GitHub has extended enterprise managed settings to the Copilot app and cloud agent, allowing organizations to enforce consistent security policies across all Copilot clients in one place. Previously, enterprises could only govern Copilot through the command-line interface (CLI) and VS Code. Now, a single configuration file automatically applies the same rules to the desktop app and cloud-based agent tasks, closing what GitHub calls governance gaps where developers might otherwise bypass organizational controls.

Why Does Unified Copilot Governance Matter for Enterprises?

As developers adopt AI coding assistants across more tools and workflows, enterprises face a growing challenge: keeping security policies consistent everywhere. If one Copilot client sits outside your governance framework, it becomes a potential weak point. A developer could install an unapproved plugin, run an ungated command, or access files that would normally require approval. GitHub's new approach treats governance as a single source of truth, rather than a patchwork of different rules across different tools.

The update addresses a real operational headache for large organizations. When teams use Copilot in VS Code, the CLI, the standalone app, and cloud-based agent tasks simultaneously, managing four separate policy systems becomes error-prone and difficult to audit. Unified governance reduces that friction and gives security teams confidence that their rules actually apply everywhere developers work.

How to Set Up Enterprise Managed Settings for Copilot

• Create a configuration repository: Set up a.github-private repository in your enterprise and add a copilot/managed-settings.json file to define your policies.
• Define your policy keys: Specify which plugins are available, which plugin marketplaces developers can install from, whether developers can bypass approval prompts, and whether to set auto model selection as the default for new conversations.
• Deploy and enforce: Commit your configuration to the default branch, and supported clients will apply the updated settings within about an hour, immediately after a developer restarts the client, or when they sign back in. You can also deploy through mobile device management (MDM) or a distributed file system.

If your organization already uses managed-settings.json for Copilot CLI and VS Code, there is nothing new to set up. The Copilot app automatically picks up your existing configuration the next time a developer signs in or restarts the app, and the cloud agent observes changes on the next task assignment.

What Specific Controls Do Enterprises Get?

The managed-settings.json file gives enterprise owners granular control over several key areas. Organizations can decide which plugins developers have access to, restrict which plugin marketplaces are available, control whether developers can bypass approval prompts before Copilot runs commands, accesses files, or fetches URLs, and set auto model selection as the default for new conversations. For each supported key, the managed value takes precedence over anything a developer sets locally.

The Copilot cloud agent, which handles autonomous tasks assigned by developers, reads the applicable managed settings and only uses plugins and marketplaces that the enterprise has approved. Bypass-prompt controls apply only to interactive clients like the app, CLI, and VS Code, since the cloud agent operates without direct user interaction.

This layered approach reflects the reality of modern development teams. Some developers work in VS Code, others use the standalone Copilot app for quick tasks, and teams increasingly rely on cloud agents to handle repetitive or complex workflows. By extending governance to all four surfaces, GitHub ensures that security policies follow developers into every corner of their workflow, rather than creating blind spots where policies don't apply.

The update also simplifies compliance and audit work. Instead of checking four different policy systems and hoping they align, security teams can maintain a single source of truth and verify that all Copilot clients enforce it consistently. For enterprises already managing Copilot at scale, this represents a meaningful step toward the kind of unified governance that large organizations expect from their development tools.