Takeaway
On October 22, 2026, GitHub announced the start of global policy enforcement for Copilot Business and Enterprise features. Rollout continues through October 26, so the timing may differ between organizations.
This starts enforcement of a previously announced policy, rather than launching every Copilot feature. For a business with a development team, the practical step is to check which capabilities lack an explicit permission setting.
What changes
Eligible generally available features marked Unconfigured will inherit the global policy. Explicitly enabled or disabled features remain unchanged. Preview features remain opt-in.
The transition for unconfigured features is a one-time change: later changes to the global default do not overwrite individual policies already set. Switching one global setting after the transition may therefore be insufficient.
The documentation describes several enterprise-level policy states: enable everywhere, disable everywhere or delegate the decision to organizations. Check the actual selected value rather than assuming the same outcome for every team. The scope includes MCP servers in Copilot, but this does not automatically grant access to every external service: its own permissions need separate checks.
What to ask your administrator
Nadali’s suggested checking sequence:
- Establish whether the team uses Copilot Business or Enterprise and who manages its policies. If a contractor handles development, ask the person responsible to check that contractor’s working environment.
- Review AI Controls → Copilot → Default policy for new features and individual unconfigured features. Record actual settings and the inspection date.
- For unwanted capabilities, agree an explicit restriction with the responsible person rather than relying on a missing setting.
- After policy enforcement, recheck individual permissions against the agreed list. Do not assume changing the global value restored the previous state.
Illustrative example: an online shop owner asks the technical lead to check which AI features the website developers can use. This is a suggested scenario, not a verified case or a claim that a particular company’s access changed.
Verification limits
The rule does not cover every setting. For example, the documentation excludes storing local Copilot CLI and VS Code sessions in the cloud. Model availability also has a separate policy. Nadali verified the announcement of the October 22–26 rollout, not its completion in your account.
Nadali did not change settings or test access. The practical conclusion is to request evidence of the team’s specific policies rather than a general assurance that everything stayed the same.
Read also: how to organize an access review.
Author: Nadali. Prepared with AI. Sources rechecked on October 24, 2026.
Cover: an original conceptual AI-generated illustration, not an interface screenshot or evidence of testing.
