Enterprise-Managed Settings for Copilot Business and Copilot Enterprise

[gpadak]

🏷️ Discussion Type

Product Feedback

Body

We've been releasing new features for governance and extensibility that allows for an enterprise-managed configuration to be applied to Copilot clients. This is a configuration as code model available to GitHub Enterprise customers. If an enterprise's users are operating with a Copilot Business or Copilot Enterprise licensed issues by the enterprise, the user's client of choice will automatically pick up this configuration at login time. We'll be covering client permissions and extensibility where enterprise-wide standards are appropriate to apply.

Check out these docs to get started.

Our goals for this feature set

• Cross-client standardization of governance and extensibility
  • Copilot should have the same enterprise-managed configuration regardless of where you operate.
  • Supportive of both file-based and MDM deliveries.
• Visible guardrails that humans and agents can see and navigate in the client experience
  • If an operation is prohibited or controlled in a specific way, you should know why and where that was defined.
• Faster ramp-up time for new users or for specific jobs to be done
  • Plugin marketplaces and automatically enabled plugins can be configured so that Copilot is customized to your specific needs at login.
• Innersourced configuration and a traceable governance SDLC
  • Users can open a pull request with suggestions to improve the settings that apply to all clients or specializations that apply to specific teams of users.
  • Changes can be versioned and made subject to codeowners and rulesets that enforce review standards

Published releases in this area

• Agent Control Plane is Generally Available
• Extensibility: Enterprise-managed plugins in GitHub Copilot CLI are now in public preview
• Extensibility: Enterprise-managed plugins in VS Code in public preview
• Governance: disableBypassPermissionsMode - up next

Tell us your thoughts

We'll be adding more configurable parameters over time that allow an enterprise to tailor their Copilot client experience - and your feedback can help us decide on what's next! If you're an administrator, setting AI standards for your business, a developer, or any user of Copilot Business/Enterprise we'd love to hear from you.

[lukaszkiszka]

Hi feature working well, but enable all permissions is still possible in autopilot mode.

You are considering introduce similar settings to block autopilot mode for enterprise?

[digitarald]

The latest VS Code separated Autopilot from the permissions mode. Does that fix it?

Also, even before that change disabling auto-allow should have also disabled autopilot's auto-allow behavior, so maybe you can clarify that this was in VS Code or in another surface.

[joshspicer]

👋 @lukaszkiszka - Are you using the VS Code agent or Copilot CLI? With permissions.disableBypassPermissionsMode appropriate set, I would expect in the latest VS Code (1.126.0) for auto-pilot to be disabled.

If this is in another Copilot surface, please let us know so we cna dig into that!

[lukaszkiszka]

@joshspicer 👋

I agree, that works fine in VS Code, but I use a Copilot CLI harness in version 1.0.65 and I can using autopilot mode with Enable all permissions option.

Copilot team will plan also disable this setting s in Copilot CLI?

[lukaszkiszka]

Command: /allow-all it's blocked fine - attempt to use ends with:
Bypass permissions mode has been disabled by policy. Contact your administrator for more information.

[lukaszkiszka]

Hi,

@gpadak any opinion/plan for block the autopilot on enterprise level?

[mohammad-siahatgar]

Really glad to see this shipping.

One gap we hit: our plugin marketplace repo is hosted on Azure DevOps, not GitHub. The docs only document the "source": "git" + url form under strictKnownMarketplaces, while extraKnownMarketplaces is described as "github" + OWNER/REPO only. Since strictKnownMarketplaces locks installs to only the listed marketplaces, there's no documented additive way to register a non-GitHub git marketplace alongside existing ones.

Two asks, if they're on the roadmap:

1. Officially support git + url sources in extraKnownMarketplaces (additive), so non-GitHub-hosted marketplaces don't force strict mode.
2. Guidance on clone authentication for private non-GitHub repos (e.g. Azure DevOps) — how the client / cloud agent is expected to authenticate when resolving the marketplace at login.

Use case: a single internal marketplace shipping custom agents + preconfigured remote MCP servers (Azure DevOps + Atlassian), auto-enabled for all enterprise users.

[ViacheslavKudinov]

Hi,
I have created in .github-private repo file with marketplace configuration:

 {
   "extraKnownMarketplaces": {
     "internal-marketplace": {
       "source": {
         "source": "github",
         "repo": "ORG/copilot-plugins"
       }
     }
   }
 }

and also the repository (internal visibility, not public) for Agent plugins ORG/copilot-plugins
where i have marketplace.json with something like

{
  "name": "internal-marketplace",
  "owner": {
    "name": "ORG",
    "email": "example@example.com"
  },
  "metadata": {
    "description": "Curated plugins",
    "version": "0.1.0"
  },
  "plugins": [
    {
      "name": "plugin",
      "description": "A plugin",
      "version": "0.1.0",
      "source": "./plugins/plugin"
    }
  ]
}

with folder for plugins and so on.

I can see the marketplace and plugin(s) on Copilot clients (Copilot CLI, VSCode),
but not on Copilot Cloud Agent as one can't checkout the repository with plugins.

On the repo where i want to get plugins is file:

{
  "extraKnownMarketplaces": {
    "internal-marketplace": {
      "source": {
        "source": "github",
        "repo": "ORG/copilot-plugins"
      }
    }
  },
  "enabledPlugins": {
    "plugin@internal-marketplace": true # to get installed automatically
  }
}

It would be great for Enterprises if Copilot Cloud Agent could checkout Agent plugins from internal repositories somehow as well.

Is it known limitation or any workaround is there ?

Maybe it is the feature request for this funtionality.

Thank you in advance.

[calexandre]

Regarding the post Enterprise-managed OpenTelemetry export for VS Code and CLI i'm quite confused...Can we configure OpenTelemetry via .github-private/copilot/managed-settings.json ...? The documentation doesn't state anything about telemetry :/