Deploy managed Copilot settings via MDM in VS Code and CLI

GitHub announced general availability of managed Copilot settings deployment via MDM and file-based configuration for VS Code and CLI, enabling enterprise administrators to enforce governance policies directly on devices using tools like Microsoft Intune, Jamf, or Group Policy. The settings apply consistently across VS Code and Copilot CLI regardless of developer sign-in, with native MDM taking highest precedence among delivery channels.

Deploy managed Copilot settings via MDM in VS Code and CLI Enterprise administrators can now deliver managed GitHub Copilot settings directly to devices through native mobile device management MDM and file-based configuration, in addition to the existing server-managed channel. This is generally available for GitHub Copilot CLI and VS Code. Device-level deployment lets you enforce Copilot governance using the same tools you already use to manage endpoints. You can push settings through Microsoft Intune, Jamf, or Group Policy, or deploy a configuration file with Chef, Puppet, or Ansible. Because settings are read from the device, they apply consistently across VS Code and Copilot CLI, regardless of how a developer signs in. Delivery channels delivery-channels You can deliver managed settings through any of three channels, all of which use the same keys and values. Native MDM reads OS-level managed preferences. On Windows, settings come from the HKEY LOCAL MACHINE\SOFTWARE\Policies\GitHubCopilot registry key. On macOS, they come from managed preferences for the com.github.copilot domain. File-based reads a managed-settings.json file from a well-known path i.e, /Library/Application Support/GitHubCopilot/managed-settings.json on macOS, %ProgramFiles%\GitHubCopilot\managed-settings.json on Windows, and /etc/github-copilot/managed-settings.json on Linux . File-based settings must be owned by root and cannot be world-writable or symlinked. Server-managed resolves settings from the developer’s signed-in GitHub account via managed-settings.json in your organization’s .github-private repository. When more than one channel provides settings, the highest-precedence channel wins outright, in this order: - Native MDM - Server-managed - File-based Supported settings supported-settings The device-level channels support the same managed setting keys as the server-managed channel, including: permissions.disableBypassPermissionsMode model enabledPlugins extraKnownMarketplaces strictKnownMarketplaces telemetry. for OpenTelemetry export configuration Scalar settings use their dot-separated key directly, while structured settings such as enabledPlugins are supplied as a JSON string value. Additional keys will be added over time. Getting started getting-started To learn how to deploy managed settings to your devices, see Deploy Copilot managed settings https://code.visualstudio.com/docs/enterprise/ai-settings deploy-copilot-managed-settings . For the full list of keys and the settings they control, see Configure enterprise managed settings https://docs.github.com/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-agents/configure-enterprise-managed-settings . Join the discussion within GitHub Community https://github.com/orgs/community/discussions/199139 .