GitHub’s global model policy for Copilot Business and Enterprise started enforcement on August 26. The comfortable assumption your team may have relied on — that unconfigured AI models stay off — is now incorrect. Any generally available model that hasn’t been explicitly disabled is now live for every developer on your plan. Enforcement completes across all enterprises on September 1. You have days.
What Changed and Why It Matters #
Until now, adding a new AI model to GitHub Copilot’s roster required an admin to manually enable it. The default was off. That meant enterprises could let new model announcements accumulate while slowly running them through vendor approval or security review processes.
GitHub flipped that. Under the new global model policy, generally available models are enabled by default. A single enterprise-level toggle controls them all. Any model you haven’t explicitly configured now follows the global policy — and the global policy defaults to on.
This matters most to companies with formal AI governance processes: regulated industries, government contractors, organizations with data handling requirements, or any team that needs legal sign-off before a new vendor’s model touches their code. Those organizations may have just had unapproved models enabled without anyone touching a setting.
What’s On, What Stays Off #
Not every model is auto-enabled. GitHub carved out two categories that remain disabled by default regardless of your global policy setting:
Open-weight models— DeepSeek, Kimi K2.7, and similar open-weight options require explicit admin enablement** Data-retention models**— Models that fall outside GitHub’s standard data retention agreement (such as Fable 5) are off by default
Everything else in the generally available catalog — OpenAI’s GPT-5.6 family, Anthropic Claude, Google Gemini, Microsoft MAI models — is on unless you explicitly disable it. Check the full model availability list in GitHub Docs to see exactly which models are affected on your plan.
Six Models Are Gone on August 31 #
Separate from the policy change, GitHub is retiring six models on August 31:
- Gemini 3.1 Pro
- Claude Opus 4.5
- Claude Opus 4.6
- Claude Sonnet 4.5
- Claude Sonnet 4.6 (exception: stays for individual annual plan subscribers)
- Raptor mini
If your team has hardcoded any of these model names — in agent workflows, VS Code extension settings, CI/CD pipelines, or direct Copilot API calls — update them now. Current Claude Sonnet and Opus versions, plus newer Gemini models, are available as drop-ins. See GitHub’s deprecation changelog for replacement guidance.
Enterprise Team Model Targeting Is in Preview #
Beyond the global toggle, GitHub added per-team model granularity in a preview rolling out since late July. It lets admins set a baseline model roster at the enterprise level and then grant additional models to specific teams — frontier teams get experimental models, compliance teams get a tighter list.
The evaluation is least-restrictive: if a user gains access to a model through any team, they can use it everywhere on Copilot. To enable it, go to Copilot settings → Models → “Enterprise teams mode.”
Worth noting alongside this: MCP server allowlists went GA on August 6. You can now centrally control which Model Context Protocol servers Copilot clients are allowed to run, via allowedMcpServers
and deniedMcpServers
keys in your copilot/managed-settings.json
. Policies fail closed — a malformed config is blocked, not silently allowed. Enforcement covers Copilot app, CLI, VS Code, and JetBrains.
What to Do Before September 1 #
Three things, in order of urgency:
Audit your global model policy. Go to your Copilot enterprise settings and check what’s enabled. If you need stricter control, disable the global policy and configure models individually.Find and update deprecated model references. Search your repos, CI configs, and agent definitions for Gemini 3.1 Pro, Claude Opus 4.5/4.6, Claude Sonnet 4.5/4.6, and Raptor mini. Replace them before August 31.Configure your MCP allowlist if you haven’t already.Enterprise team model targetingand MCP governance are both available now and worth setting up while you’re already in the admin console.
GitHub’s direction is clear: as AI models proliferate, opt-out is the new default. The 28-day configuration window before enforcement was a reasonable heads-up for most organizations. For regulated industries, it probably wasn’t enough. Either way, the window is closed.