GitHub added two Copilot governance controls for VS Code and Copilot CLI: device-level managed settings and enterprise-managed OpenTelemetry export.
The managed-settings release lets enterprise administrators push Copilot settings through native mobile device management, a file-based configuration, or a server-managed channel tied to the signed-in GitHub account. GitHub says the feature is generally available for Copilot CLI and VS Code.
The OpenTelemetry release lets organizations mandate where Copilot sends telemetry data. GitHub says the configuration applies to both the Copilot Chat extension in VS Code and the agent host process that powers Copilot CLI.
Together, the releases are a signal that coding agents are becoming part of enterprise endpoint management.
Admins get device-level control
GitHub’s managed-settings release gives admins three delivery channels.
Native MDM reads operating-system managed preferences: the Windows registry key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\GitHubCopilot or the macOS managed-preferences domain com.github.copilot. File-based settings come from platform-specific managed-settings.json locations. Server-managed settings resolve from an organization’s .github-private repository.
If more than one channel provides settings, GitHub says native MDM wins, then server-managed settings, then file-based settings.
The supported settings include permissions.disableBypassPermissionsMode, model, enabledPlugins, extraKnownMarketplaces, strictKnownMarketplaces, and telemetry.*.
That is not just configuration hygiene. It gives security and platform teams a way to control model choice, plugin availability, marketplace boundaries, and permission behavior across local agent sessions.
Telemetry becomes part of the agent rollout
The OpenTelemetry update is about where agent activity can be observed.
GitHub says administrators can control the OTLP export endpoint and protocol, service name, resource attributes, exporter headers, and whether prompt, response, and tool content is captured. Managed values override environment variables and user settings.
The security detail is important: managed exporter headers are applied only to the Copilot Chat extension’s OTLP exporter and are not passed through environment variables. That reduces the chance that an authentication token for the collector leaks into tool subprocesses spawned by the agent host.
This does not mean every organization should capture prompt and response content. It means GitHub is giving enterprises a governed way to decide and enforce that choice.
The local agent is no longer just local
GitHub’s June and early-July VS Code Copilot update points in the same direction. It added more agentic browser tooling, parallel sessions, clearer cost visibility, model-provider discovery, and Autopilot improvements.
Those features make agents more useful. They also make governance more complicated. A developer can run side-by-side sessions, delegate work, browse and validate web apps, inspect usage, and choose models or providers.
That workflow needs policy. It also needs logs that can help a team answer what happened when an agent changed code, called a tool, consumed budget, or touched sensitive context.
