Enterprise governance playbook
Locking Down
GitHub Copilot
A practical guide to the controls, policies, and audit layers that keep Copilot useful, secure, and aligned with your organization.
Start with the mental model
Kept current automatically
Where controls live
| Layer | Examples | Applies to |
|---|---|---|
| Enterprise/Org Policies (“AI controls”) | Feature enable/disable, model access, cloud agent per-org allow | Whatever surfaces the policy covers |
managed-settings.json |
MCP allow/deny, marketplaces, plugins, sandbox, permissions | CLI, VS Code, Copilot app, cloud agent, JetBrains |
| Content controls | Content exclusion, public-code matching | Suggestion/context generation |
| Network controls | IP allow lists, subscription routing, cloud agent firewall | Access to GitHub/Copilot infra |
| Visibility/audit | Audit log, streaming, usage metrics | Governance/monitoring, not prevention |
Golden rule for conflicts: enterprise beats org; across multiple orgs in one enterprise, least-restrictive usually wins except for a sensitive shortlist; across multiple enterprises, most-restrictive wins.
Sections
- 01Mental Model: Where Controls LiveRead section
- 02Enterprise & Org Policies (AI controls)Read section
- 03managed-settings.json — The Core Enterprise Lockdown FileRead section
- 04MCP Server Governance (Deep Dive)Read section
- 05Plugin Marketplace GovernanceRead section
- 06Copilot Coding (Cloud) Agent RestrictionsRead section
- 07Copilot CLI & App SandboxingRead section
- 08Content & Suggestion ControlsRead section
- 09Network-Level ControlsRead section
- 10Visibility & Audit (governance, not prevention)Read section
- 11Model & Data GovernanceRead section
- 12Plan-Tier GatingRead section
- 13Suggested Training Course OutlineRead section
- 14Known Gaps to VerifyRead section
- ··ChangelogRead section
How this site stays current
A scheduled agentic workflow runs daily (hourly during confirmed GitHub/Microsoft live events), reviews the GitHub Blog changelog and GitHub Copilot documentation, and opens a pull request when governance guidance needs updating or a new control has shipped.