GitHub's new Copilot default policy takes effect today
From 22 October, any unconfigured Copilot feature in Business and Enterprise orgs follows one global default: enabled, disabled, or left to each organisation. Admins had a 28-day window to set it before this landed.
GitHub’s new default-enablement policy for Copilot takes effect today, 22 October. Announced on 24 September, it gives Copilot Business and Enterprise admins one global switch, enabled, disabled, or let organisations decide, that now governs every generally available Copilot feature and client capability nobody has explicitly configured.
The setting sits on the AI Controls page’s Copilot subpage, under “Default policy for new features”, and it reaches further than chat and completions: it also covers the Copilot Code Review policy on the Agents page and the MCP servers in Copilot policy. Admins got a 28-day window from the September announcement to pick a default before it started governing live access; from today, anything still unconfigured follows whatever was chosen, or GitHub’s default if nobody chose.
Why it matters: if nobody on your team visited that settings page, new Copilot capabilities, including agent and MCP features, may now be switched on for every seat without anyone having decided that on purpose. Worth checking AI Controls today rather than assuming the quiet period just continued.
The caveat: this policy only applies to Copilot Business and Enterprise; individual, non-organisation Copilot accounts aren’t affected.