GitHub Copilot for JetBrains Gets Enterprise Admin Controls

GitHub has added enterprise managed settings to the GitHub Copilot plugin for JetBrains IDEs, announced on August 18, 2026. Administrators on an enterprise Copilot plan can now centrally control plugin availability, restrict or allow MCP servers (the protocol that lets AI agents connect to external tools), configure OpenTelemetry telemetry collection, and limit which agent permission modes developers can invoke. The update closes a governance gap that previously left JetBrains users outside the admin controls already available in other editors.

What happened

Setting area	Key detail
Plugin governance	Three controls: enabledPlugins, extraKnownMarketplaces, strictKnownMarketplaces
MCP server access	allowedMcpServers and deniedMcpServers fields for central allowlisting
OpenTelemetry	Admin values override developer settings; visible under Settings > Tools > GitHub Copilot > Chat > OpenTelemetry
Permission modes	permissions.disableBypassPermissionsMode disables Bypass Approvals and Autopilot

GitHub released enterprise managed settings for GitHub Copilot in JetBrains IDEs on August 18, 2026. The four areas covered are plugin governance, MCP server access, OpenTelemetry configuration, and agent permission modes.

Plugin governance

Admins now have three levers for managing plugins inside JetBrains IDEs. The enabledPlugins field forces a plugin on or off for all users. The extraKnownMarketplaces field makes additional approved plugin sources visible to developers. The strictKnownMarketplaces field goes further, restricting installation so only sources on the approved list are available.

MCP server allowlist

MCP (Model Context Protocol) servers let Copilot agents reach external data sources and tools. The new allowedMcpServers and deniedMcpServers settings give admins a centrally managed list of which servers developers can connect to from inside JetBrains. Connections to any server not on the allowlist are blocked.

Managed OpenTelemetry

OpenTelemetry is an open standard for collecting telemetry (traces, metrics, logs) from software. Admins can now set the collector endpoint, protocol, service name, resource attributes, and content-capture policy for Copilot in JetBrains. Critically, admin-supplied values take precedence over whatever a developer has set locally. Developers can check what is applied under Settings, then Tools, then GitHub Copilot, then Chat, then OpenTelemetry.

Organization-controlled permission modes

Setting permissions.disableBypassPermissionsMode to disable prevents the Copilot agent from running in either Bypass Approvals or Autopilot mode. These modes allow the agent to act with fewer confirmation steps, so blocking them keeps human review in the loop for sensitive workflows.

Why it matters

JetBrains IDEs (IntelliJ IDEA, PyCharm, GoLand, and the rest of the family) are widely used in enterprise Java, Kotlin, and Python teams. Before this update, IT and security teams deploying Copilot across those teams had limited ability to enforce a consistent security posture. A developer could connect Copilot to an unapproved MCP server, install plugins from unvetted marketplaces, or run the agent in Autopilot mode without any central oversight.

That gap is now closed for the settings listed above. This is particularly relevant for teams in regulated industries where data routing (who sees telemetry, which servers the agent calls) needs to be auditable.

For teams already thinking about AI integration across their dev toolchain, the MCP allowlist is the most practically important addition. It gives security teams a concrete control surface as MCP adoption grows.

Our take

This is a sensible, incremental update. The controls GitHub has added here are exactly what a cautious enterprise IT team would ask for before approving Copilot at scale inside JetBrains. Plugin governance and MCP allowlisting are not exciting features, but they are the kind of thing that turns a pilot into a company-wide rollout.

The one thing to watch: admin values silently overriding developer telemetry settings could cause confusion if a developer thinks their local OpenTelemetry config is in effect and it is not. The UI path (Settings, Tools, GitHub Copilot, Chat, OpenTelemetry) to review applied config is a good start, but teams should document what is being enforced and why.

If your business is evaluating AI coding tools and governance is a sticking point, this update makes Copilot a more defensible choice for JetBrains shops. We cover related developments in our AI news section as they land.

What to do about it

1. Update to the latest GitHub Copilot plugin version in your JetBrains IDE.
2. Review the enterprise managed settings reference in GitHub’s documentation to see which fields apply to your plan.
3. Audit which MCP servers your developers are currently connecting to, then build your allowedMcpServers and deniedMcpServers lists accordingly.
4. Decide whether Bypass Approvals and Autopilot modes are appropriate for your team and set permissions.disableBypassPermissionsMode if not.
5. Verify that telemetry is routing to the correct collector after setting managed OpenTelemetry values.

Start with the MCP allowlist. It is the highest-risk surface and the easiest to configure first.

Source: GitHub Changelog