From 08de4578db38dee854832980bc8ff73ce6b063ec Mon Sep 17 00:00:00 2001 From: Sameen Karim Date: Mon, 7 Sep 2026 06:38:12 +0000 Subject: [PATCH 1/8] Update gh-stack CLI docs for v0.1.1 (#63061) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com> Copilot-Session: dabd63a8-35af-4e83-be87-3451133580b3 --- content/pull-requests/reference/stacked-prs-cli-commands.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/pull-requests/reference/stacked-prs-cli-commands.md b/content/pull-requests/reference/stacked-prs-cli-commands.md index f4a0a9fd3a18..1aa14b17e040 100644 --- a/content/pull-requests/reference/stacked-prs-cli-commands.md +++ b/content/pull-requests/reference/stacked-prs-cli-commands.md @@ -141,7 +141,7 @@ View the current stack. gh stack view [flags] ``` -Shows all branches in the stack, their ordering, pull request links, and the most recent commit with a relative timestamp. Output is piped through a pager, which respects `GIT_PAGER` or `PAGER`, and defaults to `less -R`. +Shows all branches in the stack, their ordering, pull request links, and the most recent commit with a relative timestamp. By default, the command opens a full-screen view in an interactive terminal and prints static output in a non-interactive terminal. The `--short` and `--json` flags print directly to standard output in either environment. | Flag | Description | |------|-------------| @@ -308,7 +308,7 @@ If every pull request in the stack has already been merged, that stack is comple In an interactive terminal, `submit` opens a full-screen editor on a single screen. * **Left panel.** Every branch without a pull request is included by default. Deselect any you do not want to submit with Ctrl+X. Because each pull request builds on the branch below it, deselecting a branch also deselects the ones stacked above it, and re-including a branch re-includes the ones below it that it depends on. Branches that already have a pull request, whether open, draft, queued, or merged, are shown for context but are locked. Edit those on the web. -* **Right panel.** For the focused branch, draft the title and description, and choose whether the pull request opens ready for review or as a draft. The description is pre-filled from your repository's pull request template or commits, with a markdown preview and an `$EDITOR` escape. Focusing a locked branch shows a read-only card with a link to its pull request. Press o to open it in the browser. +* **Right panel.** For the focused branch, draft the title and description, and choose whether the pull request opens ready for review or as a draft. The description is pre-filled from your repository's pull request template or commits, with a markdown preview. To edit the description in an external editor, press Ctrl+E. The extension uses the first nonempty value from the `GH_EDITOR`, `VISUAL`, and `EDITOR` environment variables, in that order. If none is set, it uses `vi` if available on your `PATH`. Focusing a locked branch shows a read-only card with a link to its pull request. Press o to open it in the browser. Press Ctrl+S to submit all included pull requests at once. The editor supports both keyboard and mouse input. Pass `--auto`, or run the command in a non-interactive terminal such as CI, to skip the editor and use automatically generated titles. From 86cbee1f55c4890ff2091147ff00a5e7d7443245 Mon Sep 17 00:00:00 2001 From: hubwriter Date: Mon, 7 Sep 2026 08:23:55 +0000 Subject: [PATCH 2/8] [AUTOMATED] Copilot CLI: Update core interactive usage articles (#63043) --- .../concepts/agents/copilot-cli/cancel-and-roll-back.md | 9 ++++----- .../copilot/concepts/agents/copilot-cli/tool-search.md | 2 +- .../how-tos/copilot-cli/use-copilot-cli/overview.md | 4 ++-- .../use-copilot-cli/speed-up-task-completion.md | 2 +- 4 files changed, 8 insertions(+), 9 deletions(-) diff --git a/content/copilot/concepts/agents/copilot-cli/cancel-and-roll-back.md b/content/copilot/concepts/agents/copilot-cli/cancel-and-roll-back.md index 9fdabfeb4498..c38d4c0bca9e 100644 --- a/content/copilot/concepts/agents/copilot-cli/cancel-and-roll-back.md +++ b/content/copilot/concepts/agents/copilot-cli/cancel-and-roll-back.md @@ -17,7 +17,7 @@ category: When you work in an interactive {% data variables.copilot.copilot_cli_short %} session, you can press Esc or Ctrl+C to control what {% data variables.product.prodname_copilot_short %} is doing. Both keypresses can cancel operations, but they work slightly differently: * Ctrl+C acts immediately, without a confirming second press—removing any queued prompts first (one per press), then canceling the current operation. -* A single Esc keypress gives you more gradual, staged control. While {% data variables.product.prodname_copilot_short %} is actively working, a single Esc doesn't cancel right away—it shows a reminder, and a second press carries out the next step: removing the most recently queued prompt, or canceling the operation once nothing is queued. +* A single Esc keypress gives you more gradual, staged control. While {% data variables.product.prodname_copilot_short %} is actively working, a single Esc doesn't cancel right away—it shows a reminder, and a second press interrupts the current operation. In a local session, any queued prompts are then processed as the next turn. In a remote-backed or attached session, the second press fully cancels the operation instead, and queued prompts are not carried over to a follow-up turn. If {% data variables.product.prodname_copilot_short %} has already made changes and you want to undo them, you can roll back to a previous point in the session. As {% data variables.product.prodname_copilot_short %} works, {% data variables.copilot.copilot_cli_short %} tracks the file changes it makes as it responds to each prompt. This lets you rewind to an earlier point by pressing Esc twice when {% data variables.product.prodname_copilot_short %} is idle and the input area is empty. When you rewind, you choose whether to rewind the conversation only, or to also restore the files that {% data variables.product.prodname_copilot_short %} changed. @@ -28,18 +28,17 @@ Pressing Esc once performs different actions depending on the current | Current state | What pressing Esc does | | ------------- | --------------------------------- | | {% data variables.product.prodname_copilot_short %} is active with no queued prompts. | Shows an "Esc again to cancel" reminder. The running operation is canceled only if you press Esc again within half a second. | -| {% data variables.product.prodname_copilot_short %} is active and there are queued prompts. | Shows the "Esc again to cancel" reminder. Pressing Esc again removes the most recently queued prompt. | +| {% data variables.product.prodname_copilot_short %} is active and there are queued prompts. | Shows the "Esc again to cancel" reminder. Pressing Esc again interrupts the current operation. In a local session, the queued prompts are then processed as the next turn; in a remote-backed or attached session, the operation is fully canceled and the queued prompts are not run as a follow-up turn. | | A permission dialog is open. | A single Esc denies the pending request (no second press needed). | | A dialog, overlay, or picker is open. | Closes the dialog, overlay, or picker. | | {% data variables.product.prodname_copilot_short %} is idle. | Shows a brief reminder that pressing Esc again quickly will open the rewind picker. See [Rolling back changes](#rolling-back-changes). | -Pressing Esc twice quickly, when {% data variables.product.prodname_copilot_short %} is idle, allows you to roll back to an earlier point in the session. If an operation is in progress, a double Esc does one of the following, in this order of priority: +Pressing Esc twice quickly, when {% data variables.product.prodname_copilot_short %} is idle and the input area is empty, allows you to roll back to an earlier point in the session. In other situations, a double Esc does one of the following, in this order of priority: * Cancels a running shell command. * Stops the current response. * Stops background agents. * Clears text in the input area. -* Exits shell mode. If none of these applies, the rewind picker is displayed. @@ -47,7 +46,7 @@ If none of these applies, the rewind picker is displayed. The main difference between these two ways of canceling an operation is that Esc is designed for gradual, targeted intervention, while Ctrl+C is a hard stop. -Use Esc when you want to interact with {% data variables.product.prodname_copilot_short %} without necessarily ending the current operation. For example, if a permission dialog appears and you want to deny that specific request, pressing Esc dismisses the dialog and {% data variables.product.prodname_copilot_short %} continues working—it just won't use the tool you denied. Similarly, if you've queued follow-up prompts and want to cancel them without interrupting the work already in progress, pressing Esc removes the most recently queued prompt (repeat to remove earlier ones), while the current operation keeps running. +Use Esc when you want a confirming keypress before interrupting an operation. If a permission dialog appears and you want to deny that specific request, pressing Esc once rejects the request and stops the current operation. If you've queued follow-up prompts in a local session, pressing Esc twice interrupts the current operation and processes the queued prompts as the next turn. In a remote-backed or attached session, pressing Esc twice fully cancels the operation instead, and queued prompts are not run as a follow-up turn. Use Ctrl+C when you want to cancel without the confirming second press that Esc requires. If no prompts are queued, a single Ctrl+C immediately cancels the active operation. If you have queued prompts, each Ctrl+C removes the most recently queued prompt—one per press—and cancels the active operation only once the queue is empty. Any file write that is already in progress will complete—files are not left corrupted mid-write—but any remaining planned changes are abandoned. Pressing Ctrl+C a second time within two seconds, when the input area is empty, exits the session entirely. diff --git a/content/copilot/concepts/agents/copilot-cli/tool-search.md b/content/copilot/concepts/agents/copilot-cli/tool-search.md index e759b1bea0ae..aca6aaa7d03a 100644 --- a/content/copilot/concepts/agents/copilot-cli/tool-search.md +++ b/content/copilot/concepts/agents/copilot-cli/tool-search.md @@ -47,7 +47,7 @@ Tool search is enabled by default and activates automatically whenever you're on | Family | Supported versions | | ------ | ------------------ | -| Claude (Anthropic) | Mythos Preview, Fable, Sonnet 4.0+, Opus 4.0+ (not Haiku) | +| Claude (Anthropic) | Mythos Preview, Fable, Haiku 4.5+, Sonnet 4.0+, Opus 4.0+ | | GPT (OpenAI) | GPT-5.4 and later | On any other model, all tools are loaded up front. diff --git a/content/copilot/how-tos/copilot-cli/use-copilot-cli/overview.md b/content/copilot/how-tos/copilot-cli/use-copilot-cli/overview.md index d8f7740f27e4..47e3188f571d 100644 --- a/content/copilot/how-tos/copilot-cli/use-copilot-cli/overview.md +++ b/content/copilot/how-tos/copilot-cli/use-copilot-cli/overview.md @@ -83,7 +83,7 @@ Optimize your experience with {% data variables.copilot.copilot_cli_short %} wit ### Stop a currently running operation -If you enter a prompt and then decide you want to stop {% data variables.product.prodname_copilot_short %} from completing the task while it is still "Thinking," press Esc. +If you enter a prompt and then decide you want to stop {% data variables.product.prodname_copilot_short %} from completing the task while it is still "Thinking," press Esc twice within half a second. ### Use plan mode @@ -305,7 +305,7 @@ Details of your configured MCP servers are stored in the `mcp-config.json` file, * `/context`: Provides a visual overview of your current token usage * `/compact`: Manually compresses your conversation history to free up context space -{% data variables.copilot.copilot_cli %} automatically compresses your history in the background when your conversation approaches 95% of the token limit, without interrupting your workflow. +{% data variables.copilot.copilot_cli %} automatically starts compressing your history in the background when your conversation approaches 80% of the token limit. This starting point is dynamic: when static context—your system messages and tool definitions—already uses a large share of the limit (roughly 75% or more), {% data variables.product.prodname_copilot_short %} waits until usage is closer to 90% before compacting, because compressing the conversation reclaims less space in that situation. If usage reaches approximately 95% before background compaction has finished, the CLI waits for it to complete before continuing. ### Enable all permissions diff --git a/content/copilot/how-tos/copilot-cli/use-copilot-cli/speed-up-task-completion.md b/content/copilot/how-tos/copilot-cli/use-copilot-cli/speed-up-task-completion.md index 4ec9c9a19068..d6362a0e34cb 100644 --- a/content/copilot/how-tos/copilot-cli/use-copilot-cli/speed-up-task-completion.md +++ b/content/copilot/how-tos/copilot-cli/use-copilot-cli/speed-up-task-completion.md @@ -42,7 +42,7 @@ Use the `/tasks` slash command to see a list of background tasks relating to the Use up and down keyboard keys to navigate through the list of background tasks. For each subagent task, you can: * Press Enter to view details. When the subtask is complete, you will see a summary of what was done. -* Press k to kill the process. +* Press x to kill the process. * Press r to remove completed or killed subtasks from the list. Press Esc to exit the task list and return to the main CLI prompt. From af93e994eb401fee617bf693cdb1d1b02944ef55 Mon Sep 17 00:00:00 2001 From: chaitra pula <168718308+Chaitrapula@users.noreply.github.com> Date: Mon, 7 Sep 2026 08:24:10 +0000 Subject: [PATCH 3/8] Clarify required signatures squash merges (#63044) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com> Copilot-Session: 1898d4d0-0fd5-43be-b7d1-c219df680cbe --- .../about-protected-branches.md | 4 +--- .../available-rules-for-rulesets.md | 4 +--- .../repositories/required-signed-commits.md | 17 +++++++++++++++++ 3 files changed, 19 insertions(+), 6 deletions(-) create mode 100644 data/reusables/repositories/required-signed-commits.md diff --git a/content/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches.md b/content/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches.md index 5b9c9f4ed704..1f384252d3ee 100644 --- a/content/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches.md +++ b/content/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches.md @@ -126,9 +126,7 @@ When you enable required commit signing on a branch, contributors {% ifversion f > If a collaborator pushes an unsigned commit to a branch that requires commit signatures, the collaborator will need to rebase the commit to include a verified signature, then force push the rewritten commit to the branch. {% endif %} -You can always push local commits to the branch if the commits are signed and verified. {% ifversion fpt or ghec %}You can also merge signed and verified commits into the branch using a pull request. However, you cannot squash and merge a pull request into the branch on {% data variables.product.github %} unless you are the author of the pull request.{% else %} However, you cannot merge pull requests into the branch on {% data variables.product.github %}.{% endif %} You can {% ifversion fpt or ghec %}squash and {% endif %}merge pull requests locally. For more information, see [AUTOTITLE](/pull-requests/how-tos/review-pull-requests/checking-out-pull-requests-locally). - -{% ifversion fpt or ghec %} For more information about merge methods, see [AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/about-merge-methods-on-github).{% endif %} +{% data reusables.repositories.required-signed-commits %} ### Require linear history diff --git a/content/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets.md b/content/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets.md index a0bef0a6bcba..8866e5313c2d 100644 --- a/content/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets.md +++ b/content/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets.md @@ -96,9 +96,7 @@ With both methods, we use the `verified_signature?` to confirm if a commit has a {% endif %} -You can always push local commits to the branch if the commits are signed and verified. {% ifversion fpt or ghec %}You can also merge signed and verified commits into the branch using a pull request. However, you cannot squash and merge a pull request into the branch on {% data variables.product.github %} unless you are the author of the pull request.{% else %} However, you cannot merge pull requests into the branch on {% data variables.product.github %}.{% endif %} You can {% ifversion fpt or ghec %}squash and {% endif %}merge pull requests locally. For more information, see [AUTOTITLE](/pull-requests/how-tos/review-pull-requests/checking-out-pull-requests-locally). - -{% ifversion fpt or ghec %} For more information about merge methods, see [AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/about-merge-methods-on-github).{% endif %} +{% data reusables.repositories.required-signed-commits %} ## Require a pull request before merging diff --git a/data/reusables/repositories/required-signed-commits.md b/data/reusables/repositories/required-signed-commits.md new file mode 100644 index 000000000000..75fda49bccd7 --- /dev/null +++ b/data/reusables/repositories/required-signed-commits.md @@ -0,0 +1,17 @@ +You can push local commits to the branch if the commits are signed and verified. + +{% ifversion fpt or ghec %} + +You can also merge signed and verified commits into the branch using a pull request. When {% data variables.product.github %} evaluates whether a pull request can be merged, it creates a test merge commit whose parents are the latest commit on the base branch and the pull request's head commit. {% data variables.product.github %} checks the commits introduced by this test merge, including commits from the head branch. As a result, unsigned commits on the head branch can block a squash merge, even though {% data variables.product.github %} would sign the final squash commit. This restriction can also apply to the author of the pull request. + +To merge a blocked pull request, rewrite and sign the unsigned commits on the head branch, or ask someone with permission to bypass the applicable protections to merge the pull request. + +{% else %} + +However, you cannot merge pull requests into the branch on {% data variables.product.github %}. + +{% endif %} + +You can {% ifversion fpt or ghec %}squash and {% endif %}merge pull requests locally, but you must sign the resulting commit before pushing it to the branch. If another protection requires changes to be made through a pull request, you may also need bypass permissions to push the locally merged commit. See [AUTOTITLE](/pull-requests/how-tos/review-pull-requests/checking-out-pull-requests-locally) and [AUTOTITLE](/authentication/managing-commit-signature-verification/signing-commits). + +{% ifversion fpt or ghec %} For more information about merge methods, see [AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/about-merge-methods-on-github).{% endif %} From 037dfaab6c6a2b2e45773dd890065ef81509d0f1 Mon Sep 17 00:00:00 2001 From: docs-bot <77750099+docs-bot@users.noreply.github.com> Date: Mon, 7 Sep 2026 08:30:33 +0000 Subject: [PATCH 4/8] Copilot CLI: Update automation and CI articles (#63102) Co-authored-by: github-actions[bot] Co-authored-by: hubwriter Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../copilot-cli/automate-copilot-cli/schedule-prompts.md | 2 +- .../copilot/how-tos/copilot-cli/use-copilot-cli-in-actions.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/copilot/how-tos/copilot-cli/automate-copilot-cli/schedule-prompts.md b/content/copilot/how-tos/copilot-cli/automate-copilot-cli/schedule-prompts.md index d7b699f687cd..820670f89949 100644 --- a/content/copilot/how-tos/copilot-cli/automate-copilot-cli/schedule-prompts.md +++ b/content/copilot/how-tos/copilot-cli/automate-copilot-cli/schedule-prompts.md @@ -108,7 +108,7 @@ You can use the ID to cancel the schedule. For example, by entering `stop prompt To list the active schedules for the current session, type `/every` or `/after` with no arguments. -To delete a schedule, use the arrow keys on your keyboard to move through the list and select the schedule you want to delete, then press d. +To delete a schedule, use the arrow keys on your keyboard to move through the list and select the schedule you want to delete, then press x. Press Esc to exit the schedule list. diff --git a/content/copilot/how-tos/copilot-cli/use-copilot-cli-in-actions.md b/content/copilot/how-tos/copilot-cli/use-copilot-cli-in-actions.md index d4aaa75901c6..45e3320c7024 100644 --- a/content/copilot/how-tos/copilot-cli/use-copilot-cli-in-actions.md +++ b/content/copilot/how-tos/copilot-cli/use-copilot-cli-in-actions.md @@ -60,7 +60,7 @@ jobs: Key details about this example: -* The `--yolo` flag suppresses interactive prompts, which is required for non-interactive environments like {% data variables.product.prodname_actions %}. +* The `--yolo` flag automatically approves all tool, path, and URL permission requests. Non-interactive (`-p`) runs can't display an interactive approval prompt, so any action that isn't pre-approved is denied automatically. To grant only the permissions the task needs, use narrower options such as `--allow-tool`, `--add-dir`, and `--allow-url` instead. * The `copilot-requests: write` permission is required for the workflow to make {% data variables.product.prodname_copilot_short %} requests. * The `GITHUB_TOKEN` provided by {% data variables.product.prodname_actions %} handles authentication automatically, no additional secrets are needed. From 4aa30882aaea7927d8b642db1e2e7a808f183a83 Mon Sep 17 00:00:00 2001 From: hubwriter Date: Mon, 7 Sep 2026 09:25:05 +0000 Subject: [PATCH 5/8] Fix Copilot CLI OTel attribute docs (#63017) --- .../copilot-cli-reference/cli-command-reference.md | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/content/copilot/reference/copilot-cli-reference/cli-command-reference.md b/content/copilot/reference/copilot-cli-reference/cli-command-reference.md index 358580e14e88..6607071e68b7 100644 --- a/content/copilot/reference/copilot-cli-reference/cli-command-reference.md +++ b/content/copilot/reference/copilot-cli-reference/cli-command-reference.md @@ -1496,8 +1496,8 @@ Wraps the entire agent invocation: all LLM calls and tool executions for one use | `gen_ai.usage.cache_read.input_tokens` | Cached input tokens read | Both | | `gen_ai.usage.cache_creation.input_tokens` | Cached input tokens created | Both | | `github.copilot.turn_count` | Number of LLM round-trips | Both | -| `github.copilot.cost` | Monetary cost | Both | -| `github.copilot.aiu` | AI units consumed | Both | +| `github.copilot.cost` | Per-request model multiplier used for billing. **Not a monetary value.** | Both | +| `github.copilot.nano_aiu` | AI units consumed, in nano AI units (1 AIU = 1,000,000,000 nano AIU) | Both | | `server.address` | Server hostname | Top-level only | | `server.port` | Server port | Top-level only | | `error.type` | Error class name (on error) | Both | @@ -1525,8 +1525,8 @@ One span per LLM request. Span kind: `CLIENT`. | `gen_ai.usage.cache_read.input_tokens` | Cached tokens read | | `gen_ai.usage.input_tokens` | Input tokens this turn | | `gen_ai.usage.output_tokens` | Output tokens this turn | -| `github.copilot.cost` | Turn cost | -| `github.copilot.aiu` | AI units consumed this turn | +| `github.copilot.cost` | Per-request model multiplier used for billing. **Not a monetary value.** | +| `github.copilot.nano_aiu` | AI units consumed this turn, in nano AI units (1 AIU = 1,000,000,000 nano AIU) | | `github.copilot.server_duration` | Server-side duration | | `github.copilot.initiator` | Request initiator | | `github.copilot.turn_id` | Turn identifier | @@ -1554,6 +1554,9 @@ One span per tool call. Span kind: `INTERNAL`. | `gen_ai.tool.call.arguments` | Tool input arguments as JSON (content capture only) | | `gen_ai.tool.call.result` | Tool output as JSON (content capture only) | +> [!NOTE] +> To measure AI unit consumption, read `github.copilot.nano_aiu` from the root `invoke_agent` span only. The attribute is also stamped on the child `chat` spans, so summing it across every span double-counts. `github.copilot.cost` is a per-request model multiplier used for billing calculations—it is not a currency value and must not be interpreted as one. + ### Metrics #### GenAI convention metrics @@ -1564,6 +1567,7 @@ One span per tool call. Span kind: `INTERNAL`. | `gen_ai.client.token.usage` | Histogram | tokens | Token counts by type (`input`/`output`) | | `gen_ai.client.operation.time_to_first_chunk` | Histogram | s | Time to receive first streaming chunk | | `gen_ai.client.operation.time_per_output_chunk` | Histogram | s | Inter-chunk latency after first chunk | +| `gen_ai.invoke_agent.duration` | Histogram | s | End-to-end duration of one agent invocation | | `gen_ai.invoke_agent.inference_calls` | Histogram | `{inference_call}` | Number of model calls made during one agent invocation, counted at provider dispatch (failed and partial calls included; requests blocked before dispatch excluded). Dimension: `gen_ai.agent.name`. | | `gen_ai.invoke_agent.tool_calls` | Histogram | `{tool_call}` | Number of client-side tool calls made during one agent invocation (failed and partial calls included; synthetic CLI tool lifecycles and provider-executed server-side tools excluded). Dimension: `gen_ai.agent.name`. | From cac8130bad3a5ba43b4e8c30dac3413aac922ad1 Mon Sep 17 00:00:00 2001 From: Isaac Brown <101839405+isaacmbrown@users.noreply.github.com> Date: Mon, 7 Sep 2026 09:34:31 +0000 Subject: [PATCH 6/8] Reorganize the managed settings docs (#62949) Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../manage-for-enterprise/index.md | 1 + .../configure-enterprise-managed-settings.md | 185 ------------------ .../manage-agents/index.md | 1 - .../copilot-business-only.md | 39 ++++ .../deploy-managed-settings.md | 106 ++++++++++ .../use-managed-settings/get-started.md | 122 ++++++++++++ .../use-managed-settings/index.md | 13 ++ .../override-settings-for-teams.md | 83 ++++++++ .../enterprise-managed-settings.md | 23 +-- .../enterprise-team-overrides-structure.md | 8 + 10 files changed, 373 insertions(+), 208 deletions(-) delete mode 100644 content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/configure-enterprise-managed-settings.md create mode 100644 content/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/copilot-business-only.md create mode 100644 content/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/deploy-managed-settings.md create mode 100644 content/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/get-started.md create mode 100644 content/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/index.md create mode 100644 content/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/override-settings-for-teams.md create mode 100644 data/reusables/copilot/policy/enterprise-team-overrides-structure.md diff --git a/content/copilot/how-tos/administer-copilot/manage-for-enterprise/index.md b/content/copilot/how-tos/administer-copilot/manage-for-enterprise/index.md index 75599766b836..4a9826abbd03 100644 --- a/content/copilot/how-tos/administer-copilot/manage-for-enterprise/index.md +++ b/content/copilot/how-tos/administer-copilot/manage-for-enterprise/index.md @@ -8,6 +8,7 @@ children: - /manage-plan - /manage-access - /manage-enterprise-policies + - /use-managed-settings - /manage-agents - /manage-availability-of-default-models - /enable-custom-models diff --git a/content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/configure-enterprise-managed-settings.md b/content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/configure-enterprise-managed-settings.md deleted file mode 100644 index 780822710507..000000000000 --- a/content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/configure-enterprise-managed-settings.md +++ /dev/null @@ -1,185 +0,0 @@ ---- -title: Configuring enterprise-managed settings -shortTitle: Enterprise managed settings -allowTitleToDifferFromFilename: true -intro: Configure enterprise managed settings to centrally control {% data variables.product.prodname_copilot_short %} client behavior across your enterprise using server-managed, MDM-managed, or file-based deployment. -permissions: Enterprise owners -redirect_from: - - /copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/disable-automatic-commands - - /copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/configure-enterprise-plugin-standards -versions: - feature: copilot -contentType: how-tos -category: - - Configure Copilot - - Manage Copilot for a team ---- - -With enterprise managed settings, enterprise owners can centrally define and distribute configuration settings to supported clients for users on your enterprise's {% data variables.product.prodname_copilot_short %} plan, ensuring every member works within the guardrails you define, while letting teams tailor the settings you allow. - -The following clients are supported, although not every client supports every property: - -* {% data variables.copilot.copilot_cli_short %} -* {% data variables.product.prodname_vscode_shortname %} -* {% data variables.product.prodname_jetbrains_ides %} -* The {% data variables.copilot.github_copilot_app %} -* {% data variables.copilot.copilot_cloud_agent %} -* {% data variables.product.prodname_jetbrains_ides %} - -These settings apply enterprise-wide and enterprises can customize specific keys to enterprise teams. For most supported keys, the `{% data variables.copilot.managed_setting_file %}` value takes precedence over any file-based configuration a user sets in their client. In {% data variables.copilot.copilot_cli_short %}, managed `sandbox` settings instead define minimum restrictions that users can further tighten but cannot loosen. - -MDM-managed and file-based settings are loaded from the device, so they can apply before sign in or a server round trip and remain active when users switch accounts. Server-managed settings are associated with the user's signed-in account. - -## Defining settings - -For detailed information on the available properties and syntax, see [AUTOTITLE](/copilot/reference/enterprise-administrators/enterprise-managed-settings). - -Use `copilot/{% data variables.copilot.team_mappings_file %}` and the `copilot/{% data variables.copilot.team_settings_directory %}` directory when you need one or more enterprise teams to use settings that differ from the defaults in `copilot/{% data variables.copilot.managed_setting_file %}`. For more information, see [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/configure-enterprise-managed-settings#overriding-settings-for-specific-teams). - -## Choosing a deployment method - -There are multiple ways to deploy enterprise managed settings. Use the following guidelines to choose the right method for you. For any method, pilot on a small device group before broad deployment. - -* **Server-managed**: Default for most enterprises and best for review workflows and audit history. Applies to all clients, including {% data variables.copilot.copilot_cloud_agent %}. -* **MDM-managed**: Best when IT teams need device-group targeting through existing MDM tooling on macOS and Windows. Local clients only. -* **File-based**: Available on all platforms, and useful when server-managed and MDM-managed deployment are not available, including developer environments such as containers and {% data variables.product.prodname_codespaces %}. Local clients only. - -In {% data variables.copilot.copilot_cli_short %}, if a request for server-managed settings fails and no cached response is available, the server-managed policy is unavailable for that session. For restrictions that must remain available without a server response, use MDM-managed or file-based settings. - -There are additional considerations if you use a dedicated enterprise for {% data variables.copilot.copilot_business_short %}. See [Guidance for dedicated {% data variables.copilot.copilot_business_short %} enterprises](#guidance-for-dedicated-copilot-business-enterprises). - -## Deploying server-managed settings - -1. Create and configure your `.github-private` repository. See [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/create-github-private-repo). -1. In the repository, create or update `copilot/{% data variables.copilot.managed_setting_file %}`. -1. Add your enterprise policy keys and values in JSON format. -1. Commit and push your changes to the default branch. -1. Confirm that enterprise users are running a supported client. Updated settings are applied automatically within about an hour. Restarting the client or signing in again triggers an immediate refresh. - -## Overriding settings for specific teams - -For server-managed deployments, use `copilot/{% data variables.copilot.team_mappings_file %}` and the `copilot/{% data variables.copilot.team_settings_directory %}` directory when one or more enterprise teams should use settings that differ from your default `copilot/{% data variables.copilot.managed_setting_file %}` values. `enabledPlugins` and `extraKnownMarketplaces` work additively. The enterprise `{% data variables.copilot.managed_setting_file %}` sets a baseline, and an enterprise team file can add more plugins and marketplaces on top of it. - -1. In your enterprise's `copilot/{% data variables.copilot.managed_setting_file %}` file, mark each key you want to make eligible for override using the `{ "overridable": }` syntax. The `json` files you map to teams can only send different values for keys you mark overridable. An `overridable` value you provide in `managed-settings.json` is the default when teams files do not declare a different value for a given key. -For example, to defer both `model` and `disableBypassPermissionsMode`: - - ```json - { - "model": { "overridable": "auto" }, - "permissions": { - "disableBypassPermissionsMode": { "overridable": "disable" } - }, - "allowedMcpServers": { - "overridable": [ - { "serverUrl": "https://mcp.company.com/*" } - ] - } - } - ``` - -1. In your enterprise's `.github-private` repository, create `copilot/{% data variables.copilot.team_mappings_file %}`. Map each team settings file to one or more enterprise team slugs. The key is the settings file name and the value is an array of team slugs, so you can apply one file across multiple teams. - - ```json - { - "devs.json": ["developers-all", "finops-dev"], - "ai-users.json": ["ai-baseline-trained"], - "frontier.json": ["ai-pioneers"] - } - ``` - -1. Create the team settings file under `copilot/{% data variables.copilot.team_settings_directory %}`. You can include any keys you marked as overridable, plus the additive keys `enabledPlugins` and `extraKnownMarketplaces`. Every other key stays governed by your enterprise default. - - ```json - { - "model": "unmanaged", - "permissions": { - "disableBypassPermissionsMode": "unmanaged" - }, - "allowedMcpServers": [ - { "serverUrl": "https://team-specific-mcp.company.com/*" } - ] - } - ``` - -1. Commit and push your changes to the default branch. - -{% data variables.product.prodname_dotcom %} evaluates enterprise team membership and applies matching settings for each person. If a user belongs to multiple teams, their team files are combined using the least restrictive value for each key, then applied beneath the enterprise settings, where platform decisions always win. - -## Deploying MDM-managed settings - -Native MDM delivery uses the same logical keys and values as server-managed settings, but it does not deploy a `{% data variables.copilot.managed_setting_file %}` file. Instead, your MDM platform deploys individual settings as operating-system-managed string values. - -Native MDM delivery is available on Windows and macOS: - -| Operating system | Native policy location | -| --- | --- | -| Windows | String (`REG_SZ`) values under `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\GitHubCopilot` | -| macOS | String values in forced managed preferences for the `com.github.copilot` preference domain | -| Linux | Native MDM delivery is not supported. Use file-based settings instead. | - -All native MDM values must be strings. For nested settings, use a dot-separated key such as `permissions.disableBypassPermissionsMode` or `sandbox.enabled`. Store ordinary string values directly. Store booleans, arrays, and objects as JSON text within a string value. - -For example: - -| Key | Native string value | -| --- | --- | -| `permissions.disableBypassPermissionsMode` | `disable` | -| `sandbox.enabled` | `true` | -| `enabledPlugins` | `{"PLUGIN-NAME@MARKETPLACE-NAME":true}` | - -1. Choose the settings you want to enforce. See [AUTOTITLE](/copilot/reference/enterprise-administrators/enterprise-managed-settings). -1. Convert each setting to the native key and string value representation. -1. Deploy the settings to the native policy location using your enterprise MDM platform and standard rollout process. -1. Assign the policy to the target device groups. - - Clients do not need to restart, and check for updated policies on an hourly basis. In {% data variables.product.prodname_vscode_shortname %}, an administrator can force a check for testing by running the `Developer: Sync Account Policy` command. - -1. Confirm the settings took effect. See [Verifying the configuration has applied](#verifying-the-configuration-has-applied). - -## Deploying file-based settings - -Place `{% data variables.copilot.managed_setting_file %}` in the following location: - -| Operating system | File location | -| --- | --- | -| macOS | `/Library/Application Support/GitHubCopilot/managed-settings.json` | -| Windows | `%ProgramFiles%\GitHubCopilot\managed-settings.json` | -| Linux | `/etc/github-copilot/managed-settings.json` | - -1. Create or update a `{% data variables.copilot.managed_setting_file %}` file with the policy keys and values you want to enforce. -1. Distribute the file to the platform-specific location using your standard device management process. Machines that don't receive the file are not restricted by this policy. -1. For {% data variables.copilot.copilot_cli_short %} on macOS and Linux, make the file a regular file owned by `root`, and ensure it is not group-writable or world-writable. Do not use a symbolic link. The CLI rejects files that do not meet these requirements. -1. Ask users to restart supported clients so the updated policy is loaded at startup. -1. Confirm the settings took effect. See [Verifying the configuration has applied](#verifying-the-configuration-has-applied). - -## Verifying the configuration has applied - -For server-managed deployments, users on a supported client see the specified settings within about an hour. This includes `copilot/{% data variables.copilot.managed_setting_file %}`, `copilot/{% data variables.copilot.team_mappings_file %}`, and files in `copilot/{% data variables.copilot.team_settings_directory %}`. Restarting the client or signing in again triggers an immediate refresh. - -For MDM-managed deployments, clients check for updated policies hourly. For file-based deployments, restart the client to load an updated file. - -If a user does not see these settings, ensure they receive access to {% data variables.product.prodname_copilot_short %} through your enterprise or one of its organizations. If a user receives a license from multiple billing entities, ensure they have selected your enterprise in the "Usage billed to" dropdown in their [personal {% data variables.product.prodname_copilot_short %} settings](https://github.com/settings/copilot/features). - -## Guidance for dedicated {% data variables.copilot.copilot_business_short %} enterprises - -If you have a dedicated enterprise for {% data variables.copilot.copilot_business_short %} (sometimes called {% data variables.product.prodname_copilot_short %} Standalone), you can still use enterprise managed settings. The deployment method you choose determines what you need to set up first. - -### Using server-managed settings - -Server-managed settings require an organization and a `.github-private` repository. To create these, one user in your enterprise needs a {% data variables.product.prodname_enterprise %} license. With that license, the user can: - -1. Create an organization and a `.github-private` repository. See [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/create-github-private-repo). -1. Add settings to the repository in a `copilot/{% data variables.copilot.managed_setting_file %}` file. -1. Set that organization as the source of governance for your enterprise's AI standards. See [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/create-github-private-repo#selecting-your-repository-as-your-source-of-governance). - -From that point on, any user on your enterprise's {% data variables.product.prodname_copilot_short %} plan using {% data variables.copilot.copilot_cli_short %} or supported clients is governed by those settings, whether or not they have access to the `.github-private` repository. - -The main limitation of this method is the {% data variables.product.prodname_enterprise %} license requirement to create the organization and repository. - -### Using MDM-managed or file-based settings - -If you don't want to add a {% data variables.product.prodname_enterprise %} license or create an organization, you can deploy the same logical settings through MDM (such as Intune or Jamf) or a file-based deployment. File-based delivery uses the JSON schema directly. Native MDM delivery uses flat keys and string-encoded values. Neither method requires an organization or `.github-private` repository. See [Deploying MDM-managed settings](#deploying-mdm-managed-settings) and [Deploying file-based settings](#deploying-file-based-settings). For {% data variables.product.prodname_vscode_shortname %}-specific guidance, see [Deploy Copilot managed settings](https://code.visualstudio.com/docs/enterprise/ai-settings#_deploy-copilot-managed-settings) in the {% data variables.product.prodname_vscode_shortname %} documentation. - -### Plugin access considerations - -Users don't need access to the `.github-private` repository for clients to pull in managed settings. However, if managed settings define a plugin using `enabledPlugins`, the client automatically tries to install it for each user. The user needs access to where the plugin files are hosted. If the plugin is hosted in a private repository on {% data variables.product.prodname_dotcom %}, the user needs authorization to that repository, which may require a license. diff --git a/content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/index.md b/content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/index.md index 4bdac00af9d6..c9b83e27b867 100644 --- a/content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/index.md +++ b/content/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/index.md @@ -7,7 +7,6 @@ versions: children: - /prepare-for-custom-agents - /create-github-private-repo - - /configure-enterprise-managed-settings - /monitor-agentic-activity - /enable-copilot-cloud-agent - /block-agentic-features diff --git a/content/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/copilot-business-only.md b/content/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/copilot-business-only.md new file mode 100644 index 000000000000..e5c23eaaff09 --- /dev/null +++ b/content/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/copilot-business-only.md @@ -0,0 +1,39 @@ +--- +title: Using enterprise-managed settings without organizations +shortTitle: Copilot Business only +intro: Special guidance for enterprises that are only used to assign {% data variables.copilot.copilot_business_short %} licenses. +permissions: Enterprise owners +versions: + feature: copilot +contentType: how-tos +category: + - Configure Copilot + - Manage Copilot for a team +--- + +You may have created an enterprise account with no organizations to distribute {% data variables.product.prodname_copilot_short %} without paying for {% data variables.product.prodname_enterprise %}. This is sometimes called {% data variables.product.prodname_copilot_short %} Standalone. With this setup, you can still use enterprise managed settings, but you should be aware of some additional guidance. + +If you're using a standard enterprise setup with organizations, you can ignore this guidance. + +## Using server-managed settings + +Server-managed settings require an organization and a `.github-private` repository. To create these, one user in your enterprise needs a {% data variables.product.prodname_enterprise %} license. If you use volume or subscription billing, contact your account team to purchase a license. Otherwise, the license will automatically be assigned when the user joins an organization. + +The user with the license can: + +1. Create an organization and join it as an owner. +1. Add a `.github-private` repository, make the repository the enterprise's source of managed settings, and add settings to the `{% data variables.copilot.managed_setting_file %}` file. For step-by-step instructions, see [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/get-started). + +From that point on, any user on your enterprise's {% data variables.product.prodname_copilot_short %} plan is governed by those settings, regardless of whether they have access to the `.github-private` repository. + +The main limitation of this method is the {% data variables.product.prodname_enterprise %} license required to create the organization and repository. + +## Using MDM-managed or file-based settings + +If you don't want to add a {% data variables.product.prodname_enterprise %} license or create an organization, you can deploy the same logical settings through MDM (such as Intune or Jamf) or a file-based deployment. File-based delivery uses the JSON schema directly. Native MDM delivery uses flat keys and string-encoded values. Neither method requires an organization or `.github-private` repository. + +For more information about deployment methods, see [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/deploy-managed-settings). + +## Plugin access considerations + +If managed settings define a plugin using `enabledPlugins`, the client automatically tries to install it for each user. The user needs access to where the plugin files are hosted. If the plugin is hosted in a private repository on {% data variables.product.prodname_dotcom %}, the user needs access to that repository, which may require a license. diff --git a/content/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/deploy-managed-settings.md b/content/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/deploy-managed-settings.md new file mode 100644 index 000000000000..14ee09afbbd1 --- /dev/null +++ b/content/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/deploy-managed-settings.md @@ -0,0 +1,106 @@ +--- +title: Choosing how to deploy enterprise-managed settings to users +shortTitle: Deploy managed settings +intro: Choose from different deployment methods to deliver managed settings keys to users. +permissions: Enterprise owners +versions: + feature: copilot +contentType: how-tos +category: + - Configure Copilot + - Manage Copilot for a team +--- + +If you followed [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/get-started), you hosted your managed settings on {% data variables.product.github %}. This is a server-managed deployment. You can also choose to deploy settings directly to a user's machine with mobile device management or file-based delivery. + +It is possible to combine multiple different deployment methods. For example, you can use MDM for non-negotiable security policies governed by IT, and server-managed settings for things that are more subject to change, like plugin settings. However, bear in mind that this may make it more difficult to understand exactly which settings apply to your users. If you plan to do this, see [Precedence of deployment methods](#precedence-of-deployment-methods). + +## Choosing a deployment method + +There are multiple ways to deploy enterprise managed settings. Use the following guidelines to choose the right methods for you. + +* **Server-managed (.github-private repository)**: + * Default for most enterprises and best for review workflows and audit history. + * Applies to all clients, including {% data variables.copilot.copilot_cloud_agent %}. + * Only applies to users who receive a {% data variables.product.prodname_copilot %} license from your enterprise. + * Allows overrides for enterprise teams. +* **Mobile device management**: + * Best when IT teams need device-group targeting through existing MDM tooling on macOS and Windows. + * Local clients only. + * Applies to the user regardless of where they receive their {% data variables.product.prodname_copilot %} license. +* **File-based**: + * Available on all platforms and useful when server-managed and MDM-managed deployments are not available, including developer environments such as containers and {% data variables.product.prodname_codespaces %}. + * Local clients only. + * Applies to the user regardless of where they receive their {% data variables.product.prodname_copilot %} license. + +MDM-managed and file-based settings are loaded from the device, so they can apply before sign in or a server round trip and remain active when users switch accounts. Server-managed settings are associated with the user's signed-in account. + +In {% data variables.copilot.copilot_cli_short %}, if a request for server-managed settings fails and no cached response is available, the server-managed policy is unavailable for that session. For restrictions that must remain available without a server response, use MDM-managed or file-based settings. + +There are additional considerations if you use a dedicated enterprise for {% data variables.copilot.copilot_business_short %}. See [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/copilot-business-only). + +## Deploying server-managed settings + +1. Create and configure your `.github-private` repository. See [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/create-github-private-repo). +1. In the repository, create or update `copilot/{% data variables.copilot.managed_setting_file %}`. +1. Add your enterprise policy keys and values in JSON format. +1. Commit and push your changes to the default branch. +1. Confirm that enterprise users are running a supported client. Updated settings are applied automatically within about an hour. Restarting the client or signing in again triggers an immediate refresh. + +## Deploying MDM-managed settings + +Native MDM delivery uses the same logical keys and values as server-managed settings, but it does not deploy a `{% data variables.copilot.managed_setting_file %}` file. Instead, your MDM platform deploys individual settings as operating-system-managed string values. + +Native MDM delivery is available on Windows and macOS: + +| Operating system | Native policy location | +| --- | --- | +| Windows | String (`REG_SZ`) values under `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\GitHubCopilot` | +| macOS | String values in forced managed preferences for the `com.github.copilot` preference domain | +| Linux | Native MDM delivery is not supported. Use file-based settings instead. | + +All native MDM values must be strings. For nested settings, use a dot-separated key such as `permissions.disableBypassPermissionsMode` or `sandbox.enabled`. Store ordinary string values directly. Store booleans, arrays, and objects as JSON text within a string value. + +For example: + +| Key | Native string value | +| --- | --- | +| `permissions.disableBypassPermissionsMode` | `disable` | +| `sandbox.enabled` | `true` | +| `enabledPlugins` | `{"PLUGIN-NAME@MARKETPLACE-NAME":true}` | + +1. Choose the settings you want to enforce. See [AUTOTITLE](/copilot/reference/enterprise-administrators/enterprise-managed-settings). +1. Convert each setting to the native key and string value representation. +1. Deploy the settings to the native policy location using your enterprise MDM platform and standard rollout process. +1. Assign the policy to the target device groups. + + Clients do not need to restart, and check for updated policies on an hourly basis. In {% data variables.product.prodname_vscode_shortname %}, an administrator can force a check for testing by running the `Developer: Sync Account Policy` command. + +## Deploying file-based settings + +Place `{% data variables.copilot.managed_setting_file %}` in the following location: + +| Operating system | File location | +| --- | --- | +| macOS | `/Library/Application Support/GitHubCopilot/managed-settings.json` | +| Windows | `%ProgramFiles%\GitHubCopilot\managed-settings.json` | +| Linux | `/etc/github-copilot/managed-settings.json` | + +1. Create or update a `{% data variables.copilot.managed_setting_file %}` file with the policy keys and values you want to enforce. +1. Distribute the file to the platform-specific location using your standard device management process. Machines that don't receive the file are not restricted by this policy. +1. For {% data variables.copilot.copilot_cli_short %} on macOS and Linux, make the file a regular file owned by `root`, and ensure it is not group-writable or world-writable. Do not use a symbolic link. The CLI rejects files that do not meet these requirements. +1. Ask users to restart supported clients so the updated policy is loaded at startup. + +## Precedence of deployment methods + +When multiple settings sources are present, settings earlier in this list take precedence over settings later in the list: + +1. MDM-managed settings +1. Server-managed settings +1. File-based settings +1. User-level settings + +As an exception, the following keys are composed in the most restrictive direction across different delivery methods: + +* `sandbox` +* `permissions.deny`, `permissions.ask`, and `permissions.allow` diff --git a/content/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/get-started.md b/content/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/get-started.md new file mode 100644 index 000000000000..252f8f0eaaa6 --- /dev/null +++ b/content/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/get-started.md @@ -0,0 +1,122 @@ +--- +title: Getting started with enterprise-managed settings +shortTitle: Get started +allowTitleToDifferFromFilename: true +intro: Configure enterprise managed settings to centrally control {% data variables.product.prodname_copilot_short %} client behavior across your enterprise. +permissions: Enterprise owners +redirect_from: + - /copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/disable-automatic-commands + - /copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/configure-enterprise-plugin-standards + - /copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/configure-enterprise-managed-settings +versions: + feature: copilot +contentType: how-tos +category: + - Configure Copilot + - Manage Copilot for a team +--- + +With enterprise managed settings, you can centrally define and distribute configuration settings for {% data variables.product.prodname_copilot %} to supported clients. This ensures everyone works within the guardrails you define, with the option to specialize settings for different teams. For example, you can block agents from performing sensitive operations, install approved agent plugins, or ensure that sessions run in a sandbox. + +This guide walks through creating the `{% data variables.copilot.managed_setting_file %}` file on {% data variables.product.github %}, rolling out the settings to users, and overriding specific settings for enterprise teams. As a low-friction example, we'll ensure new conversations start in auto model mode for most users, and override this setting for a specific enterprise team. This example will allow you to test the managed settings deployment without causing disruption to users. + +> [!NOTE] If you use a dedicated enterprise for Copilot Business, there is additional guidance to consider. See [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/copilot-business-only). + +## Supported clients + +The following clients are supported, although not every client supports every property: + +* {% data variables.copilot.copilot_cli_short %} +* {% data variables.product.prodname_vscode_shortname %} +* The {% data variables.copilot.github_copilot_app %} +* {% data variables.copilot.copilot_cloud_agent %} +* {% data variables.product.prodname_jetbrains_ides %} + +For a full reference of supported keys, see [AUTOTITLE](/copilot/reference/enterprise-administrators/enterprise-managed-settings). + +## 1. Create a `.github-private` repository + +You can host the `{% data variables.copilot.managed_setting_file %}` file in a `.github-private` repository owned by a designated organization in your enterprise. This allows you to keep your managed settings next to your custom agent profiles, in a place that members of the enterprise can view. + +For instructions on **creating the repository and selecting it as your enterprise's source of client governance**, see [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/create-github-private-repo). + +The governance settings in this repository apply to all users who receive a {% data variables.product.prodname_copilot_short %} license from your enterprise or any of its organizations, regardless of whether the user has access to the `.github-private` repository or the organization that owns it. We recommend giving the repository internal visibility, so that enterprise members can view the governance settings, and restricting edits of the `{% data variables.copilot.managed_setting_file %}` file to administrators and AI managers. + +> [!TIP] This is called a "server-managed" deployment. There are other methods of distributing managed settings to users, including mobile device management (MDM) and local file delivery. For more information, see [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/deploy-managed-settings). + +## 2. Create the `{% data variables.copilot.managed_setting_file %}` file + +In this example, we're using a very simple configuration that ensures users' conversations start in auto mode. This means {% data variables.product.prodname_copilot_short %} will automatically choose the best model for a user's task from your enterprise's allowed models, which reduces rate limiting issues for users. + +1. In the `.github-private` repository, create a file at `copilot/{% data variables.copilot.managed_setting_file %}`. +1. Add configuration to the file. For example: + + ``` json copy + { + "model": "auto" + } + ``` + +1. Commit your changes to the default branch. + +For a real rollout, **check the supported keys and their coverage across clients**. See [AUTOTITLE](/copilot/reference/enterprise-administrators/enterprise-managed-settings). + +## 3. Override the setting for specific teams + +You can override supported properties of the `{% data variables.copilot.managed_setting_file %}` file for enterprise teams. In this example, we'll disable the auto model default for a team that needs to stick to specific models for specialized work. + +{% data reusables.copilot.policy.enterprise-team-overrides-structure %} + +### Steps + +1. Create an enterprise team containing users who should not receive the auto mode default. In this example, we'll call it `special-team`. See [AUTOTITLE](/enterprise-cloud@latest/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/create-enterprise-teams). +1. In your `copilot/{% data variables.copilot.managed_setting_file %}` file, mark the key as eligible for override using the `{ "overridable": VALUE }` syntax. The `VALUE` is the default when teams files do not declare a different value for a given key. + + For example, we will make `model` overridable for enterprise teams, with `auto` remaining the default for everyone else: + + ```json copy + { + "model": { "overridable": "auto" } + } + ``` + +1. In your `.github-private` repository, create a dedicated settings file for the enterprise team under `copilot/{% data variables.copilot.team_settings_directory %}`. For example: `copilot/{% data variables.copilot.team_settings_directory %}no-auto.json`. + + In this file, add configuration that provides values for overridable properties. + + The following example removes the control on auto model mode. Everything else remains governed by your `{% data variables.copilot.managed_setting_file %}` file. + + ```json copy + { + "model": "unmanaged" + } + ``` + +1. In your `.github-private` repository, create `copilot/{% data variables.copilot.team_mappings_file %}`. In this file, map the name of the enterprise team to its special configuration file. The key is the settings file name, and the value is an array of team slugs, so you can apply one file across multiple teams. + + ```json copy + { + "no-auto.json": ["special-team"] + } + ``` + +1. Commit and push your changes to the default branch. + +Later, you can add different overrides for other keys and other teams. **For a more complete example**, see [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/override-settings-for-teams). + +## 4. Check the settings are active + +Check that the settings you defined are active for users and overridden for specific teams. In this example, most of your enterprise's {% data variables.product.prodname_copilot_short %} users should find that new conversations in their client start in auto mode. The `special-team` enterprise team should not have this experience. + +For server-managed deployments, users on a supported client see the specified settings within about an hour. This includes `copilot/{% data variables.copilot.managed_setting_file %}`, `copilot/{% data variables.copilot.team_mappings_file %}`, and files in `copilot/{% data variables.copilot.team_settings_directory %}`. Restarting the client or signing in again triggers an immediate refresh. + +If a user does not see these settings, ensure they receive access to {% data variables.product.prodname_copilot_short %} through your enterprise or one of its organizations. If a user receives a license from multiple billing entities, ensure they have selected your enterprise in the "Usage billed to" dropdown in their [personal {% data variables.product.prodname_copilot_short %} settings](https://github.com/settings/copilot/features). + +For MDM-managed deployments, clients check for updated policies hourly. For file-based deployments, restart the client to load an updated file. These deployment methods apply to all users with the settings installed on their machine, regardless of where their {% data variables.product.prodname_copilot_short %} license comes from. + +## Next step + +Now you've created a simple managed settings setup, you can: + +* Add additional governance properties to the file. See [AUTOTITLE](/copilot/reference/enterprise-administrators/enterprise-managed-settings). +* Decide whether to deploy settings to users through other methods. See [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/deploy-managed-settings). diff --git a/content/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/index.md b/content/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/index.md new file mode 100644 index 000000000000..849523833108 --- /dev/null +++ b/content/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/index.md @@ -0,0 +1,13 @@ +--- +title: Using enterprise managed settings for GitHub Copilot +shortTitle: Use enterprise managed settings +intro: Govern how enterprise members can use {% data variables.product.prodname_copilot_short %} across clients. +versions: + feature: copilot +children: + - /get-started + - /deploy-managed-settings + - /override-settings-for-teams + - /copilot-business-only +contentType: how-tos +--- \ No newline at end of file diff --git a/content/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/override-settings-for-teams.md b/content/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/override-settings-for-teams.md new file mode 100644 index 000000000000..c8382a38c2be --- /dev/null +++ b/content/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/override-settings-for-teams.md @@ -0,0 +1,83 @@ +--- +title: Overriding enterprise-managed settings for teams +shortTitle: Override settings for teams +allowTitleToDifferFromFilename: true +intro: Avoid overly restrictive configuration by overriding default settings for specific teams. +permissions: Enterprise owners +versions: + feature: copilot +contentType: how-tos +category: + - Configure Copilot + - Manage Copilot for a team +--- + +With a server-managed deployment, you can configure your enterprise's `{% data variables.copilot.managed_setting_file %}` file to apply different governance settings to groups of users based on their enterprise team membership. The enterprise defines all settings in a central place, and team membership determines which users receive a given set of values. **If you haven't created the `{% data variables.copilot.managed_setting_file %}` file yet, see [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/get-started).** + +To make a key eligible for team overrides, you will mark it as `overridable` in `{% data variables.copilot.managed_setting_file %}`. An overridable key uses the team's value when set, or falls back to your enterprise default when the team leaves it unset. + +## Supported keys + +The `{ "overridable": }` syntax applies to the `model`, `permissions.disableBypassPermissionsMode`, `permissions.deny`, `permissions.ask`, `permissions.allow`, `allowedMcpServers`, and `deniedMcpServers` keys. + +`enabledPlugins` and `extraKnownMarketplaces` work additively. The enterprise `{% data variables.copilot.managed_setting_file %}` sets a baseline, and an enterprise team file can add more plugins and marketplaces on top of it. + +For a full description of these keys and their syntax, see [AUTOTITLE](/copilot/reference/enterprise-administrators/enterprise-managed-settings). + +## Overriding settings for specific teams + +These instructions apply to **server-managed deployments** (a `{% data variables.copilot.managed_setting_file %}` hosted on {% data variables.product.github %}). Other deployment methods do not support enterprise team overrides, and would require you to deploy different settings to different groups of users via your MDM platform. + +You will use `copilot/{% data variables.copilot.team_mappings_file %}` and the `copilot/{% data variables.copilot.team_settings_directory %}` directory to configure which enterprise teams should use settings that differ from your default `copilot/{% data variables.copilot.managed_setting_file %}` values. + +{% data reusables.copilot.policy.enterprise-team-overrides-structure %} + +## Steps + +1. In your enterprise's `copilot/{% data variables.copilot.managed_setting_file %}` file, mark each key you want to make eligible for override using the `{ "overridable": }` syntax. The `json` files you map to teams can only send different values for keys you mark overridable. + + An `overridable` value you provide in `{% data variables.copilot.managed_setting_file %}` is the default when team files do not declare a different value for a given key. + + For example, to defer `model`, `disableBypassPermissionsMode`, and `allowedMcpServers` to teams: + + ```json + { + "model": { "overridable": "auto" }, + "permissions": { + "disableBypassPermissionsMode": { "overridable": "disable" } + }, + "allowedMcpServers": { + "overridable": [ + { "serverUrl": "https://mcp.company.com/*" } + ] + } + } + ``` + +1. In your enterprise's `.github-private` repository, create `copilot/{% data variables.copilot.team_mappings_file %}`. Map each team settings file to one or more enterprise team slugs. The key is the settings file name, and the value is an array of team slugs, so you can apply one file across multiple teams. + + ```json + { + "devs.json": ["developers-all", "finops-dev"], + "ai-users.json": ["ai-baseline-trained"], + "frontier.json": ["ai-pioneers"] + } + ``` + +1. Create the team settings file under `copilot/{% data variables.copilot.team_settings_directory %}`. You can include any keys you marked as overridable, plus the additive keys `enabledPlugins` and `extraKnownMarketplaces`. Every other key stays governed by your enterprise default. + + ```json + { + "model": "unmanaged", + "permissions": { + "disableBypassPermissionsMode": "unmanaged" + }, + "allowedMcpServers": [ + { "serverUrl": "https://team-specific-mcp.company.com/*" } + ] + } + ``` + +1. Commit and push your changes to the default branch. + +{% data variables.product.prodname_dotcom %} evaluates enterprise team membership and applies matching settings for each person. If a user belongs to multiple teams, their team files are combined using the least restrictive value for each key, then applied beneath the enterprise settings, where platform decisions always win. diff --git a/content/copilot/reference/enterprise-administrators/enterprise-managed-settings.md b/content/copilot/reference/enterprise-administrators/enterprise-managed-settings.md index c2f804d71b60..74d99b42df57 100644 --- a/content/copilot/reference/enterprise-administrators/enterprise-managed-settings.md +++ b/content/copilot/reference/enterprise-administrators/enterprise-managed-settings.md @@ -12,21 +12,7 @@ category: Use this reference to understand the currently supported keys in `{% data variables.copilot.managed_setting_file %}`. -For deployment methods and supported clients, see [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/configure-enterprise-managed-settings). - -## Precedence rules - -When multiple settings sources are present, settings earlier in this list take precedence over settings later in the list: - -1. MDM-managed settings -1. Server-managed settings -1. File-based settings -1. User-level settings - -As an exception, the following keys are composed in the most restrictive direction across different delivery methods: - -* `sandbox` -* `permissions.deny`, `permissions.ask`, and `permissions.allow` +For instructions on creating the file, see [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/use-managed-settings/get-started). ## Supported keys @@ -50,13 +36,6 @@ As an exception, the following keys are composed in the most restrictive directi {% endrowheaders %} -## Applying different settings to enterprise teams - -For server-managed deployments, the enterprise can apply different governance to groups of users based on their enterprise team membership. The enterprise defines all settings—team membership only determines which users receive a given set of values. - -To make a key eligible for team-specific values, mark it as overridable in `{% data variables.copilot.managed_setting_file %}` using the `{ "overridable": }` syntax. An overridable key uses the team's value when set, or falls back to your enterprise default when the team leaves it unset. The `{ "overridable": }` syntax applies to the `model`, `permissions.disableBypassPermissionsMode`, `permissions.deny`, `permissions.ask`, `permissions.allow`, `allowedMcpServers`, and `deniedMcpServers` keys. Keys not marked overridable remain an enterprise-level decision that teams can't modify. - -`enabledPlugins` and `extraKnownMarketplaces` work additively. The enterprise `{% data variables.copilot.managed_setting_file %}` sets a baseline, and an enterprise team file can add more plugins and marketplaces on top of it. For the full setup steps, see [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/configure-enterprise-managed-settings#overriding-settings-for-specific-teams). ## Example configuration diff --git a/data/reusables/copilot/policy/enterprise-team-overrides-structure.md b/data/reusables/copilot/policy/enterprise-team-overrides-structure.md new file mode 100644 index 000000000000..e92a0768c8de --- /dev/null +++ b/data/reusables/copilot/policy/enterprise-team-overrides-structure.md @@ -0,0 +1,8 @@ +After you complete this section, your `.github-private` repository will have the following structure: + +* **`.github-private/`** + * **`copilot/`** + * **`{% data variables.copilot.managed_setting_file %}`**: `{ "model": { "overridable": "auto" } }` + * **`{% data variables.copilot.team_mappings_file %}`**: `{ "no-auto.json": ["special-team"] }` + * **`{% data variables.copilot.team_settings_directory %}`** + * **`no-auto.json`**: `{ "model": "unmanaged" }` From 6ea74476b008ee64ecd4e0da842d0fca82ddb2d6 Mon Sep 17 00:00:00 2001 From: Anne-Marie <102995847+am-stead@users.noreply.github.com> Date: Mon, 7 Sep 2026 12:14:41 +0000 Subject: [PATCH 7/8] [Content creation]: [Audit for Copilot IA project] Concepts: Enterprise #24267 (#63084) Co-authored-by: docs-bot <77750099+docs-bot@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3924ad1b-4f15-43f9-8894-a05997f8ee7e --- .../concepts/agents/cloud-agent/index.md | 1 - content/copilot/concepts/agents/index.md | 3 --- ...nterprise-accounts-for-copilot-business.md | 1 + .../agent-management.md} | 7 ++++--- .../cloud-agent-access.md} | 3 ++- .../default-model-availability.md} | 4 +++- .../{models => enterprise}/fedramp-models.md | 1 + content/copilot/concepts/enterprise/index.md | 20 +++++++++++++++++++ .../learning-about-new-features-and-models.md | 1 + .../{ => enterprise}/mcp-management.md | 4 +++- .../{agents => enterprise}/opentelemetry.md | 2 ++ .../plugin-standards.md} | 3 ++- .../concepts/{ => enterprise}/policies.md | 4 +++- content/copilot/concepts/index.md | 6 ++---- content/copilot/concepts/models/index.md | 2 -- 15 files changed, 44 insertions(+), 18 deletions(-) rename content/copilot/concepts/{ => enterprise}/about-enterprise-accounts-for-copilot-business.md (98%) rename content/copilot/concepts/{agents/enterprise-management.md => enterprise/agent-management.md} (96%) rename content/copilot/concepts/{agents/cloud-agent/access-management.md => enterprise/cloud-agent-access.md} (98%) rename content/copilot/concepts/{models/default-availability.md => enterprise/default-model-availability.md} (93%) rename content/copilot/concepts/{models => enterprise}/fedramp-models.md (97%) create mode 100644 content/copilot/concepts/enterprise/index.md rename content/copilot/concepts/{ => enterprise}/learning-about-new-features-and-models.md (99%) rename content/copilot/concepts/{ => enterprise}/mcp-management.md (93%) rename content/copilot/concepts/{agents => enterprise}/opentelemetry.md (98%) rename content/copilot/concepts/{agents/about-enterprise-plugin-standards.md => enterprise/plugin-standards.md} (96%) rename content/copilot/concepts/{ => enterprise}/policies.md (98%) diff --git a/content/copilot/concepts/agents/cloud-agent/index.md b/content/copilot/concepts/agents/cloud-agent/index.md index 6b91b412a596..8878e39bbda5 100644 --- a/content/copilot/concepts/agents/cloud-agent/index.md +++ b/content/copilot/concepts/agents/cloud-agent/index.md @@ -11,7 +11,6 @@ children: - /about-custom-agents - /about-automations - /about-automation-rationale-and-approvals - - /access-management - /mcp-and-cloud-agent - /risks-and-mitigations contentType: concepts diff --git a/content/copilot/concepts/agents/index.md b/content/copilot/concepts/agents/index.md index cd8858a5f1e6..34a403726919 100644 --- a/content/copilot/concepts/agents/index.md +++ b/content/copilot/concepts/agents/index.md @@ -15,14 +15,11 @@ children: - /copilot-memory - /hooks - /about-plugins - - /about-enterprise-plugin-standards - /about-third-party-coding-agents - /agent-apps - /openai-codex - /anthropic-claude - /about-agent-skills - - /enterprise-management - - /opentelemetry contentType: concepts --- diff --git a/content/copilot/concepts/about-enterprise-accounts-for-copilot-business.md b/content/copilot/concepts/enterprise/about-enterprise-accounts-for-copilot-business.md similarity index 98% rename from content/copilot/concepts/about-enterprise-accounts-for-copilot-business.md rename to content/copilot/concepts/enterprise/about-enterprise-accounts-for-copilot-business.md index 2022fd1b0270..a43dc68aff5b 100644 --- a/content/copilot/concepts/about-enterprise-accounts-for-copilot-business.md +++ b/content/copilot/concepts/enterprise/about-enterprise-accounts-for-copilot-business.md @@ -8,6 +8,7 @@ redirect_from: - /admin/copilot-business-only - /admin/copilot-business-only/about-enterprise-accounts-for-copilot-business - /early-access/copilot/managing-copilot-business-licenses-with-an-enterprise-account + - /copilot/concepts/about-enterprise-accounts-for-copilot-business contentType: concepts category: - Learn about Copilot diff --git a/content/copilot/concepts/agents/enterprise-management.md b/content/copilot/concepts/enterprise/agent-management.md similarity index 96% rename from content/copilot/concepts/agents/enterprise-management.md rename to content/copilot/concepts/enterprise/agent-management.md index 569f3863650b..d6d36a488a8a 100644 --- a/content/copilot/concepts/agents/enterprise-management.md +++ b/content/copilot/concepts/enterprise/agent-management.md @@ -1,12 +1,14 @@ --- title: Agent management for enterprises -shortTitle: Enterprise management -intro: 'Maintain your enterprise''s security and compliance standards and supercharge your developers by managing agents with AI Controls.' +shortTitle: Agent management +intro: Maintain your enterprise's security and compliance standards and supercharge your developers by managing agents with AI Controls. versions: feature: copilot contentType: concepts category: - Learn about Copilot +redirect_from: + - /copilot/concepts/agents/enterprise-management --- ## Overview @@ -83,4 +85,3 @@ For more information, see [AUTOTITLE](/copilot/how-tos/administer-copilot/manage ## Agent mode in the IDE Enterprise and organization owners can separately control whether their users have access to agent mode in IDE chat, independently from the "Chat in IDE" policy. This gives you finer-grained control over agentic capabilities in your developers' IDEs. - diff --git a/content/copilot/concepts/agents/cloud-agent/access-management.md b/content/copilot/concepts/enterprise/cloud-agent-access.md similarity index 98% rename from content/copilot/concepts/agents/cloud-agent/access-management.md rename to content/copilot/concepts/enterprise/cloud-agent-access.md index 24bccba9ea62..5fb88fd8232a 100644 --- a/content/copilot/concepts/agents/cloud-agent/access-management.md +++ b/content/copilot/concepts/enterprise/cloud-agent-access.md @@ -1,6 +1,6 @@ --- title: Managing access to GitHub Copilot cloud agent -shortTitle: Access management +shortTitle: Cloud agent access allowTitleToDifferFromFilename: true intro: Find out about {% data variables.copilot.copilot_cloud_agent %} policies available for {% data variables.copilot.copilot_enterprise %} and {% data variables.copilot.copilot_for_business %}, and about disabling the agent for specific repositories. product: '{% data reusables.gated-features.copilot-cloud-agent %}
Sign up for {% data variables.product.prodname_copilot_short %} {% octicon "link-external" height:16 %}' @@ -18,6 +18,7 @@ redirect_from: - /copilot/how-tos/agents/copilot-coding-agent/enabling-copilot-coding-agent - /copilot/concepts/agents/coding-agent/coding-agent-for-business-and-enterprise - /copilot/concepts/agents/coding-agent/managing-access + - /copilot/concepts/agents/cloud-agent/access-management contentType: concepts category: - Manage Copilot for a team diff --git a/content/copilot/concepts/models/default-availability.md b/content/copilot/concepts/enterprise/default-model-availability.md similarity index 93% rename from content/copilot/concepts/models/default-availability.md rename to content/copilot/concepts/enterprise/default-model-availability.md index 16ae99c2a74b..e328dd617628 100644 --- a/content/copilot/concepts/models/default-availability.md +++ b/content/copilot/concepts/enterprise/default-model-availability.md @@ -1,6 +1,6 @@ --- title: About default availability of {% data variables.product.prodname_copilot_short %} models -shortTitle: Default availability +shortTitle: Default model availability intro: A policy controls whether unconfigured models default to enabled or disabled. product: '{% data variables.copilot.copilot_business_short %} and {% data variables.copilot.copilot_enterprise_short %}' versions: @@ -11,6 +11,8 @@ category: - Manage Copilot for a team redirect_from: - /copilot/concepts/models/automatic-enablement + - /copilot/concepts/models/default-availability + - /copilot/concepts/enterprise/default-availability --- For enterprises with {% data variables.copilot.copilot_business_short %} or {% data variables.copilot.copilot_enterprise_short %} plans, the **Default availability for released models** policy controls whether unconfigured generally available (GA) models default to enabled or disabled. If this policy is enabled, users benefit from the latest models without the need for administrator intervention. diff --git a/content/copilot/concepts/models/fedramp-models.md b/content/copilot/concepts/enterprise/fedramp-models.md similarity index 97% rename from content/copilot/concepts/models/fedramp-models.md rename to content/copilot/concepts/enterprise/fedramp-models.md index 21239e286f9c..d3f6338ddc40 100644 --- a/content/copilot/concepts/models/fedramp-models.md +++ b/content/copilot/concepts/enterprise/fedramp-models.md @@ -8,6 +8,7 @@ product: '{% data variables.enterprise.data_residency %}' contentType: concepts redirect_from: - /copilot/concepts/fedramp-models + - /copilot/concepts/models/fedramp-models --- If your enterprise uses {% data variables.enterprise.data_residency %} in the US, you can enable a policy to ensure that users on your {% data variables.product.prodname_copilot_short %} plan can only use models with **FedRAMP Moderate** certification. diff --git a/content/copilot/concepts/enterprise/index.md b/content/copilot/concepts/enterprise/index.md new file mode 100644 index 000000000000..d5564c05253e --- /dev/null +++ b/content/copilot/concepts/enterprise/index.md @@ -0,0 +1,20 @@ +--- +title: Enterprise concepts for GitHub Copilot +shortTitle: Enterprise +intro: Understand how to govern and manage {% data variables.product.prodname_copilot %} across your enterprise. +versions: + feature: copilot +children: + - /policies + - /default-model-availability + - /fedramp-models + - /learning-about-new-features-and-models + - /agent-management + - /mcp-management + - /plugin-standards + - /opentelemetry + - /cloud-agent-access + - /about-enterprise-accounts-for-copilot-business +contentType: concepts +--- + diff --git a/content/copilot/concepts/learning-about-new-features-and-models.md b/content/copilot/concepts/enterprise/learning-about-new-features-and-models.md similarity index 99% rename from content/copilot/concepts/learning-about-new-features-and-models.md rename to content/copilot/concepts/enterprise/learning-about-new-features-and-models.md index 74feed2b66cd..9b53069fbda4 100644 --- a/content/copilot/concepts/learning-about-new-features-and-models.md +++ b/content/copilot/concepts/enterprise/learning-about-new-features-and-models.md @@ -9,6 +9,7 @@ category: - Learn about Copilot redirect_from: - /copilot/concepts/preparing-for-new-features-and-models + - /copilot/concepts/learning-about-new-features-and-models --- {% data variables.product.prodname_copilot %} is evolving rapidly, with new features and models released regularly. If you're an enterprise administrator, staying informed helps you make confident decisions about which capabilities to enable, when to adopt them, and how to manage risk across your organizations. diff --git a/content/copilot/concepts/mcp-management.md b/content/copilot/concepts/enterprise/mcp-management.md similarity index 93% rename from content/copilot/concepts/mcp-management.md rename to content/copilot/concepts/enterprise/mcp-management.md index bc5911064a4f..8663d6d2e363 100644 --- a/content/copilot/concepts/mcp-management.md +++ b/content/copilot/concepts/enterprise/mcp-management.md @@ -1,13 +1,15 @@ --- title: MCP server usage in your company shortTitle: MCP management -intro: 'You can manage MCP server usage to provide your developers with valuable tools while maintaining security and compliance.' +intro: You can manage MCP server usage to provide your developers with valuable tools while maintaining security and compliance. versions: feature: copilot contentType: concepts category: - Learn about Copilot - Manage Copilot for a team +redirect_from: + - /copilot/concepts/mcp-management --- {% data reusables.copilot.mcp.intro %} diff --git a/content/copilot/concepts/agents/opentelemetry.md b/content/copilot/concepts/enterprise/opentelemetry.md similarity index 98% rename from content/copilot/concepts/agents/opentelemetry.md rename to content/copilot/concepts/enterprise/opentelemetry.md index ac019fd8bbec..de175fa4468d 100644 --- a/content/copilot/concepts/agents/opentelemetry.md +++ b/content/copilot/concepts/enterprise/opentelemetry.md @@ -7,6 +7,8 @@ versions: contentType: concepts category: - Manage Copilot for a team +redirect_from: + - /copilot/concepts/agents/opentelemetry --- OpenTelemetry (OTel) is an open source observability framework. It provides a standard way to collect telemetry events and metrics and export them to compatible observability tools. For more information, see [What is OpenTelemetry?](https://opentelemetry.io/docs/what-is-opentelemetry/) on the OTel website. diff --git a/content/copilot/concepts/agents/about-enterprise-plugin-standards.md b/content/copilot/concepts/enterprise/plugin-standards.md similarity index 96% rename from content/copilot/concepts/agents/about-enterprise-plugin-standards.md rename to content/copilot/concepts/enterprise/plugin-standards.md index e64fbdffef4c..9cb0ad2a5285 100644 --- a/content/copilot/concepts/agents/about-enterprise-plugin-standards.md +++ b/content/copilot/concepts/enterprise/plugin-standards.md @@ -1,6 +1,6 @@ --- title: About enterprise-managed plugin standards -shortTitle: Enterprise plugin standards +shortTitle: Plugin standards allowTitleToDifferFromFilename: true intro: Enterprise administrators can centrally define plugin policies for users, ensuring consistent plugin availability. versions: @@ -13,6 +13,7 @@ docsTeamMetrics: - copilot-cli redirect_from: - /copilot/concepts/agents/copilot-cli/about-enterprise-plugin-standards + - /copilot/concepts/agents/about-enterprise-plugin-standards --- Enterprise-managed plugin standards allow administrators to **define and enforce policies for plugin availability**. By configuring a `{% data variables.copilot.managed_setting_file %}` file, administrators can specify which plugin marketplaces are available to users and which plugins are installed automatically. diff --git a/content/copilot/concepts/policies.md b/content/copilot/concepts/enterprise/policies.md similarity index 98% rename from content/copilot/concepts/policies.md rename to content/copilot/concepts/enterprise/policies.md index 7000046dff27..94c19a612d98 100644 --- a/content/copilot/concepts/policies.md +++ b/content/copilot/concepts/enterprise/policies.md @@ -6,6 +6,8 @@ intro: 'Control the availability of {% data variables.product.prodname_copilot % versions: feature: copilot contentType: concepts +redirect_from: + - /copilot/concepts/policies category: - Manage Copilot for a team --- @@ -26,7 +28,7 @@ A small number of policies work differently and govern a setting for everyone. F ## What about users with multiple licenses? -A user can receive access to {% data variables.product.prodname_copilot_short %} from multiple organizations in the same enterprise. If these organizations have configured the same policy differently, the **least restrictive** policy usually applies, but there are some exceptions. +A user can receive access to {% data variables.product.prodname_copilot_short %} from multiple organizations in the same enterprise. If these organizations have configured the same policy differently, the **least restrictive** policy usually applies, but there are some exceptions. More rarely, if a user receives a license from multiple different enterprises, the **most restrictive** policy across enterprises almost always applies. For example, if any enterprise disables {% data variables.copilot.copilot_chat_dotcom_short %}, that feature is disabled for the user. diff --git a/content/copilot/concepts/index.md b/content/copilot/concepts/index.md index 9641b5694f44..92d63b299c3f 100644 --- a/content/copilot/concepts/index.md +++ b/content/copilot/concepts/index.md @@ -16,10 +16,8 @@ children: - /models - /usage-limits - /billing - - /about-enterprise-accounts-for-copilot-business - - /policies - - /mcp-management - /network-settings - - /learning-about-new-features-and-models + - /enterprise contentType: concepts --- + diff --git a/content/copilot/concepts/models/index.md b/content/copilot/concepts/models/index.md index 8130d5308aa1..5e55b889958a 100644 --- a/content/copilot/concepts/models/index.md +++ b/content/copilot/concepts/models/index.md @@ -6,11 +6,9 @@ versions: feature: copilot contentType: concepts children: - - /default-availability - /bring-your-own-key - /utility-models - /auto-model-selection - - /fedramp-models - /fallback-and-lts-models --- From 12553032ffc26d69c16d41d9a3453090488229fe Mon Sep 17 00:00:00 2001 From: Sophie <29382425+sophietheking@users.noreply.github.com> Date: Mon, 7 Sep 2026 13:28:51 +0000 Subject: [PATCH 8/8] Direct Org Billing for Automatic CCR on bot-authored, bot-requested, and CCA-authored PRs [GA] (#62606) --- content/copilot/concepts/agents/code-review.md | 5 ++--- .../copilot/reference/copilot-billing/models-and-pricing.md | 2 +- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/content/copilot/concepts/agents/code-review.md b/content/copilot/concepts/agents/code-review.md index 750dc2a4af6d..c05aab1dc38c 100644 --- a/content/copilot/concepts/agents/code-review.md +++ b/content/copilot/concepts/agents/code-review.md @@ -106,10 +106,9 @@ Code reviews have two cost components: {% data variables.product.prodname_ai_cre If a repository is configured to automatically request a code review from {% data variables.product.prodname_copilot_short %} for all new pull requests, the {% data variables.product.prodname_ai_credits_short %} consumption is attributed to the pull request author. If a review is manually requested by another user, the consumption is attributed to that user instead. -If a pull request is created by {% data variables.product.prodname_actions %} or by a bot, the usage will apply to: +For pull requests authored by {% data variables.copilot.copilot_cloud_agent %}, usage is attributed first to the human co-author associated with the change. If the co-author cannot be billed, usage is billed directly to the organization. -* The user who triggered the workflow, if that user can be identified. -* A designated billing owner. +For pull requests authored by other bots, or when a bot requests the review, usage is billed directly to the organization. These pull requests are eligible for agentic review. ### What happens when a budget is reached diff --git a/content/copilot/reference/copilot-billing/models-and-pricing.md b/content/copilot/reference/copilot-billing/models-and-pricing.md index 7bacdf1cee27..0ee0e06a752b 100644 --- a/content/copilot/reference/copilot-billing/models-and-pricing.md +++ b/content/copilot/reference/copilot-billing/models-and-pricing.md @@ -105,7 +105,7 @@ For most {% data variables.product.prodname_copilot_short %} features, the model Each code review is billed in two ways: token consumption is billed in {% data variables.product.prodname_ai_credits_short %}, and the agentic infrastructure that powers the review consumes {% data variables.product.prodname_actions %} minutes. -{% data variables.product.prodname_actions %} minutes are attributed to the repository, and from there to the enterprise or cost center where applicable. {% data variables.product.prodname_ai_credits_short %} are charged to the person who requests the review, or to the author of a pull request where a policy automatically triggers a review. If neither has a {% data variables.product.prodname_copilot_short %} seat, usage is billed to the enterprise or cost center instead. +{% data variables.product.prodname_actions %} minutes are attributed to the repository, and from there to the enterprise or cost center where applicable. {% data variables.product.prodname_ai_credits_short %} are charged to the person who requests the review, or to the author of a pull request where a policy automatically triggers a review. If that person does not have a {% data variables.product.prodname_copilot_short %} seat, usage is billed to the enterprise or cost center instead. For pull requests authored by {% data variables.copilot.copilot_cloud_agent %}, usage is attributed first to the human co-author associated with the change. If the co-author cannot be billed, usage is billed directly to the organization. For pull requests authored by other bots, or when a bot requests the review, usage is also billed directly to the organization. These pull requests are eligible for agentic review. You can view your current {% data variables.product.prodname_actions %} usage for {% data variables.copilot.copilot_code-review_short %} in the following ways: