GitHub Copilot managed settings: govern the app and cloud agent safely
Quick answer
On July 27, 2026, GitHub expanded enterprise managed settings to the GitHub Copilot app and the Copilot cloud agent. The change closes an important governance gap: plugin and marketplace rules can now follow developers from Copilot CLI and VS Code into the app and cloud tasks. GitHub also separated access to the Copilot app from the Copilot CLI policy, so administrators can decide whether the app is available without coupling that decision to CLI access.
Do not treat this as “one JSON file controls every client identically.” Start with a client-by-key matrix, keep app access separate from runtime guardrails, deploy the smallest policy through a pull request, and prove six negative and recovery cases before broad rollout. In particular, bypass-prompt controls apply to interactive clients, not the cloud agent, and OpenTelemetry settings currently apply only to Copilot CLI and VS Code.
Who this is for
