GitHub shipped a cluster of Copilot governance updates on July 27, expanding enterprise controls across the Copilot app, Copilot cloud agent, and JetBrains IDEs.
The practical change is that Copilot is less like one assistant and more like a set of managed clients. GitHub now gives the Copilot app its own enterprise and organization access policy. Enterprise managed settings also apply to the Copilot app and Copilot cloud agent, so the same guardrails used for Copilot CLI and VS Code can follow developers into newer agent surfaces.
For JetBrains, GitHub added OpenTelemetry export settings for agent workflows, default token limits for BYOK and custom endpoints, and controls to disable or enable all built-in Copilot models.
Agent governance is moving into settings files
GitHub says the Copilot app reads the same managed-settings.json that enterprises already use for other clients. Admins can govern which plugins are available, which plugin marketplaces developers can install from, whether approval prompts can be bypassed before commands, file access, or URL fetches, and whether auto model selection should be the default for new conversations.
The Copilot cloud agent reads the applicable managed settings for plugins and marketplace controls. GitHub notes that bypass-prompt controls apply only to interactive clients such as the app, Copilot CLI, and VS Code.
That division matters. A cloud agent running in an isolated workspace is still part of the software delivery system. It can open pull requests, trigger reviews, and create changes that go through existing checks. Enterprises need controls that follow the work surface, not only the local editor.
Separate app policy closes a client gap
Until this update, GitHub says access to the Copilot app depended on the Copilot CLI policy being enabled. The app now has a dedicated policy with three choices: enabled everywhere, disabled everywhere, or letting organizations decide.
The default is enabled everywhere. That means some enterprise teams may need to make an affirmative governance decision rather than waiting for adoption to appear organically. If the app is not the right fit, admins can disable it and developers who open the app will see a notice.
JetBrains gets a more operational set of controls. OpenTelemetry export helps align agent workflows with observability requirements. Token-limit defaults and model-management controls help teams govern cost, endpoint behavior, and allowed model choices.
