Changelog

Automated updates from the Copilot Governance Watch workflow are recorded here, newest first. Each entry links to its official source and to the training page(s) that were updated.

2026-10-16

Corrected — telemetry is now supported in the Copilot app (previously listed as unsupported) (enterprise-managed-settings) — Updated: Managed Settings
Added — telemetry.capture fine-grained classes (identity, prompts, responses, toolArguments, toolOutput, policyDetail), legacy captureContent semantics, and managed-telemetry precedence (capture-controls, monitor-agentic-activity) — Updated: Managed Settings

2026-10-14

Corrected — telemetry is now supported in the Copilot app, and forceRemoteSettingsRefresh also applies to the Copilot app and has its own row in the supported-keys table (enterprise-managed-settings, deploy-managed-settings) — Updated: Managed Settings
Added — telemetry.capture classes (identity, prompts, responses, toolArguments, toolOutput, policyDetail) and telemetry precedence/headers rules (capture-controls) — Updated: Managed Settings
Added — Minimum client versions enforced when sandbox is set: VS Code 1.141.0, CLI 1.0.93, Copilot app 1.1.26 (enterprise-managed-settings) — Updated: Managed Settings

2026-10-09

Added — Copilot code review setting “Only allow Copilot code review to be triggered by authorized users” (org/repo) blocks reviews requested with external Copilot licenses (code-review) — Updated: Enterprise & Org Policies
Added — Local sandbox credential masking (sandbox.credentials.envVars / injectHosts) and the bypass caveat (configuring-local-sandbox-settings) — Updated: CLI & App Sandboxing

2026-10-08

Corrected — sandbox now also supports VS Code Agent Host sessions (1.138.0+; enabled: true removes the session toggle from 1.140.0), gitAuth/ghAuth are now auth.git/auth.gh, /sandbox disable is a session-only opt-out unless allowBypass: false, and allowedHosts/allowLocalNetwork/proxy semantics were clarified (enterprise-managed-settings#sandbox) — Updated: Managed Settings, CLI & App Sandboxing, Known Gaps
Added — forceRemoteSettingsRefresh key (CLI and VS Code) and Windows-only sandbox.learningMode (forceRemoteSettingsRefresh, sandbox.learningMode) — Updated: Managed Settings

2026-10-02

Added — New autoTier managed-settings key (CLI and VS Code only) sets the default Auto routing tier; a non-unmanaged string locks it, { "overridable": ... } allows overrides, and it is override-eligible for enterprise teams (enterprise-managed-settings#autotier, override-settings-for-teams#supported-keys) — Updated: Managed Settings

2026-09-26

Corrected — The overridable-keys list for enterprise team overrides was incomplete: extraKnownMarketplaces, strictKnownMarketplaces, and sandbox (wrapped as a whole object) are also override-eligible, not just model, permissions.*, allowedMcpServers, and deniedMcpServers (override-settings-for-teams#supported-keys) — Updated: Managed Settings, Known Gaps
Added — Server-managed deployments now get automatic settings validation surfaced in the enterprise Agents tab (“Copilot settings validation”), checking managed-settings.json, team-mappings.json, and referenced team files for errors/warnings by file and JSON path (get-started#4-validate-and-check-the-settings) — Updated: Managed Settings

2026-09-25

Added — New “Default policy for new features” and “Default availability for released models” enterprise/org policies documented: the models policy is already active (auto-enables new/unconfigured GA models labeled “Delegate to Default Policy”, but not pre-GA models, open-weight models, models outside GitHub’s data-retention agreement, or models conflicting with data-residency/FedRAMP restrictions), while the features policy is configurable now but activates October 22, 2026 for unconfigured GA features, preview→GA transitions, and existing unconfigured GA features — including the Copilot code review and MCP servers policies, but excluding preview features, the data-residency/FedRAMP restrictive model policies, and Store local sessions in the Cloud (default-availability) — Updated: Enterprise & Org Policies, Course Outline, Known Gaps

2026-09-24

Corrected — The sandbox managed-settings key is no longer CLI-only: it now also enforces on the GitHub Copilot app (public preview), and the site’s sub-property list was missing gitAuth, ghAuth, allowDevToolAccess, addCurrentWorkingDirectory, and userPolicy (filesystem/network/macOS Seatbelt) (enterprise-managed-settings#sandbox) — Updated: Managed Settings, CLI & App Sandboxing, Known Gaps, Course Outline
Added — Session data governance for Copilot CLI and the Copilot app: local storage location, the “Store local sessions in the Cloud” sync policy, default share/visibility differences between local and cloud-agent sessions, and available retention controls (share/delete/archive) (session-data) — Updated: Visibility & Audit

2026-09-23

Corrected — Content exclusion is honored by Copilot CLI; only Agent mode in IDE Chat (and third-party agents/Spark) don’t support it (exclude-content-from-copilot, supported-surfaces-for-policies) — Updated: Content Controls, Known Gaps
Corrected — strictKnownMarketplaces supports 8 source types (github, git, url, npm, file, directory, hostPattern, pathPattern), not just 3; extraKnownMarketplaces supports only github/git/directory (enterprise-managed-settings) — Updated: Plugin Marketplaces
Added — Cloud agent custom-instructions file discovery documented: .github/copilot-instructions.md, path-specific .instructions.md, AGENTS.md, CLAUDE.md, GEMINI.md (get-the-best-results) — Updated: Cloud Agent, Course Outline
Added — “Restrict MCP access to registry servers” and “Copilot Memory” policy surface coverage noted in Enterprise & Org Policies (supported-surfaces-for-policies) — Updated: Enterprise & Org Policies, Known Gaps
Added — “Policies for enterprise-assigned users” setting noted for users licensed directly by the enterprise (policies) — Updated: Enterprise & Org Policies

2026-08-18

Added — Initial publication of the enterprise guardrails training as a GitHub Pages site — start with the Mental Model.