GitHub Copilot App Gets Its Own Access Policy, Separate from Copilot CLI
GitHub now lets enterprise and org admins control Copilot app access independently from Copilot CLI, with three policy options in the AI Controls tab.
GitHub has split GitHub Copilot app access into its own policy, separate from the Copilot CLI policy that previously controlled it. Admins at the enterprise or organization level can now enable or disable the Copilot app independently, choosing from three options. The change is live now, defaulting to enabled everywhere, and the Copilot app joins Copilot CLI and VS Code as a fully supported client for enterprise-managed settings.
What happened
| Detail | Value |
|---|---|
| Change date | July 27, 2026 |
| Previous behaviour | Copilot app access tied to Copilot CLI policy |
| New behaviour | Copilot app has its own dedicated policy |
| Default setting | Enabled everywhere |
| Supported clients for enterprise-managed settings | Copilot app, Copilot CLI, VS Code |
| Policy location | Enterprise or org settings / AI Controls / Copilot Clients |
Until this week, enabling the GitHub Copilot app for your team required the Copilot CLI policy to be switched on. According to GitHub, customer feedback made clear that many teams want to control each client on its own terms. The new dedicated policy satisfies that request directly.
There are three settings to choose from:
- Enabled everywhere: all developers in the enterprise can use the app.
- Disabled everywhere: the app is blocked across the enterprise, and developers who try to open it see a notice that their admin has not enabled it.
- Let organizations decide: control passes to each individual organization’s admin.
Because the default is already set to Enabled everywhere, admins who are happy with the current state do not need to touch anything.
How the Copilot app actually works
When a developer uses the Copilot app, it runs agent sessions (AI-driven coding tasks) inside isolated workspaces. Any changes the agent makes land through pull requests, so your existing code review process, CI checks, and audit history all apply. Nothing bypasses the normal contribution workflow.
The app also now respects enterprise-managed settings. That means guardrails you have already defined, such as which plugins developers are allowed to use, apply consistently inside the Copilot app, the same way they do in Copilot CLI and VS Code.
Where to find the new policy
To review or update the setting, follow these steps:
- Open your enterprise or organization settings.
- Click the AI Controls tab.
- Navigate to the Copilot Clients section.
- Select the Copilot app policy row.
- Choose your preferred option and save.
Why it matters
The old setup created an awkward coupling: turning off Copilot CLI also cut off the Copilot app, and vice versa. That forced a binary choice that did not reflect how real teams are structured. Some developers need CLI access, others work exclusively in the app, and some should not have agentic coding tools at all. Separate policies let you reflect that reality.
The inclusion of the Copilot app in enterprise-managed settings is the more significant long-term change. It means policy drift, where the app behaves differently from other clients, is less likely. Security and compliance teams can set rules once and trust they hold across all three supported clients. That matters especially in regulated industries or any organisation running AI integration alongside strict governance requirements.
Our take
This is a small, sensible housekeeping update from GitHub. The coupling of the app policy to the CLI policy was a design shortcut that made sense early on but created real friction for larger teams. Separating them is the right call.
The more interesting signal here is GitHub continuing to build out enterprise governance for agentic AI tools. The isolated workspace plus pull-request model is the correct architecture for AI agents touching production code. It keeps humans in the loop at the review stage, which is exactly where oversight should sit. Teams evaluating AI coding tools should look carefully at whether other platforms offer the same audit trail before committing.
If you are already using GitHub Copilot in a managed enterprise setup, log in and confirm the policy reflects your intent. The default is permissive, so if your organisation has restrictions in place, this is worth a five-minute check. Our AI news coverage has more on how Copilot and other AI coding tools are evolving across the enterprise landscape.
Frequently asked questions
What is the default setting for the new GitHub Copilot app policy?
The policy defaults to Enabled everywhere, meaning developers can use the Copilot app immediately without any admin action required.
Is the GitHub Copilot app policy separate from the Copilot CLI policy now?
Yes. As of July 27, 2026, the Copilot app has its own dedicated policy. Previously, its access depended on the Copilot CLI policy being enabled.
Where do I find the Copilot app policy in GitHub settings?
Go to your enterprise or organization settings, open the AI Controls tab, then navigate to the Copilot Clients section to find and update the Copilot app policy.
What happens when a developer uses the GitHub Copilot app?
The app runs agent sessions inside isolated workspaces, and any code changes are submitted through pull requests, so normal code review, CI checks, and audit history all apply.
