Agent Mode, Edit Mode, Plan Mode, Sub-Agents, MCP, Copilot Spaces, Copilot Spark, and Copilot CLI to scope. Any study material that predates this revision is missing meaningful content. Check that whatever you're using covers agentic workflows.

What's the biggest trap? Two candidates: plan-tier distinctions and the billing model. The exam tests specific feature-to-tier mappings (content exclusion requires Business or above; Knowledge Bases require Enterprise). The billing model trap is that the exam as revised in January 2026 still tests the old Premium Request Unit model, while GitHub began transitioning to AI Credits in June 2026. If your prep material is recent, verify it covers the PRU model.

What about content exclusion and Agent Mode? Content exclusion does not apply to Copilot CLI, the coding agent, or Agent Mode in Chat. This is a specific documented limitation and it's tested. If a question involves preventing Agent Mode from accessing sensitive files, content exclusion is not the answer, a different control is required.

The GH-300 is a genuine test of enterprise AI literacy, not a product walkthrough. If you use Copilot every day, the features domain is review. The governance material, plan tiers, data architecture, content exclusions, responsible AI framing, is where the exam actually discriminates. Study that material like it's 40% of the exam, because for practical purposes it is.

Ready to build the pattern recognition you need? Start with CertCompanion's GH-300 practice questions to run through scenario-based questions before you book.