Copilot CLI & App Sandboxing

Official documentation

Administering Copilot CLI for your enterprise

About cloud and local sandboxes

Enterprise managed settings reference: sandbox

Configuring local sandbox settings: masking environment variables

Using local sandboxing

Related sections: Managed Settings · Cloud Agent Restrictions

Enterprise AI controls → Copilot Clients → Copilot CLI dropdown enables/disables CLI independently of the Copilot app.
permissions.disableBypassPermissionsMode: kills “YOLO”/bypass-all mode.
Corrected: local sandboxing is generally available in Copilot CLI, the GitHub Copilot app, and VS Code Agent Host sessions. The sandbox managed-settings key enforces on the app as well as Copilot CLI — minimum restrictions on command execution, filesystem/network access, credentials, local MCP/LSP servers — cumulative-restrictive across MDM/server/file/user layers (see the precedence exception). The public-preview notice applies to cloud sandboxes, not local sandboxing.
Corrected: sandbox also enforces for Agent Host sessions in VS Code 1.138.0+, and the CLI’s /sandbox disable is a session-only opt-out that only allowBypass: false blocks.
In app sessions, the embedded runtime enforces the complete effective managed sandbox object, including properties not shown in the app’s own project settings UI — the app only displays the user’s project settings, not per-setting managed locks.
Masked environment variables (local sandbox): users can mask extra env vars via the /sandbox Credentials tab or sandbox.credentials.envVars (each with non-empty injectHosts); sandboxed processes get placeholders and a local proxy injects real values only into HTTPS request headers to those hosts. Git/gh auth use this automatically when their authentication settings are enabled. Adding an inject host does not grant network access, and an approved sandbox bypass runs the command with real secrets and no masking.
Model selection in CLI is capped to whatever models are enterprise-enabled; custom model API keys can be supplied by admins.