Author: Nadali. Prepared using AI.
On October 28, GitHub released repository plugin defaults and enterprise rules in VS Code, Copilot CLI and the Copilot app. Trusted repositories can specify plugin installation and activation.
Who benefits
Business owners whose web systems are maintained by a team or contractor using Copilot. The practical question is who chooses the connected capabilities and whether an employee can change them.
Default does not mean mandatory
According to GitHub’s documentation, repository defaults can be disabled where the surface and policy allow a local choice. Enterprise settings take precedence: members cannot disable required plugins. Adding a plugin marketplace does not itself install its plugins.
A plugin can contain instructions, agents, event handlers or MCP configurations. Component support depends on the surface.
What to ask the responsible person
Our editorial checking sequence, not a test we conducted:
- Record plugins, their sources and the person responsible for each.
- Mark which were installed personally, specified by the project or required by enterprise policy.
- Check necessary connections and access to work data before using them for an actual customer task.
- Agree who reviews changes to the plugin set and whom to contact about an unwanted required component.
Availability and limits
Repository defaults are available to individual Copilot users and Business and Enterprise users. Enterprise-managed controls require GitHub Enterprise Cloud and a Copilot Business or Enterprise license issued by that enterprise or one of its organizations.
The takeaway: request a list of actually active plugins and the source of each rule. This is distinct from the global feature-availability policy.
Nadali has not changed settings or tested accounts or plugins. Sources read November 1, 2026. The cover is a reused AI illustration, not GitHub’s interface.
